The CW Corner – Those “We Watched You On Adult Sites” Emails Are Scams

by Charles Oropallo | May 30, 2026 | Email, Internet, Security

Just thought I would post this informational piece reassuring you that those “We Watched You On Adult Sites” sextortion emails are scams!

The Email That Shocks People

I have seen these emails for many years.

They usually start with a nasty claim.

The sender says they hacked your computer.

Then they say they watched you visit adult websites.

Next, they claim they recorded you through your camera.

After that, they demand money, usually in cryptocurrency.

Finally, they threaten to send the “video” to your contacts.

That message scares people fast.

It uses shame, fear, confusion, and urgency.

That is exactly why scammers send it.

They do not need to hack everyone.

They only need to scare enough people.

The Big Secret About These Emails

Most of these emails are complete garbage.

The scammer does not have a video.

The scammer did not watch you.

The scammer did not hack your camera.

The scammer probably does not know you.

The scammer usually only has your email address.

Sometimes they also have an old password.

That old password may scare people even more.

However, that password often came from an old breach.

It may have nothing to do with your current email account.

That detail gives the scam more punch.

The scammer wants you to think, “Oh no, they know me.”

That is the hook.

Why They Mention Adult Websites

The adult website claim does a lot of work.

First, it creates embarrassment.

Second, it makes people hesitate to ask for help.

Third, it makes people panic.

Fourth, it makes people act alone.

That is exactly what the scammer wants.

Scammers love silence.

They want you scared, ashamed, and isolated.

They do not want you calling your web person.

They do not want you asking your spouse.

They do not want you asking your office manager.

They want you thinking in panic mode.

Panic makes people click.

Panic makes people pay.

Panic makes smart people ignore common sense.

The Psychology Behind The Scam

These scams work because they hit deep human fears.

Most people fear public embarrassment.

Most people fear losing trust.

Most people fear family conflict.

Most people fear business damage.

Most people fear being judged.

The scammer pushes all those buttons at once.

That makes the message feel powerful.

However, the message only has power if you believe it.

Once you understand the trick, it loses its teeth.

It becomes spam with a costume on.

An ugly costume, yes.

But still spam.

They Use Urgency To Shut Down Thinking

Most of these emails include a deadline.

They may say you have 24 hours.

They may say you have 48 hours.

They may claim a timer started when you opened the email.

That is nonsense.

They want you to move fast.

They know calm people ask questions.

They know calm people check facts.

They know calm people call support.

So they try to steal your calm.

They try to rush you.

That rushed feeling matters.

Whenever a message screams “act now,” slow down.

That rule saves people from many scams.

They Use Technical Jargon To Sound Real

The emails often include computer words.

They may mention malware.

They may mention spyware.

They may mention remote access.

They may mention operating systems.

They may mention your router.

They may mention your camera.

They may mention tracking pixels.

They may mention your browser history.

Most of that talk means nothing.

The scammer throws technical words like confetti.

They hope one word sounds scary enough.

They do not need accuracy.

They need fear.

A real technician can usually spot the nonsense quickly.

But regular users may feel overwhelmed.

That is part of the trap.

They Want Cryptocurrency For A Reason

These scammers usually demand Bitcoin or another cryptocurrency.

They do this because crypto payments move differently.

Banks can sometimes reverse or trace certain payments.

Credit card companies may help fraud victims.

However, crypto payments usually do not work that way.

Once you send the money, it often disappears.

That is why scammers love it.

They also know many people find crypto confusing.

Confusion helps the scammer.

The harder the payment process feels, the more serious it may seem.

That is another trick.

A complicated payment does not prove a real threat.

It only proves the scammer wants hard-to-recover money.

Your Email Address On The Dark Web

People often panic when they hear “dark web.”

That phrase sounds terrifying.

However, an email address on a leaked list means very little.

Your email address may appear in many places.

A store may leak it.

A service provider may leak it.

A social website may leak it.

A newsletter company may leak it.

An old vendor may leak it.

That does not mean your mailbox was hacked.

It means your address joined spammer lists.

That can increase junk mail.

It can also increase targeted scaremail.

Still, the address alone gives them no magic power.

They cannot control your account because they know your address.

They need your password too.

They may also need a second security step.

Old Passwords Make The Scam Feel Real

Some scam emails include a password.

That scares people more than anything else.

I understand why.

