Sexual Exploitation Actors Stealing and Leaking Explicit Content

How it works

Attackers use three main methods to break into accounts. First, they try many password combinations using lists from data leaks or public sources. Second, they text victims impersonating social media support, claiming the account will be locked unless the victim provides a verification code, then use that code to reset the password. Third, they create fake emails and websites that look like official support pages, trick victims into clicking links, and capture login credentials. After accessing the account, stolen explicit content is posted to criminal forums or sold, often with the victim's name, birthdate, email, and other personal details attached.

Red flags to watch for

• Text or email from social media saying your account will be locked unless you respond immediately
• Request for a verification code or password reset code that you did not initiate
• Email from social media support with a link to click (check the sender address carefully)
• Password reset or access code you did not request
• Fake website URL that looks similar to but not exactly like the real platform
• Email asking you to verify login or change your password

What to do

Do not click links in emails or texts claiming your account is locked, and do not share any codes or passwords you receive. Instead, go directly to the official website or app by typing the URL yourself or opening the app from your phone's home screen, then log in and check your account security settings. If you believe your explicit images have been stolen and shared without consent, report it immediately to the IC3's NCII reporting portal at ncii.ic3.gov and to the FBI at ic3.gov, including details about where your content was posted and when you discovered it.