When Extortion, Blackmail or a Deepfake Targets Your Executives

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

From Automated Phishing Lures to Targeted Executive and Corporate Extortion

Digital extortion threats targeting corporate executives, high net worth individuals and legal teams have evolved into two distinct categories. The first consists of mass automated email campaigns that spoof a victim email address or display an old leaked password while falsely claiming to possess compromising recordings. Those threats can be rapidly debunked through email header analysis, and you can check one yourself with our zero upload Email Header Analyzer. The second, far more serious category involves targeted corporate extortion where threat actors compromise a personal or corporate cloud account, steal sensitive communications or financial records, or fabricate synthetic deepfake media to coerce a ransom payment or manipulate litigation and business negotiations.

If You Received a Mass Extortion Email Today

Many readers arrive at this page because an email landed this morning claiming that a camera recorded them, quoting a password they recognize and demanding payment in cryptocurrency. In almost every such case the password came from a data breach years ago and was purchased in bulk, the sender has no recording and no access to the device, and the message was sent to thousands of addresses at once. The From line may even show your own address, which is a forgery that takes seconds to produce. You can confirm the forgery yourself by pasting the full message headers into our Email Header Analyzer, which runs in your browser without uploading the message and shows where the email actually originated and whether it failed authentication checks.

The response is the same for everyone. Do not pay and do not reply, since a reply only confirms a live address. Change the quoted password anywhere it is still in use and turn on multi factor authentication for email, banking and social accounts. Keep the message rather than deleting it, because if the sender escalates it becomes evidence. Report the message to the FBI's Internet Crime Complaint Center, and if the threat involves a minor or intimate images that actually exist, the FBI's public safety alert on financial sextortion explains how to report immediately. Our practice serves counsel, companies and executives, and the hotline is answered 24/7 if a personal threat becomes a matter that counsel is handling.

What the Record Can Establish in a Targeted Case

When the demand is specific, naming real documents, quoting real messages or attaching real or claimed recordings, the question becomes how the sender obtained the material, and the record often answers it. Full email headers show the originating infrastructure and the path the message took. Sign in logs and audit records from the executive's cloud accounts show whether an unauthorized session read mail, downloaded files or set up forwarding, and whether a third party application was granted access through a consent the user does not remember. An examination of the mobile device and laptop shows whether monitoring software is present, what accounts and backups the device syncs to and whether the files in question ever existed there. The compromise analysis and mobile device forensics disciplines are the tools, applied here to a question of exposure rather than fraud.

The record also has limits that counsel needs stated plainly. Attribution beyond anonymizing infrastructure typically runs through legal process directed at providers, which counsel directs with the facts our report supplies. What the examination can show is whether access occurred, through which account or device, over what period and to what material, and whether a claimed recording is consistent with the device and accounts it would have come from. Those findings are what let counsel assess the threat's credibility and advise on the response, which is the point of engaging under counsel's direction.

Deepfake and Synthetic Media Claims

A growing share of corporate extortion involves media the sender claims to be genuine and the executive says is fabricated, or media the sender threatens to fabricate. Authenticating an image, a video or an audio recording is a technical examination with its own methods. We examine the file's structure and metadata for signs of editing or generation, analyze compression history and noise patterns for inconsistencies that editing or synthesis introduces, compare lighting, geometry and motion within the frame for the artifacts current generation tools leave, and where a claimed original exists, compare the questioned file against it. Our Forensic Media Analyzer workbench supports that work, and the media authentication service page describes what a full examination covers.

Results are reported as findings about the file and the methods used, with their limits. Some fabrications leave clear traces and some do not, and a well made synthetic file may yield an examination result that identifies inconsistencies without declaring the file fabricated beyond question. Counsel receives the findings in a form that can be relied on in a demand response, a referral to law enforcement or a civil proceeding, and the examiner who did the work can explain it in a declaration or in testimony. Readers who want to understand the approach before a threat arrives can read our guide to authenticating questioned media and try the browser based photo forensics and video forensics tools, which illustrate the first layer of analysis without any upload.

The Engagement, Phase by Phase

The first conversation is with general counsel or outside counsel and the security lead, and it establishes what has been received, what has been done since and who else knows. Preservation begins immediately: the extortion messages are exported in their native format with full headers rather than screenshotted, cloud audit and sign in logs for the affected accounts are exported before retention removes them, and the executive's devices are set aside untouched. Where a phone must be examined, our remote collection lets the executive keep using the device while the collection runs, usually from a few minutes to overnight depending on setup. Each item receives a chain of custody record from the moment of acquisition.

Analysis then runs on the three questions counsel needs answered: whether unauthorized access occurred and through what path, whether the material the sender claims to hold is consistent with that access, and whether any attached media is what it purports to be. Findings are reported to counsel as they are confirmed so decisions about law enforcement referral, insurer notice, board communication and any response to the sender can be made on facts. Communication with the sender, if any, is counsel's and law enforcement's decision, not ours. The written report is structured to support whichever path counsel chooses, and when a matter proceeds to a civil action or a prosecution, our expert witness practice carries the findings into a declaration or testimony. The executive cyber risk service describes the preventive side of the same work.

Responses That Make the Exposure Worse

Paying is the first and worst. Payment confirms the target will pay, rarely ends the demands and often results in the material being released anyway or sold onward. Negotiating alone, without counsel and without knowing whether the sender actually holds anything, is the second, because every message the target sends reveals information and pressure points. Deleting the messages, wiping the phone or resetting the laptop in a rush to remove the material destroys the record that would have shown whether access occurred and how. Confronting a suspected insider before the record is examined alerts the person and invites destruction of evidence on their side. Making a public statement before the facts are known commits the organization to a position the record may not support.