Seeing a real password in a threat feels personal.

However, that password often came from an old breach.

Maybe you used it years ago.

Maybe you used it on another website.

Maybe that website stored passwords badly.

Then criminals dumped the stolen data online.

Later, another scammer grabbed that list.

Now they send scary emails using old passwords.

That does not prove they logged into your current email.

It proves they found old leaked data.

Still, you should never ignore that clue.

Change any account that still uses that password.

Never reuse that password again.

Why Smart People Fall For It

Smart people fall for scams every day.

That does not make them foolish.

It makes them human.

Scammers do not attack intelligence first.

They attack emotions first.

They attack fear.

They attack shame.

They attack urgency.

They attack trust.

They attack exhaustion.

They attack busy mornings.

They attack stressful afternoons.

They attack people during real life.

A business owner may read the email between customers.

A parent may read it while handling family stress.

An employee may read it before a meeting.

That timing helps scammers.

The scammer only needs one bad moment.

The Scammer Plays A Numbers Game

These criminals send huge numbers of messages.

They do not need most people to pay.

They only need a small number.

Suppose they send 100,000 emails.

Suppose only 20 people pay.

That can still make the scam profitable.

That is why these scams keep coming.

They work often enough.

They cost almost nothing to send.

They also reach people around the world instantly.

That ugly math keeps the scam alive.

They Copy And Reuse The Same Scripts

I have seen these messages many times.

They change a few words.

They change the payment wallet.

They change the deadline.

They change the claimed method.

But the story stays mostly the same.

They say they hacked you.

They say they watched you.

They say they recorded you.

They say they will expose you.

They say you must pay quickly.

That script has circulated for years.

The scammer may sound personal.

But most messages are mass-produced.

They read like form letters with threats added.

Sometimes They Spoof Your Own Address

Some versions look like they came from your own email address.

That really scares people.

They think, “They must control my account.”

Not necessarily.

Email spoofing can fake the visible sender address.

It works like writing a fake return address on an envelope.

The message may look like it came from you.

But the mail server records often tell another story.

That is why headers matter.

A proper mail check can show whether the account sent it.

Most users never see those details.

So the fake sender line does its job.

It creates fear.

What Real Account Compromise Looks Like

A real hacked mailbox usually leaves signs.

You may see strange messages in Sent Items.

You may find deleted messages you never deleted.

You may see forwarding rules you never created.

You may find filters moving mail secretly.

You may receive password reset notices.

You may see login alerts from strange locations.

Your contacts may receive spam from your account.

Your mailbox may suddenly lock you out.

Those signs deserve fast attention.

A scary sextortion email alone does not prove compromise.

It proves someone sent you a scary email.

That is different.

What To Do When You Receive One

Do not reply.

Do not pay.

Do not click links.

Do not open attachments.

Do not scan strange quick response codes.

Do not call phone numbers inside the message.

Do not negotiate.

Do not explain yourself.

Do not threaten the scammer.

Do not send any personal information.

Mark the message as spam or junk.

Then delete it.

If you feel unsure, ask a trusted technical person.

A second set of eyes helps.

Scammers hate second opinions.

When You Should Change Passwords

Change your email password if you feel unsure.

That step can bring peace of mind.

Also change it if the email shows an old password.

Change it if you reused that password anywhere.

Change it if your account shows strange activity.

Change it if you cannot remember when you last changed it.

Use a strong password.

Use a unique password.

Do not reuse passwords across accounts.

A reused password turns one breach into many problems.

That risk causes real trouble.

Why Password Reuse Hurts People

Many people use the same password everywhere.

I understand why.

Nobody wants to remember dozens of passwords.

However, password reuse creates a big risk.

One weak website can expose your password.

Then criminals try that password on email.

They try it on banking websites.

They try it on shopping accounts.

They try it on social media.

They try it on web hosting accounts.

This attack has a name.

People call it credential stuffing.

The scammer stuffs known passwords into other login pages.

If you reused the password, they may get in.

That is why unique passwords matter.

Use A Password Manager If Possible

A password manager can help a lot.

It stores strong passwords for you.

It also creates different passwords for each site.

That means one breach does not unlock everything.

Some people prefer written password books.

That can still beat password reuse.

The main goal stays simple.

Use different passwords for important accounts.

Email matters most.

Your email account often unlocks everything else.

