Sextortion: What to Do in the First Hour

Sextortion Call or Morphed Video Threat? What to Do in the First Hour — 1930, Getting the Content Taken Down and the Laws on Your Side

A threatening video call, a fake intimate video, or a message claiming that private images will be sent to your family can cause immediate panic. Do not pay, do not send more images, and do not let the caller rush you into a decision. Sextortion relies on fear and urgency; your first priorities are to preserve evidence, secure your accounts, report the threat and seek help if you feel unsafe.

In India, victims can report cybercrime through the National Cyber Crime Reporting Portal, request removal of non-consensual intimate imagery from platforms, and approach the police. If you have already transferred money to the blackmailer, report the financial fraud immediately through 1930.

What is sextortion?

Sextortion is a form of blackmail in which someone threatens to expose, publish or distribute intimate images, videos or fabricated sexual content unless the victim pays money, sends more material or complies with another demand.

Common tactics include:

A video call is recorded or manipulated, followed by a demand for money.
A scammer combines a person's face with explicit imagery to create a morphed video or deepfake.
Someone threatens to send screenshots or fabricated content to friends, family, colleagues or an employer.
A fake police officer, lawyer or social-media account claims that payment is necessary to prevent arrest or publication.
The blackmailer demands repeated payments, claiming that each payment will stop the content from spreading.

A morphed video does not become genuine evidence simply because it looks convincing. Do not assume that paying will make the threat disappear. Blackmailers may demand more money after the first payment.

The first hour: What to do, step by step

Minutes 0–10: Stop engaging and preserve evidence

Before blocking the caller, preserve the information you can safely collect.

Take screenshots of the threats, profile, phone number, usernames and payment demands.
Save the chat, message links, email headers or relevant URLs where available.
Record the date and time of calls and messages.
Keep payment requests, UPI IDs, bank account details or transaction references if money is demanded or transferred.
Save the original messages and files without editing them.

Do not forward intimate material to friends or upload it to public websites as proof. If the material involves a minor, do not download, copy or circulate it; report the account and preserve non-explicit evidence such as messages and URLs.

If the caller is still on the line, you do not need to argue, negotiate or prove that the video is fake. End the interaction when safe.

Minutes 10–20: Secure your accounts

If the threat involves a hacked account, stolen photos or unauthorised access, take steps to reduce further exposure.

Change the password for your email account and other affected accounts from a trusted device.
Enable two-factor authentication.
Review logged-in devices and sign out of sessions you do not recognise.
Check recovery email addresses and phone numbers for unauthorised changes.
Make social-media profiles private temporarily and review who can message, tag or view your posts.
Warn close contacts not to open suspicious links or respond to messages sent in your name.

If you suspect that your phone or computer is compromised, use a separate trusted device to change passwords and seek technical assistance.

Minutes 20–30: Report the threat online

Visit the official National Cyber Crime Reporting Portal.

The portal offers reporting routes for women- and child-related cybercrime, other cybercrime and financial fraud. Choose the category that matches your situation and follow the instructions. Source: National Cyber Crime Reporting Portal.

For a sextortion threat or non-consensual intimate imagery:

Open the portal and choose the relevant complaint category.
Provide the threatening messages, account details, URLs and other requested information.
Include the dates, demand and any payment information.
Save the complaint acknowledgement or reference number.

The portal provides anonymous reporting for certain categories of online sexual abuse content, as well as a report-and-track option. Anonymous reporting is not available for every type of complaint, so follow the instructions for the category you select. Source: Cyber Crime Portal FAQ.

You can also visit a local police station or cybercrime police station to report the incident. If you are in immediate danger, call 112.

Minutes 30–45: Request removal of the content

If the video or image has already been uploaded, report the exact post, account or URL to the platform hosting it.

Use the platform's reporting category for non-consensual intimate imagery, sexual exploitation, impersonation or manipulated media, as appropriate. Include the URL and explain that the content is intimate imagery shared without consent or a morphed image depicting you.