A subtler error is treating the matter as personal to the executive when corporate systems are involved. If the material came from a corporate mailbox or a company device, the incident is a corporate compromise with notification, insurance and board dimensions, and handling it quietly as a personal matter forfeits the organization's ability to respond on time. The reverse error also occurs, when a company treats a personal account compromise as outside its concern while the executive's personal mailbox holds years of forwarded company documents. Scoping under counsel's direction decides which it is before anyone acts. Our email forensics work covers both corporate and personal mail systems for exactly that reason.

Who Acts First and What to Preserve

In a corporate matter the general counsel takes the lead, retains outside counsel where appropriate and routes the technical engagement through counsel. The CISO or security lead preserves and exports the cloud logs for the affected accounts and confirms that nothing is being deleted or reset. The executive stops using the affected accounts for anything sensitive but does not wipe or replace the devices. Executive protection or corporate security, where it exists, records any physical component of the threat. Nobody responds to the sender. Those four actions, taken in the first hour, keep every option open for counsel and preserve the record our examination depends on.

What to preserve is concrete. The original messages as EML or MSG files with full headers, every attachment unopened on any device beyond the one that received it, screenshots of any web pages, profiles or leak sites the sender referenced with their addresses visible, the payment demand with any cryptocurrency wallet addresses, the devices themselves powered on and set aside, and the account audit and sign in exports. After the first call, counsel receives a written scope describing the examination, a timing plan with the preservation steps first and a proposal for the report, declaration or testimony the matter may require. The initial consultation is free, and because these threats arrive on evenings and weekends, the hotline is answered 24/7.

Verifying the Threat and Tracing Its Source

When an executive, board member or organization receives an extortion demand, panic and uncoordinated responses only compound the risk. Working strictly under the direction of retained legal counsel or corporate security leadership, Global Digital Forensics conducts discreet technical examinations to establish the truth immediately. Our examiners analyze the extortion communication headers, inspect the target executive mobile devices and cloud accounts to determine whether any actual unauthorized access or spyware infection occurred, and authenticate any attached media using our Forensic Media Analyzer workbench to prove fabrication or provenance. For immediate assistance, call Global Digital Forensics 24/7 at (800) 868-8189. The initial consultation is free.

Mass Email Threat Against Targeted Demand

The guide separates two very different threats that both arrive as extortion. This table contrasts the mass automated email with the targeted demand across the signs that distinguish them, the right first response and what a technical examination can establish for each. Read the response column first if a message arrived today, then the examination column if the demand names real material. Do not pay or reply in either case, since a reply only confirms a live address.

Read the Extortion Email Headers in the Browser

Before paying anything or replying, paste the complete header block of the extortion email into the Email Header Analyzer. In a mass campaign the Received hops usually show a sending address that has nothing to do with your own account, the From field is forged and the SPF and DKIM results fail or point at a domain you have never used. That pattern supports the conclusion that the sender never had access to your mailbox and that the old password in the message came from a public breach list rather than from your computer. Nothing you paste leaves the browser. If the results instead show a message that passed authentication from your own domain, or the demand references files that only exist on your devices, stop and call for a device examination.

If the demand includes an image that claims to show you, open the Photo Forensics workbench, load the file exactly as it arrived without saving it through a messaging app first, and step through the views. The file structure view and the embedded text view show whether the image was produced by a camera or assembled in an editor, the recompression view highlights regions saved at a different quality from the rest of the frame, and the metadata view records the hash so you can prove later which file you examined. The analysis runs on your computer and the branded report downloads locally. If the views disagree with each other or the image appears to be a composite, keep the original and call so an examiner can test provenance under the direction of counsel.

For a video clip, load it into the Video Forensics analyzer and read the container and timing information first, because a synthetic or re encoded clip often carries a container signature and frame timing that do not match the device it claims to come from. Step through individual frames at the moments that matter and compare them with a reference recording of the real person or room when you have one. The optional model checks run on your device and are read within their stated limits rather than as a verdict. Preserve the file as received. If the clip shows signs of editing or you cannot tell, call rather than respond to the sender.

How to Begin and What Happens on the First Call

Have the original messages with full headers, the dates they arrived, a list of the accounts and devices that may be involved, what has been done since the message arrived and the name of counsel if one is engaged. Our examiner asks whether the demand references specific material, whether any payment or reply has been made, whether the affected accounts are corporate or personal or both, whether any attached media is claimed to be genuine and what logging the accounts have. You then receive a written scope with the preservation steps first, a timing plan that reflects the urgency of the demand and a proposal for the examination and for whatever report, declaration or testimony counsel anticipates. The initial consultation is free, and the hotline at (800) 868-8189 is answered 24/7.

Technical References and Further Reading

The original article pointed readers to the Better Business Bureau Scam Tracker. Those references are kept for the record.

Authorities cited in this guide: FBI public safety alert on financial sextortion schemes. Describes the financial sextortion pattern and how to report it to the FBI, in the press release already referenced on this page. FBI Internet Crime Complaint Center. Provides the reporting channel for extortion emails and related internet crime, at the current IC3 site. Federal Rule of Evidence 702. Sets the standard for expert testimony that a media authentication or compromise finding must meet when a matter reaches court, in the current rules text published by the Legal Information Institute. FTC cybersecurity guidance for small businesses. Supplies the baseline account protection practices, including multi factor authentication, that reduce exposure to credential based extortion, in the Commission's current business guidance.