Password reset links usually go there.

Protect email like the front door.

Turn On Two-Step Login When Available

Two-step login adds another layer.

People also call it multi-factor authentication.

That means a password alone does not open the account.

The account also needs a code or approval.

This extra step blocks many attacks.

It does not stop every scam.

But it helps greatly.

Use it on email when available.

Use it on banking accounts.

Use it on domain registrar accounts.

Use it on web hosting accounts.

Use it on social media.

Use it anywhere that matters.

Businesses Need Extra Caution

Business email carries extra risk.

A hacked business mailbox can cause serious damage.

Scammers may read invoices.

They may watch customer conversations.

They may change payment instructions.

They may impersonate employees.

They may trick customers.

They may steal files.

They may reset passwords for other services.

So businesses should treat mailbox security seriously.

That does not mean every scary email proves a hack.

It means we should check calmly.

Good checks beat panic every time.

What I Check For Customers

When a customer calls me about these emails, I look for real signs.

I check recent logins when possible.

I check sent mail.

I check forwarding settings.

I check autoresponders.

I check mailbox rules.

I check suspicious password reset messages.

I check whether contacts received spam.

I also ask what the email actually said.

Many times, the message matches the same old scam script.

At that point, I can usually reassure the customer.

Then we change passwords if needed.

That gives both safety and peace of mind.

Why The Messages Sound So Disgusting

The disgusting wording serves a purpose.

The scammer wants an emotional reaction.

Gross language causes shock.

Shock shortens thinking.

The more disgusting the email feels, the less likely people share it.

That helps the scammer.

The victim may feel embarrassed even discussing it.

But nobody should feel embarrassed.

The scammer wrote the garbage.

The victim only received it.

That difference matters.

Receiving filth does not make someone guilty.

It makes them a target.

The Threat To Send It To Contacts

This threat appears in many versions.

The scammer may claim they copied your contacts.

They may claim they will email everyone.

They may mention family, friends, or coworkers.

That threat works because relationships matter.

People naturally want to protect loved ones.

They also want to protect reputations.

The scammer knows that.

So they threaten social damage.

Most of the time, they have nothing.

They only have words.

They hope your imagination does the rest.

The Fake Timer Trick

Some messages claim they know when you opened the email.

Some claim a timer started at that moment.

Some claim they installed tracking software.

Most of this is nonsense.

Regular marketing emails can use tracking pixels.

That only shows whether someone opened a message.

It does not prove hacking.

It does not prove camera access.

It does not prove device control.

The scammer uses simple ideas to create fear.

Again, they need panic.

They do not need truth.

Why They Mention Malware

Malware sounds scary.

So scammers mention it often.

They may claim they installed a “Trojan.”

They may claim they control your screen.

They may claim they copied your files.

They may claim your antivirus missed it.

Sometimes malware infections do happen in real life.

But these emails usually provide no real proof.

They do not show a file.

They do not show a screenshot.

They do not show real details.

They only make broad claims.

Broad claims require broad doubt.

Ask For Proof Without Replying

Here is the funny part.

Real attackers usually prove access quickly.

They may show a real screenshot.

They may list files.

They may send logs.

They may show recent private data.

These sextortion scammers usually show none of that.

They just make claims.

However, do not reply and ask for proof.

That only confirms your address works.

It may invite more messages.

Instead, ask your technical support person.

Let them review the message safely.

Why Paying Makes Things Worse

Paying does not buy safety.

Paying marks you as profitable.

The scammer may demand more.

Other scammers may target you later.

They may share your address with more criminals.

They may say the first payment failed.

They may invent another fee.

They may keep threatening you.

Scammers do not honor agreements.

Their whole business runs on lies.

So paying rarely ends the problem.

It can make it grow.

What To Tell Employees

Employees need simple rules.

Do not panic.

Do not reply.

Do not pay.

Do not click.

Report the message.

Save it for review if needed.

Then let the right person inspect it.

That process protects the business.

It also protects the employee from embarrassment.

Make sure staff know these scams exist.

People handle threats better when they expect them.

Surprise helps scammers.

Training removes surprise.

What To Tell Family Members

Family members need reassurance first.

These messages can feel deeply upsetting.

Start by saying, “This is a common scam.”

Then explain the basic trick.

Tell them the scammer likely has no video.

Tell them not to answer.

Tell them not to send money.