India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, specifically address complaints involving material that exposes private areas, depicts nudity or sexual acts, or involves electronic impersonation, including artificially morphed images. Under Rule 3(2)(b), intermediaries must take reasonable and practicable measures to remove or disable access to qualifying content within 24 hours of receiving the complaint. Source: Ministry of Electronics and Information Technology.

This is a removal requirement for qualifying content, not a guarantee that every report will be resolved instantly or that copies elsewhere will disappear at the same time.

Minutes 45–60: Escalate and protect yourself

By the end of the first hour, aim to have:

Preserved the threats and relevant evidence.
Secured your email and social-media accounts.
Submitted a cybercrime complaint or prepared to report in person.
Reported the content to the hosting platform, if it is online.
Saved your complaint references and platform report numbers.
Contacted someone you trust if you need practical or emotional support.

If the offender knows your address, threatens physical harm or is trying to reach you in person, prioritise safety and contact the police rather than spending the hour managing online accounts.

Should you call 1930 for sextortion?

Call 1930 immediately if you have already transferred money or suffered a financial cyberfraud. The number is India's cyber financial fraud helpline, and prompt reporting can help authorities and participating financial institutions take action on the transaction.

If the threat is only a demand for money and you have not paid, you should still report the blackmail through the National Cyber Crime Reporting Portal or the police. The portal is the main online route for reporting cybercrime, while 1930 is specifically intended for immediate reporting of financial cyberfraud. Source: National Cyber Crime Reporting Portal.

If you have already paid:

Call 1930 as soon as possible.
Contact your bank or payment provider using its official number.
Report the transaction, giving the transaction ID, amount, time and recipient details.
File the online cybercrime complaint and keep the acknowledgement.
Do not pay another amount because the scammer claims the first payment was insufficient.

A quick report does not guarantee recovery, but delays can reduce the opportunity to intervene in a fraudulent transaction.

How to get a morphed video or intimate image taken down

Removal works best when you report the specific content and preserve enough information for the platform and authorities to identify it.

1. Collect the content location

Record the post URL, account name, platform, date and time. If the content is in a private group or message, preserve the message details and report it through the available channel.

Avoid downloading or redistributing explicit material unnecessarily. The post link and surrounding threat messages may be sufficient to begin a report.

2. Use the platform's reporting process

Report the content for non-consensual intimate imagery, sexual exploitation, impersonation or manipulated media. If the platform offers a separate route for intimate-image abuse, use it.

If the content appears on multiple platforms, report each copy separately and retain the report numbers.

3. Invoke India's takedown rules

MeitY issued a Standard Operating Procedure on 11 November 2025 to strengthen the handling of non-consensual intimate imagery, including intimate or morphed images shared without consent. The SOP describes coordination among platforms, the cybercrime reporting system and relevant authorities to reduce dissemination and prevent reappearance. Source: Press Information Bureau.

When making a complaint, clearly state that the content is non-consensual intimate imagery or a fabricated sexual depiction of you, and provide the relevant URL.

4. Escalate if the platform does not act

Save the platform's response and your original complaint. You can use the platform's grievance officer process, whose details should be available in its grievance or legal section.

If you are dissatisfied with the grievance officer's decision, or the platform does not respond within the applicable period, you may be able to appeal through India's Grievance Appellate Committee, subject to its eligibility and filing rules. The GAC is not a replacement for reporting the crime to police. Source: GAC — Rights of Users.

What laws in India may apply?

The exact offences depend on what happened, the content involved, the intent, the victim's age and the evidence. Police and legal professionals can determine the provisions applicable to a particular case.

Information Technology Act, 2000

The Information Technology Act contains provisions that may apply to digital sexual abuse and impersonation:

Section 66C — Identity theft: May apply when another person's electronic signature, password or other unique identification feature is fraudulently or dishonestly used.
Section 66D — Cheating by personation using a computer resource: May apply where someone cheats by impersonating another person through digital means.
Section 66E — Violation of privacy: Addresses capturing, publishing or transmitting images of a person's private area without consent in circumstances covered by the provision.
Section 67 — Obscene material: Addresses publishing or transmitting obscene material in electronic form.
Section 67A — Sexually explicit material: Addresses publishing or transmitting material containing a sexually explicit act or conduct in electronic form.

