An extortion email that displays an old password is not, by itself, proof that the sender currently controls your Gmail account or camera. Passwords can circulate from earlier breaches. Take the credential exposure seriously while assessing the threat through evidence rather than the attacker’s claims.
Do not engage with the demand
The UK’s NCSC describes mass sextortion messages that use plausible technical language and previously exposed passwords to frighten recipients into paying. Its guidance advises against engaging or paying. A payment is not a reliable way to make an attacker erase data or stop contacting you.
Do not open attachments, install a purported cleanup tool, or send additional personal information. Preserve the message privately if you need to report threats or an actual incident.
Secure any credential that remains in use
- Go directly to the affected service’s official security settings.
- Change a disclosed password that is still active, using a strong unique replacement.
- Change it on other accounts where it was reused.
- Review account activity, recovery options, verification methods, and unfamiliar authorized access.
For Gmail, inspect forwarding, delegates, and filters as well. A password change alone should not be assumed to explain or remove every unauthorized mailbox setting.
Distinguish a mass scam from a specific ongoing threat
A generic demand and an old password are different from verified current access, a targeted threat, or real private material being used against you. Do not dismiss specific evidence merely because many similar emails are scams.
Report phishing through Gmail and use the relevant local cybercrime or law-enforcement channel when appropriate. The NCSC’s reporting details are UK-specific; readers elsewhere should use their own jurisdiction’s official reporting route. Seek trusted personal or specialist support if the threat is distressing, particularly where a child or vulnerable person is involved.
Do not publish the password, private images, or the full email to ask strangers whether it is genuine. Keep evidence limited to approved support channels and avoid paid recovery offers that arrive through unsolicited messages.
Browse Gmail & Google Account help
References
Reviewed against the linked product guidance, standards, and identified vendor or public-authority guidance on October 29, 2026. Available options and screen labels can vary by account, device, region, and organization policy.