Screenshot and Recording Threats: What to Do, Step by Step
A practical guide to handling a threat to share a screenshot or recording — identifying the claim, why not to pay, evidence and reporting order, and image hash-blocking.
A threat to share a screenshot or recording is designed to make you act within minutes, alone. That pressure is the whole mechanism, and it is also the part you can remove. This guide sets out what is usually being claimed, why payment makes things worse rather than better, and the order to do things in.
Advertisement
| Before you start | Short answer |
|---|---|
| Should I pay? | No. Payment does not delete anything, and a first payment is almost always followed by a second demand. |
| Should I block immediately? | Capture the evidence first, then block. Blocking first destroys what a report needs. |
| Is there anything that actually removes images? | Yes — a hash-matching service can stop matching images being uploaded to major platforms, without you sending the image anywhere. |
Advertisement
Step 1 — Work out what is actually being claimed
Threats of this kind fall into three groups, and they call for different levels of concern. None of them call for payment.
Advertisement
Step 2 — Do not pay, and understand why
This is the one instruction that is consistent across every police force and helpline that deals with these cases, and the reasoning is practical rather than moral.
- Payment removes nothing. The file, if it exists, still exists after the money arrives. There is no mechanism by which paying deletes a copy.
- Payment identifies you as someone who pays. The most common outcome of a first payment is a second demand, then a third.
- A deadline is a tool, not a fact. The countdown exists to prevent you from telling anyone, because telling someone is what ends these.
Step 3 — Capture the evidence, then stop responding
Order matters here. Most people block first and lose everything a report would have needed.
- Screenshot the whole conversation, including the earliest messages, not just the threat.
- Capture the profile — the username, the display name, the profile photo, the account URL and the join date.
- Record any payment details given — account number, wallet address, payment handle, phone number.
- Note the dates and times, and which platform each message arrived on.
- Then stop replying. No negotiation, no explanation, no request to see proof. Silence gives them nothing to work with.
- Then block and report the account on the platform.
Step 4 — Report it to someone with authority
Platform reporting and formal reporting do different jobs, and both are worth the few minutes.
| Where | What it achieves |
|---|---|
| The platform itself | Gets the account reviewed and often removed. Accounts of this kind are usually working through many people at once. |
| National Cyber Crime Reporting Portal (cybercrime.gov.in, India) | Creates a formal record and routes it to the right police unit. The portal has a dedicated route for offences against women and children. |
| The 1930 helpline (India) | A phone route for the same thing, useful when money has also been sent. |
| Your own police service, elsewhere | Most countries have an equivalent online reporting service for cyber-enabled extortion. |
Step 5 — If real images exist, use the hash-blocking route
There is a practical mechanism for this, and it is worth knowing because it does not require you to send your images to anybody.
StopNCII.org, operated by the UK charity SWGfL, works by generating a digital fingerprint — a hash — of an image on your own device. Only that fingerprint is shared, never the picture. Participating platforms then compare uploads against it and block matches. The image itself never leaves your phone, which is why the service can be used without adding to the exposure you are already worried about. For anyone under 18, child protection organisations run dedicated services and those should be used instead.
Step 6 — Close the door behind you
Once the immediate situation is handled, a short pass over your accounts prevents the follow-up attempts that often come next.
- Change the password on any account mentioned in the threat, and anywhere you reused it.
- Turn on two-step verification everywhere it is offered.
- Lock down your contact and friend lists so they are not publicly visible — the threat to "send it to everyone" depends on that list being reachable.
- Set your profile photo and status to contacts only.
- Tell one person you trust. This is not an optional step. Isolation is the mechanism, and it stops working the moment someone else knows.
Common questions
The six steps in one place
- Identify which of the three claims you are looking at.
- Do not pay. Payment deletes nothing and invites a second demand.
- Capture evidence first, then stop replying, then block.
- Report to the platform and to the cybercrime portal.
- If real images exist, use a hash-blocking service — the image never leaves your device.
- Secure your accounts and tell someone. Secrecy is the only thing that makes this work.
