Someone Is Threatening to Share Your Private Photos. What Should You Actually Do?

A message arrives from someone you know — or perhaps someone you met online only recently.

They tell you they have a private photo or video of you. Then comes the threat: pay them, send more material, continue talking to them, or they will send it to your family, friends or followers.

The natural reaction is to panic.

Unfortunately, that is also what the person making the threat is relying on.

In many of the cases we see, the first few decisions matter. People often rush to pay, delete conversations, deactivate every account they own, or continue negotiating because they believe they can convince the other person to stop.

Sometimes those actions make the situation more difficult.

So what should you do instead?

First, keep the conversation and preserve what happened

Before blocking the account or deleting anything, save the evidence.

You do not need hundreds of screenshots. What matters is having a clear record of the situation: the profile involved, the threats, what they claim to possess, what they are demanding, and any links or accounts they mention.

Keep the username and profile URL whenever possible. Usernames can change. Accounts can disappear. A screenshot showing only a display name may not be enough later.

If money was requested, keep those details too.

If the person sent you screenshots claiming that they contacted your family or published something, save them — but do not automatically assume everything they show you is genuine. Screenshots are sometimes used simply to increase pressure.

Do not send more content to “prove” anything

One of the more common mistakes is continuing the conversation in the hope of calming the person down.

They may say:

“Send me one more photo and I’ll delete everything.”

“Show me your ID.”

“Give me access to your account so I know you won’t report me.”

Do not do it.

Someone who is already using private material as leverage has given you no reason to trust a promise that additional cooperation will end the situation.

The same applies to passwords, SMS codes, backup codes and access to your email.

A privacy incident can become an account-takeover incident very quickly if login information is handed over as well.

Paying does not buy certainty

This is usually the hardest question for someone in this situation:

Should I just pay?

There is no way to guarantee that payment will make the material disappear.

The other person may still have copies. They may ask for more money later. They may sell or share the material regardless of what they promised.

If you have already paid, do not delete the transaction details. Keep receipts, wallet addresses, payment references and any messages connected to the payment.

The important point is not to make the next decision simply because you already made the first payment.

Secure the accounts that matter most

While dealing with the threat itself, check your own digital security.

Start with your email.

Your main email account is often the key to everything else because password-reset links for Instagram, Facebook, TikTok, cloud storage and other services usually arrive there.

Change weak or reused passwords and enable two-factor authentication.

Then review the devices and sessions connected to your accounts.

If you see a device, location or browser session you do not recognise, sign it out.

Pay particular attention to cloud services as well. Private photographs are not always obtained directly from a social-media conversation. They can also come from old backups, compromised email accounts, shared folders or previously breached accounts.

Find out what is actually online

A threat is not the same thing as a publication.

This distinction matters.

If someone tells you, “I posted your video everywhere,” do not assume that statement is true without checking.

Search for the account. Check the profile they mention. Look at the exact post, story, reel or page if a link has been provided.

If something has actually been published, document the location before reporting it.

A useful record normally includes the URL, account name, date and enough context to show what was posted.

Avoid forwarding the material to multiple people just to ask whether they can see it. That can unintentionally create more copies of the very content you are trying to contain.

If something was published, report the right violation

Not every report should be submitted under the same category.

For example, a fake Instagram account using your name and photograph may involve impersonation.

A video posted without your consent may involve a privacy violation or an intimate-image violation, depending on the content and the platform.

Threatening messages may fall under harassment or abuse.

Separating these issues can make reporting clearer.

If an account is both impersonating you and publishing private material, it may require more than one report.

Platforms may also ask you to verify your identity. If they do, make sure you are dealing with an official reporting channel before uploading identification documents.

Do not disappear from the internet unnecessarily

Another common reaction is to delete every social-media account immediately.

Sometimes reducing visibility is useful. Deleting everything, however, is not always the best first step.

Making an account private, hiding follower lists where possible and limiting who can tag or contact you may be enough initially.

Keeping your genuine profile active can also make it easier to establish which account is authentic if someone creates a fake profile using your identity.

The right choice depends on how the threat is being carried out.

Watch for new accounts, not only the original one

Blocking one account may not end the situation.

People involved in this type of abuse sometimes create additional profiles after the original account is reported.

They may slightly change the username, use a different profile picture or contact the victim from another number.

For that reason, monitoring matters.

Search variations of your name and username. Check platforms where the person has threatened to publish. If you know the images being used, keep track of where they appear rather than focusing only on the original profile.

The objective is not to spend every hour searching the internet. It is to detect new exposure early enough to respond.

When professional help becomes useful

Some situations can be handled with basic account security and a platform report.

Others become more complicated.

For example:

The same material appears on several websites.

Multiple impersonation accounts keep returning.

A person starts contacting family members or colleagues.

Content is removed and then uploaded again somewhere else.

You do not know whether the person gained access to one of your accounts.

These cases usually require a more structured response: preserving evidence, checking your digital footprint, securing accounts, documenting impersonation, preparing removal requests and monitoring for re-publication.

At DERFEND, we approach these situations as digital-risk cases rather than simply telling someone to “report the account and wait.”

The first objective is to understand what has actually happened, what remains only a threat, and where the immediate risk exists.

From there, the response can be adapted to the case.

One final point

If someone is threatening you with private material, do not measure the seriousness of the situation only by how aggressive their messages sound.

A person sending dozens of threats may never publish anything.

Another person may say very little and simply create an account.

Focus on evidence and actions, not only words.

Keep the records. Secure your accounts. Confirm whether anything has actually been published. Use the correct reporting channels, and avoid giving the person additional material or access.

If the situation involves active publication, impersonation or repeated threats, you can contact DERFEND for a confidential assessment of the digital risk and the available response options.