These provisions do not automatically apply to every threat or fabricated video; their specific legal elements must be established. Source: MeitY — Information Technology Act and related laws.

Bharatiya Nyaya Sanhita, 2023

Depending on the facts, provisions of the Bharatiya Nyaya Sanhita (BNS) may also apply, including offences involving extortion, criminal intimidation, stalking, voyeurism or sexual harassment where the statutory requirements are met.

For example, threats intended to put a person in fear of injury may raise issues under the criminal-intimidation provisions, while demands for money backed by threats may raise extortion issues. The precise section and offence should be assessed by the investigating authority or a qualified lawyer rather than assumed from the label “sextortion.”

If the victim is under 18

If the material involves a child, the Protection of Children from Sexual Offences (POCSO) Act and relevant provisions of the Information Technology Act may apply. Report the matter promptly through the cybercrime portal or police, and do not download, forward or publish the material.

What if the video is fake but the blackmailer says it will ruin your reputation?

A fabricated video can still be used for extortion, harassment, impersonation or other unlawful conduct. You do not have to prove the video's falsity before reporting the threat.

Take these steps:

Save the demand and account details.
Report the threat through the cybercrime portal.
Report the fabricated content to the platform if it has been posted.
Tell trusted contacts not to forward or engage with suspicious material.
Avoid publicly reposting the video to explain that it is fake, because doing so can increase its reach.

If the content is already circulating, consider getting legal advice about further remedies, particularly if the platform does not remove it or the offender continues making threats.

What you should never do

Do not pay the blackmailer in the hope of guaranteeing deletion.
Do not send more photos, videos, identity documents or banking details.
Do not share OTPs or allow remote access to your phone or computer.
Do not hire an unknown “hacker” or recovery agent who promises to erase the content for a fee.
Do not delete every message before preserving evidence.
Do not forward explicit content to friends or public groups as proof.
Do not ignore threats of physical harm or an attempt to contact you in person.

Frequently asked questions

Can a blackmailer really send a fake video to my contacts?

They may try, but a threat does not prove that the content has been distributed or that it is genuine. Preserve the threat, secure your accounts and report the incident rather than paying to prevent a possible upload.

Is 1930 only for cases where money has been lost?

The helpline is specifically for immediate reporting of financial cyberfraud. If money has been transferred, call 1930 promptly and contact your bank. For sextortion threats without a completed payment, use the cybercrime portal or police.

How quickly must a platform remove intimate images?

Under Rule 3(2)(b) of the IT Rules, 2021, qualifying complaints involving intimate imagery, nudity, sexual acts or electronic impersonation, including artificially morphed images, require reasonable and practicable measures to remove or disable access within 24 hours of receipt. The rule does not guarantee that every copy on every website will disappear within that period.

Can I report without going to a police station?

Yes. You can submit a complaint through the National Cyber Crime Reporting Portal. You can also approach a local police station or cybercrime unit, especially where there are threats of physical harm or an urgent safety concern.

What if I already paid?

Do not pay again. Call 1930 immediately, contact your bank or payment provider, preserve transaction details and file the cybercrime complaint.

What if the offender is in another state or country?

You can still report the incident through India's cybercrime portal. Include available usernames, numbers, URLs, transaction details and other relevant evidence, even if the offender's identity or location is unknown.

Final checklist: Your first-hour action plan

Stop engaging with the blackmailer and do not pay.
Preserve threats, account details, URLs and payment information.
Secure your email, social accounts and devices.
Report the incident at cybercrime.gov.in.
Call 1930 immediately if money has been transferred in a cyberfraud.
Call 112 if you are in immediate danger.
Report intimate or morphed content directly to the hosting platform.
Save complaint and takedown reference numbers.
Ask a trusted person for support if you feel overwhelmed.

Final word

Sextortion is designed to make victims feel isolated and act before they can think. You do not have to handle it alone, and you do not need to pay to deserve protection. Preserve evidence, report the threat, request removal of non-consensual content and contact the police when necessary.

Official links and helplines