They threaten to spread your intimate photos: what to do, step by step (and what never to do)

If you are reading this with a knotted stomach, breathe. You are not the first person this has happened to, you have done nothing to deserve punishment, and there is a solution. Let’s sort it out.

Someone you used to talk to, or an account you just met, or an ex-partner with whom you thought you had closed that chapter well, is writing to you. The message is short and cold: they have your photos or a video and, if you don’t pay, don’t come back, or don’t send more, they will show them to your family, your work, or your contact list.

This is called sextortion, and it is a crime. The one who commits it is the one who blackmails, not the one who sent a photo in a moment of trust.

Publicidad

As president of the Rainbow eSafe Association and a computer expert, I tell you what I see the most: the first hours decide a lot, and almost all the damage comes from panic and from staying silent, not from the photos themselves. There is a second thing I see even more: the evidence that is poorly kept or uncertified weakens just when you need it the most.

First of all: this is not your fault.

Sending an intimate image to someone you trust or are flirting with is another form of intimacy. What breaks that trust is the blackmail, not your photo.

In our community, there is an aggravating factor: many LGTBIQ+ people are also threatened with outing us to family or at work. It is the most paralyzing threat, and the one who extorts knows it. I already talked about that pressure in what outing is and what consequences it has, and how the deception is set up in apps in sextortion in dating apps.

A 2025 study by Thorn, with 1,200 young people aged 13 to 20 in the United States, found that 1 in 5 had suffered sextortion. Among those who identify as LGTBIQ+, 28% of victims ended up harming themselves, almost three times more than their non-LGTBIQ+ peers, and Thorn links it partly to having less support outside of the internet. That’s why the first thing I ask you is to tell someone.

It’s not always a stranger: the four faces of sextortion.

When this crime is discussed, it is almost always imagined as an anonymous person, often outside of Spain, who writes to you through an app. It happens a lot, yes. But it is not the only thing.

• An unknown or fake account, that seduces you, asks for photos or videos, and changes tone within hours. The goal is usually money.
• A mass email claiming to have a recording of you from your webcam. Many times it is a template sent to thousands of people, with nothing real behind it.
• A person you know online or in person, with whom you have been talking for weeks or months. Here the blackmail can be for money, for more photos, for a meeting, or for not cutting off the relationship.
• An ex-partner, a current partner, or someone from your circle. This is the one that hurts the most and the one that is least reported.

This last case works differently. No money is needed: the material is used to control you, punish you for leaving the relationship, or force you to return. They know your family, your work, your schedule, and your contacts, which is why the threat is credible. It is another form of violence that also exists within our relationships, which I talked about in what is intragender violence.

There is an important nuance: that you sent those photos voluntarily back then does not authorize anyone to spread them or use them to threaten you. One thing is to share an image with a person, and another very different is for that person to use it against you.

And there is a risk that is overlooked: shared accounts. If at any point you shared the cloud (iCloud, Google Photos), a password, or a device with your ex-partner, they may still have access to what you keep. That’s why close it as soon as possible (see step 7).

What to do, in this order.

1. Don’t pay or give in.

This is the hardest and most important thing. The person responsible for the research group in networks of the National Police explained back in 2019, in elDiario.es, that paying usually does not stop the blackmail: it starts with a low amount and returns a few days later asking for more. It is an old piece of data, but it describes a pattern we still see. And with an ex-partner, the same happens with another currency: every time you give in to a demand, another one comes.

- Publicidad-

2. Keep the evidence, but don’t just settle for the screenshot.

Before blocking, calmly gather everything:

• Screenshots of the entire conversation, with date and time visible.
• The profile address or the exact username, and the link if there is one.
• The payment details they ask for (account, cryptocurrency wallet, Bizum).
• The messages in the order they arrived; do not delete them.

The screenshot is a good first piece of evidence, but it is only the first step. A screenshot can be questioned because anyone can claim it is edited, and it does not alone prove where the message came from or when it was sent. That’s why it is crucial to certify digital evidence: to leave a technical record of its authenticity, origin, and the moment it was collected, so that it cannot be questioned when you present it in a complaint or in a procedure.

This is just part of our work. At the Rainbow eSafe Association, we have tools to certify the authenticity of digital evidence, and that’s why we insist: before deleting, blocking, or changing anything, write to us. The sooner the evidence is secured, the stronger it is.

