I got an email saying they have a video of me — is it real?

Why the email quotes a password you recognise, why there is almost never a video, what paying actually does, and the different route when the threat is real.

Difficulty: beginner
Time: 5 min
Read: 3 min
Safety: caution

Short answer

Almost certainly not real. The standard version is sent to millions of addresses at once, and the password it quotes comes from an old data breach, not from your computer. There is no video. Do not pay, do not reply, and change that password anywhere you still use it. Report it and delete it.

The email says your webcam was accessed, that a recording exists, and that it will go to your contacts unless you pay in cryptocurrency within a short deadline. It often opens by quoting a real password of yours, which is what makes it land. That password almost always comes from a breach of a website you used years ago, and it is being used as a cheap proof of something that never happened.

Safety

In the mass-mailed version there is no video and no access to your device, and paying achieves nothing except marking you as someone who pays. The separate, genuine case — where you did send images to someone who is now threatening you — is handled differently and there is specialist UK help for it. Never pay, in either case, and do not delete the messages, because they are evidence.

What the blackmail email claims, and what actually happened

Step by step

Do not pay, and do not reply.Payment confirms a live, frightened reader. Replying does the same. Both lead to more demands, and the wallet addresses in these campaigns show the pattern clearly.
Work out where the password came from.Check your email address on a reputable breach-checking service. If the quoted password appears in a known breach, that is where it came from, and the email tells you nothing about your device.
Change that password everywhere you used it.This is the one genuinely useful action. If that password is still in use anywhere — particularly on email — change it, and change it anywhere you reused it. That is the real risk the email has revealed.
Turn on two-factor authentication on your email.It is the account that protects every other account, and it is the one an old breached password most endangers.
Check the claims against reality.Ask whether the camera has ever been in a position to record what is described, whether the device has a camera at all, and whether the email contains any actual evidence. It never does, because there is nothing to show.
Report it and delete it.Forward it to report@phishing.gov.uk, report it to Action Fraud or Police Scotland on 101, and then delete it. Mark it as spam so the filter learns.
Handle the genuine case differently.If you really did share intimate images with someone who is now demanding money, stop all contact, do not pay, keep every message and account name, and get specialist help. In the UK the Revenge Porn Helpline supports adults, StopNCII.org can prevent images being uploaded to major platforms without you sending the images anywhere, and it is a criminal offence to threaten to share them. Report it to the police.
If the person affected is under 18, use the child protection route.Report to CEOP, and the Internet Watch Foundation and Childline run the Report Remove service for under-18s. This is treated as child sexual abuse material and the response is different and urgent.

Tips

Covering the webcam costs nothing and removes the worry, but do not read the email as evidence that anything was ever recorded.
These waves are automated. The same template goes out to millions of addresses with the password field filled in from a leaked list, which is why the details are always vague.
If you feel unable to talk to anyone about it, that reaction is exactly what the message is built on. Tell one person. It changes what you do next.

Common mistakes

Paying a small amount to make it go away — It never goes away. Payment marks the address as responsive and produces a second demand almost immediately.
Deleting everything in a panic — If the threat turns out to be genuine, the messages, wallet addresses and account names are the evidence the police need.
Assuming your device is infected — In the mass-mailed version there is no access to your device at all. The password came from a website breach, not from you.

Questions people ask

They quoted my actual password — how?

From a data breach of a site you signed up to, often years ago, sold or published as a list of address-and-password pairs. It proves the site was breached, not that your computer was.

Should I tell my family in case it is real?

In the mass-mailed version there is nothing to be sent. If you are genuinely worried, telling one person you trust removes most of the power the threat has.

Is threatening to share intimate images a crime in the UK?

Yes. Sharing or threatening to share intimate images without consent is a criminal offence, and the threat alone is enough to report to the police.