A new form of email scam uses photos of your home to deceive victims into sending money or Bitcoin.
You receive an email from an unknown sender, which includes a picture of your home and address, accompanied by a threatening statement: “Don’t make the mistake of hiding. You have no idea what I’m capable of… I have recorded videos of you doing embarrassing things in your home (nice decor, by the way).”
While it sounds like a horror movie plot, it is actually one of the latest phishing scam techniques.
How the Email Scam Works
Like many other email and SMS scams, this specific extortion scam uses personal information to trick people into sending money. The email convinces people that the hacker knows more about them and that they must make a payment or send Bitcoin to keep their information safe.
“I received a PDF via email that included my address and a photo of my home, making improbable claims about my personal behavior and claiming to have recorded video documentation captured by spyware on my computer,” said Jamie Beckland, Director of Products at APIContext, to HuffPost. “The scammer threatened to release the video unless I paid them in Bitcoin.”
If you receive a similar email, here are the steps you can take to identify if it is a scam and protect yourself:
Many phishing scams are often filled with grammatical errors and poor formatting, making them easier to spot. However, this scam, involving home images, is a new, darker development.
How Did the Scammer Find Your Home Address?
According to Al Iverson, a cybersecurity expert and head of research and community engagement at Valimail, the sender likely obtained your address from a previous data breach that leaked personal details and then used a photo from Google Maps to compose the email.
Beckland was able to confirm it was a scam by comparing the image in the PDF with the image of his home on Google Maps. Most images in these scams come from online sources, so he suggests people check if the image has been copied from the internet. If it has, it’s clearly not legitimate.
Iverson recommended verifying the legitimacy of the email address whenever you receive correspondence from unknown users.
“Check if the sender’s domain matches the official website of the organization,” he suggested as an example. "Also, if you use Gmail, look for the ‘Show Original Message’ option and examine the SPF, DKIM, and DMARC results.”
These are essentially methods that verify the sender’s domain to prevent spam, phishing attacks, and other email security risks.
“All of these should ideally pass the authentication checks,” added Iverson. “In other words, it should say ‘PASS’ next to all three options.”
If an email looks legitimate, you might mistakenly click the links it contains for more information. Zarik Megerdichian, founder of Loop8, a company that protects personal data and privacy from data breaches and hackers, strongly warns against this.
“Ensure that every time you’re asked to click a link in an email,” said Megerdichian.
“Bitcoin transactions are irreversible, as are many other common payment methods, including Cash App and Zelle.”
Update and Change Your Passwords
It is also crucial, when faced with an extensive scam, to change all your passwords.
“Use a new email address if possible and move critical financial or services to it, then begin reporting the case to local police, the FBI, and ensure your family is aware of the potential threat of public embarrassment in case they managed to steal any incriminating data,” said Yashin Manraj, CEO of Pvotal Technologies, a company that creates secure technology infrastructures for businesses.
Don’t Engage with the Scammer
It might be tempting to respond to an email (especially those that seem very realistic) to negotiate with the scammer. However, Manraj suggests withdrawing and ignoring these emails, as responding can actually put you on call lists and target databases, making you vulnerable to further attacks.
Be Careful with Your Data in the Future
Users must remember that data is a commodity, and businesses today collect far more information (often more than they need to complete the transaction). When signing up for new websites or downloading apps, Megerdichian suggests avoiding over-sharing information.
“Always ask yourself, do they really need to know this? It is the consumers’ responsibility to be proactive about their personal data,” said Megerdichian.