Tell them you can help check the account.

That calm response matters.

Fear shrinks when people feel supported.

Nobody should face these emails alone.

Why Older Adults Get Targeted

Scammers often target older adults.

But they also target everyone else.

Older adults may have more savings.

They may feel less confident with technology.

They may also respect official-sounding messages.

However, younger people fall for scams too.

These criminals do not care about age.

They care about fear and money.

Still, older adults deserve extra patience.

Nobody should shame someone for asking.

Asking for help means the scammer lost.

Why Business Owners Get Targeted

Business owners publish contact information everywhere.

They list email addresses on websites.

They appear in directories.

They register domains.

They join networking groups.

They advertise services.

That public visibility helps customers.

It also helps scammers find targets.

So business owners often receive more junk.

That does not mean they did anything wrong.

It means they operate in public.

A public email address attracts spam.

That is just the ugly side of doing business online.

The Role Of Data Breaches

Data breaches feed these scams.

A breach may expose names.

It may expose email addresses.

It may expose phone numbers.

It may expose mailing addresses.

It may expose old passwords.

It may expose customer records.

Scammers combine those pieces.

Then they create messages that feel personal.

A message with your name feels stronger.

A message with your old password feels stronger.

A message after a known breach feels stronger.

But stronger does not mean true.

It only means more convincing.

What “Dark Web” Really Means Here

The dark web sounds mysterious.

Sometimes criminals do sell stolen data there.

However, many leaked lists also circulate elsewhere.

Scammers may buy or download those lists.

Then they blast messages to thousands of people.

So “your email is on the dark web” often means this.

Your address exists in stolen or shared spammer data.

That is unpleasant.

But it does not automatically mean disaster.

It means you should use better password habits.

It also means you should expect more phishing.

The Difference Between Spam And A Hack

Spam means someone sent you unwanted mail.

A hack means someone gained access.

Those are very different things.

A spammer can email anyone.

They do not need your password.

They do not need your computer.

They only need your address.

A hacker needs access.

They need credentials, malware, or another weakness.

Do not confuse receiving a threat with being hacked.

That mistake causes needless panic.

It also helps the scammer.

Why Checking Headers Helps

Email headers show the path a message took.

They can reveal sending servers.

They can show authentication results.

They can show whether mail passed security checks.

Headers look confusing.

I do not expect most users to read them.

But support people can use them.

Headers help separate spoofing from real account use.

They also help spot forged sender addresses.

That is why I like seeing the original email.

Screenshots help sometimes.

Original headers help much more.

Never Trust The Display Name Alone

Email programs often show friendly names.

That display name can say almost anything.

It may say your name.

It may say your company name.

It may say your bank.

It may say Microsoft.

It may say your own email address.

That does not prove anything.

Look at the actual address.

Even then, remember spoofing exists.

The display name gives scammers a costume.

Do not trust the costume.

Check the source.

Phone Scams Use Similar Psychology

Email scams and phone scams use the same tricks.

A caller may claim to be from a bank.

They may claim fraud already happened.

They may claim police action will follow.

They may claim your computer has viruses.

They may claim your account will close.

They push fear and urgency.

Then they demand action.

They may tell you not to hang up.

They may tell you not to call anyone.

That is a giant warning sign.

Real help does not fear verification.

Scammers do.

The Bank Scam Pattern

A fake bank caller may sound professional.

They may know some real information.

They may spoof the bank phone number.

They may say your account faces danger.

Then they ask for codes, passwords, or transfers.

That pattern resembles sextortion scams.

Both scams create fear.

Both scams demand fast action.

Both scams isolate the victim.

Both scams punish calm thinking.

That is why the same safety rule works.

Stop.

Breathe.

Verify independently.

Use a known phone number.

Do not use the number they provide.

Why Shame Keeps Scams Alive

Shame gives scammers cover.

People feel embarrassed.

So they hide the message.

Then they make decisions alone.

That is dangerous.

Nobody should feel ashamed for receiving a scam.

The criminal chose the topic.

The criminal chose the words.

The criminal created the threat.

The recipient did nothing wrong.

Talking about these emails breaks the scammer’s power.

That is why I keep writing about them.

People need plain warnings before panic strikes.

How To Respond As A Business

A business should have a simple reporting process.

Staff should know where to send suspicious emails.

They should know not to click.

They should know not to reply.