3. Cut off contact and block.

Once the evidence is secured, stop responding, block, and report the profile within the platform. This is what INCIBE, the state cybersecurity institute, recommends in its real sextortion cases: cut communication, block, report the profile, and do not give in even if the threats continue.

If the person is someone you know, avoid arguing or confronting them via message. Every response you give can become a new reason for them to threaten you or give them the opportunity to delete or manipulate what they wrote.

4. Report to the National Police or the Civil Guard.

It is a crime and should be reported. Bring the evidence, and if you already have it certified, even better. I know it is embarrassing and it seems like you will have to show the photos; in practice, what matters is the evidence of the blackmail, not the content.

If the blackmail comes from a partner or ex-partner, mention it explicitly when reporting: it can change how the case is assessed and what protective measures can be considered. For this, it is advisable to have someone knowledgeable about the regulations, like a legal advisor.

If they have already charged you money, take a copy of the complaint to your bank and claim it back. In some cases, it may be possible to recover the amount.

5. Request the removal of content if it has already been published.

There are two free tools worth knowing:

• Priority Channel of the AEPD (Spanish Agency for Data Protection): it is used to request the removal of photos, videos, or sexual audios published without consent. It can be used by the affected person or someone who knows the content, it is filled out in their electronic headquarters, and the AEPD analyzes it as a priority. If they see signs of a crime, they notify the Prosecutor’s Office. Note: they cannot order the removal of anything from WhatsApp, Telegram, or email, only from public sites and profiles, and it is intended for those living in Spain.
• StopNCII.org: a free tool for adults. You create a digital fingerprint (a hash) of your images on your own device, without uploading them anywhere, and the participating platforms, like Facebook and Instagram, use that fingerprint to detect and block them. It is not suitable for minors under 18 years old.

If the person in danger is a minor, do not wait: report directly to the Police or the Civil Guard.

6. Tell someone you trust.

It can be a friend, a sister, a current partner, or someone from your reference LGTBIQ+ association. The one who blackmails needs you to stay silent for the fear to work. When you tell it, they lose a lot of their power.

And if you don’t know where to start, you can call 017, the Cybersecurity Help Line of INCIBE: it is free, confidential, and available every day of the year from 8:00 to 23:00.

7. Review your footprint and close access.

• Change the passwords of the involved accounts and enable two-step verification.
• Check what devices and what people have access to your cloud, your email, and your networks, especially if there was a relationship.
• Adjust the privacy of your profiles: who sees your contacts and your posts.
• Search your name and your photos from time to time in a search engine (what INCIBE calls egosurfing) to know if something has come to light.

“But what if they really have my photos?”

This is the most repeated doubt, and the honest answer has two parts.

The first: there are many template scams. Mass emails claiming to have a recording of you from your webcam usually have nothing. Do not respond, do not click on any link, and do not pay.

The second: even if they have something real, the pattern is the same. Paying or giving in does not protect you, and reporting with well-secured evidence does give you tools. Every hour that passes without acting plays in favor of the one who is blackmailing.

It is also worth knowing that today the material does not have to be real. Thorn reported that 13% of the victims in their 2025 study were threatened with a fake nude generated with AI. If it happens to you, the proof that the image is fake also needs to be certified.

The counterargument that must be acknowledged.

Some say that reporting is useless because almost never is the person behind it found, often outside of Spain. It is true that pursuing these networks is difficult. But reporting is not just for catching someone: it allows you to request content removal, claim from your bank, and leave a record in case the blackmail continues. And when it is an ex-partner or someone known, identification is usually much easier, as long as the evidence is well secured.

It must also be stated clearly: we still do not know how much sextortion there is in Spain. The Interior Ministry published in July 2026 that in 2025, 488,426 cybercrimes were recorded (5.1% more than the previous year) and that sexual crimes increased by 21%, but that note does not break down sextortion. And for years, the police have estimated that a good part of these cases are not reported, due to shame. That silence is precisely the ground where the extortionist operates.

What I ask of you the most.

If this is happening to you right now: do not pay, secure the evidence, certify it, block, report, and tell someone. In that order.

If you need us to accompany you, at the Rainbow eSafe Association we are here to help you, and we will not judge you. We can help you certify the authenticity of your digital evidence before reporting. Write to us at rainbowesafe.com/contacto.