Incident guide
A blackmail or threat message
A message says you were recorded or that private material will be shared unless you pay, often in cryptocurrency.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- A message claims to have recorded you through your camera or screen.
- It quotes one of your old passwords as proof.
- Someone you met online threatens to share private pictures unless you pay or send more.
- It sets a deadline and asks for payment to a cryptocurrency address.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not pay. Payment does not end the threat and often brings more demands.
- Do not send more pictures, “proof” or personal details.
- Do not delete the messages before you have saved them.
- Do not threaten back or forward the material to others.
Keep as evidence
- Screenshots of the messages with the times, and of the sender's profile or address.
- The wallet addresses and amounts asked for.
- The e-mail saved with its full headers, if the threat came by e-mail.
- The address of any page or post where material has appeared.
Where to report
Anywhere
The platform or service concerned
When: Right away, once the evidence is saved.
How: Report the account and any posted images through the platform's own report form for threats and private images.
Your bank or card issuer
When: Only if you already paid.
How: Call the number on the back of your card or on the bank's official site, say what happened and ask for a reference number.
In Turkey
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If you want a criminal complaint. Do this soon if material has been posted.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Access-block application for content that violates privacy (Law No. 5651, Article 9/A)
When: If content that violates your privacy has been posted.
How: Article 9/A allows a direct application for an access block. The EGM FAQ describes the route; read it before applying.
BTK internet report (content that constitutes an offence)
When: If a page or post carries content that constitutes an offence.
How: Submit the report through the BTK internet report form on e-Devlet, with the exact address of the content.
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.