‘Sextortion’ emails are on the rise as scammers target unsuspecting Canadians by threatening to make “private camera recordings” public unless a Bitcoin payment is made, the country’s central anti-fraud agency warns.
Many Canadians are receiving messages that look like they come from either their own email address or a fraudulent one, falsely claiming the sender has gained access to their device and webcam, the Canadian Anti-Fraud Centre said in a recent social media post.
The emails claim to have compromised the victim’s device with malware and that the extortionist now has complete access to accounts and full control over the device. These emails often attempt to establish authenticity by including a victim’s current or previous password.
“The email will accuse you of being recorded during private or inappropriate activity and threaten that if you don’t send a Bitcoin payment immediately, the video will be shared with all of your contacts,” the agency said.
The email is a ruse, however. The password provided in the extortion email was likely acquired from an earlier data breach, the agency said, adding that the sender also lacks the ability to access anyone’s camera.
The agency posted an example of one scam currently in circulation. In this instance, the scammers say they have compromised the victim’s device with their private malware to record footage through the victim’s webcam.
It threatens to share the videos with family and friends, as well as with the victim’s social networks and the dark web unless an $800 Bitcoin payment is made to the scammer’s wallet within three days. The message then promises to allow the victim’s “peaceful life” to continue.
The anti-fraud centre said anyone receiving such a message should immediately change their password and report the scam. The centre acts as a central agency for reporting scams—even if no money was lost—to help police identify new trends in fraud crime.
The centre recommends anyone with online accounts create unique passwords for every online account including social networks, emails, and financial institutions. The passwords should consist of at least eight characters, incorporating both uppercase and lowercase letters, as well as a minimum of one numeral and a symbol.
The agency also suggests enabling multi-factor authentication, only logging into accounts from trusted sources, and never revealing personal information over social media. It also advises against clicking on links received via text message or email and verifying website URLs before visiting any site.
