Online extortion: how to react and what evidence to preserve

Receiving a message that threatens to disseminate intimate images, publish compromising information or ruin your reputation if you do not pay is one of the most distressing experiences in the digital environment. Online extortion, called sextortion when it involves intimate content, is one of the offences that have grown the most and that cause the most psychological harm. The instinctive response is fear and the temptation to pay, but paying the extortionist is almost always the worst mistake: whoever pays once will pay again, and payment is interpreted as a signal that the victim is exploitable.

Extortion is defined in Article 243 of the Criminal Code, which punishes anyone who, for profit, compels another by violence or intimidation to perform an act to their own or another’s detriment. The penalty ranges from one to five years’ imprisonment, with aggravations if it is committed repeatedly, against vulnerable victims or within a criminal organisation. It may concur with other offences: the discovery and disclosure of secrets, the dissemination of intimate images without consent or illegal access to computer systems.

The most frequent forms are several. Sextortion threatens to disseminate intimate images or videos; the material may have been shared voluntarily, obtained through deception in a fake relationship, obtained by hacking or recorded without consent; in many cases of professional extortion the material does not even exist. The extortion for an alleged copyright infringement or pornography claims to have recorded the victim’s activity by means of a trojan, and is almost always a bluff sent en masse. The extortion for compromising information threatens to publish communications or data that may indeed be real. And ransomware encrypts the device’s files and demands a ransom.

Faced with any extortion there are clear principles. Do not pay: payment guarantees nothing and sets a precedent. Do not respond to the demands, because it confirms that you are reachable. And document everything before doing anything: although the impulse is to delete the messages, that is exactly the opposite of what you should do.

The evidence to preserve is varied. Screenshots of all the messages, without altering anything, with the date and time visible, and ideally a notarial record attesting to the content. The identifying data of the extortionist: username, URL, email, phone number and bank account or cryptocurrency wallet. The full thread of the conversation, not just the most threatening messages. And the technical data, such as the email headers, which may reveal the source IP.

With the evidence documented, one must file a complaint with the National Police or the Civil Guard, which have units specialising in technological crime. It is worth knowing that the complainant has identity protection and that these cases are handled with discretion: one should not refrain from reporting out of shame.

If the material has already been disseminated, the situation is serious but not irreversible: the platforms have urgent-removal mechanisms, the right to be forgotten allows search engines to be asked to de-index the content, and the criminal complaint enables the judge to order interim measures of removal and blocking.