Northumbria Police have reported that Action Fraud are urging the public to look out for phishing emails that relate to extortion. They state that the Suspicious Email Reporting Service (SERS) received over 2,924 reports in March 2025. This is a huge increase when you see it compared to the previous month when only 133 reports were made.
Extortion scam
The National Cyber Security Centre’s SERS received phishing emails relating to a type of extortion referred to as ‘Financially Motivated Sexual Extortion’ (FMSE).
The reports suggest that both the subject lines and phrasing of the email can vary, but the theme remains consistent. It is said that the phishing email claims to have installed malware on the recipient’s computer and recorded them visiting adult websites. Action Fraud goes on to say that, “the sender will then coerce the email recipient to pay a ransom demand by threatening to release the videos. The ransom is usually demanded in a form of cryptocurrency, such as Bitcoin”.
Emails will often include genuine pieces of personal information relating to the victim, in order to make these phishing attacks convincing. These might include a password or home address; it is probably the case that these would have been obtained from historic breaches of personal data.
According to analysis, many people who received these emails also later reported becoming victims of online account hacking.
Action Fraud relates that last year a male victim, said to be in his thirties received a number of extortion emails that contained a password he had used for one of his online accounts. In all, the emails demanded a ransom of $500. The man deleted the emails, having correctly identified the emails as a scam. However, Action Fraud reported that, “shortly afterwards he noticed that he was unable to login to one of his social media accounts. After some checking, he realised that one of his bank accounts and multiple social media accounts had been hacked and he was locked out of them”.
What should you do if you receive one of these emails?
If you receive an email like this Action Fraud have suggested that you do the following:
“As with other phishing emails, do not to engage with the phisher, forward the email to report@phishing.gov.uk, which is the NCSC’s Suspicious Email Reporting Service (SERS), and then delete it.
“If you are considering paying the Bitcoin ransom, you should be aware that doing so, you will likely become the target of more scams, as the phisher will know they have a ‘willing’ customer.
“The inclusion of genuine passwords or other personal information in phishing emails is a strong indication that you may have been affected by a historic data breach. To verify if you have had data breaches in the past, you can click here to access a service that checks if any accounts were affected.
“If the phishing email includes a password you still use, then change it immediately. Advice on how to create suitable passwords and enable other factors of authentication is available by clicking here.”
Action Fraud also suggests that If you have been a victim of extortion, or you are concerned that someone may be in possession of intimate images of you, you should “report it to your local police force by calling 101”.
Find out how to protect yourself from fraud here.
If you’ve lost money or provided financial information as a result of any phishing scam, notify your bank immediately and report it to Action Fraud at by clicking here or by calling 0300 123 2040. In Scotland, call Police Scotland on 101.
CLICK HERE TO DONATE TO OUR CROWDFUNDER
HELP US BECOME STRONGER SO THAT WE CAN CONTINUE TO DELIVER POWERFUL CITIZEN JOURNALISM!
