“I have your password” email scam: is it real?
2 min read · Updated October 15, 2026
It is almost always a bluff. Scammers take an old password from a data breach and send mass emails claiming they recorded you and will release it unless you pay. Do not pay or reply. Change that password anywhere you still use it, enable two-factor authentication and check whether your address is in a breach.
How the scam works
The email quotes a real password, sometimes one you used years ago, to prove the sender ‘has access’. It then claims to have webcam footage or browsing records and demands payment, often in cryptocurrency, with a deadline.
Why the password is real but the threat is not
The scammer did not hack you. They bought or downloaded a leaked credentials list from an old breach and are mass-mailing everyone on it. The password proves your address appeared in a leak, not that your device was compromised.
Got a suspicious email about a leak?
Scammers love leaked data. See whether your address is genuinely in a known breach so you know how much of the message is real.
What to do
- ✓Do not reply, pay or click anything in the email.
- ✓If you still use the quoted password anywhere, change it immediately.
- ✓Turn on two-factor authentication for important accounts.
- ✓Check which breach exposed your address.
- ✓Report the message as phishing and delete it.
When to be more concerned
If the email includes a password that you currently use, treat that as a real exposure and change it everywhere. If you feel threatened, keep the evidence and report it to the police or your local cybercrime reporting service.
Frequently asked questions
How did they get my password?+
From an old data breach, not from your device. A breach check can tell you which incident included your address.
Do they have a video of me?+
Almost certainly not. These emails are sent in bulk with the same script.
Should I cover my webcam?+
It is a harmless precaution, but the real fix is changing exposed passwords.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.