They should know not to forward dangerous attachments casually.

They should know to ask for help.

The process should feel safe.

If employees fear blame, they may hide mistakes.

That helps scammers.

A good business culture rewards quick reporting.

Fast reporting protects everyone.

What I Would Tell A Customer

I would say this plainly.

“You received a common scam email.”

“The sender probably did not hack you.”

“They likely got your address from a leaked list.”

“Do not pay them.”

“Do not answer them.”

“We can change your password as a precaution.”

“We can also check your account for suspicious activity.”

That message calms people.

It also gives them action steps.

Fear needs a plan.

A plan restores control.

What Counts As A Real Emergency

Some signs deserve immediate action.

You cannot log into your mailbox.

Customers report spam from your address.

You see strange sent messages.

You find forwarding rules you did not create.

You receive many password reset alerts.

You see successful logins from strange locations.

Money movement instructions changed unexpectedly.

Your website admin account shows strange logins.

Those signs need quick work.

Change passwords.

Check recovery addresses.

Review mailbox rules.

Contact support.

Do not wait.

Why Scammers Keep Using This Exact Scam

They keep using it because it works.

They do not need creativity.

They need results.

Fear works.

Shame works.

Urgency works.

Technical confusion works.

Cryptocurrency confusion works.

Old breached passwords work.

So they keep recycling the same idea.

That does not mean the threat is real.

It means the scam still makes money.

Scams survive when people pay.

Education cuts their income.

Teach People Before They Get Hit

The best time to explain this scam comes before someone receives it.

A calm person learns better.

A frightened person struggles to process details.

So share examples.

Explain the pattern.

Explain the fake threats.

Explain the payment demand.

Explain the no-reply rule.

Explain password safety.

Then people recognize the scam later.

Recognition changes everything.

The message still looks ugly.

But it no longer feels mysterious.

A Simple Rule For Scary Messages

Here is one rule I like.

The scarier the message sounds, the slower you should move.

Scammers want speed.

You should choose delay.

Scammers want secrecy.

You should ask someone trusted.

Scammers want payment.

You should verify first.

Scammers want panic.

You should breathe.

That rule works for email.

It works for phone calls.

It works for text messages.

It works for fake invoices.

It works for many online threats.

What Not To Do

Do not send money.

Do not send gift cards.

Do not send cryptocurrency.

Do not send passwords.

Do not send verification codes.

Do not install remote access software.

Do not let a stranger control your computer.

Do not click links in the threat.

Do not open attachments.

Do not continue a conversation with the scammer.

Every one of those actions helps them.

The safest response usually feels boring.

Ignore, report, delete, and secure your accounts.

Boring beats broke.

Why Reporting Still Matters

Reporting helps mail systems learn.

Mark the message as spam or junk.

That can improve filtering.

Businesses may also save samples for review.

Support teams can inspect patterns.

They can block sending sources.

They can update filters.

They can warn other users.

Reporting does not always stop every message.

But it helps.

Deleting alone removes your copy.

Reporting may help protect others.

The Human Side Of This

These emails upset real people.

I have seen customers feel embarrassed.

I have seen people feel afraid.

I have seen people worry about family damage.

I have seen business owners fear reputation harm.

That reaction makes sense.

The scammer designed the email to hurt.

So we should respond with patience.

We should not laugh at the victim.

We can laugh at the scam.

But we should support the person.

Calm support beats shame.

My View After 28 Years In This Business

I have been in this business for over 28 years.

I have seen nearly every scam angle.

I have received endless phishing emails.

I have received scam phone calls.

I have seen fake invoices.

I have seen fake domain renewals.

I have seen fake bank alerts.

I have seen fake tech support warnings.

I have seen fake password threats.

I have seen fake sextortion emails.

The wording changes.

The trick stays the same.

They want fear to outrun judgment.

That is the whole game.

Final Advice

Do not let these emails control you.

They look nasty.

They sound personal.

They feel urgent.

But they usually come from bulk scam operations.

Treat them like criminal junk mail.

Do not reply.

Do not pay.

Do not click.

Change passwords when needed.

Use unique passwords.

Turn on two-step login where possible.

Ask a trusted support person when unsure.

Most importantly, do not let shame silence you.

That silence helps the scammer.

A calm conversation usually destroys the scam.

You can see more at https://CharlesWorks.com/resources.