Sextortion doesn't require a data breach or a stolen password. FBI Jacksonville notes it can start on "any site, app, messaging platform, or game where people meet and communicate," which means there's no single app to avoid and no software patch that closes the door on its own.

The pattern the FBI describes is fairly consistent. Offenders typically pose as a teenage girl to befriend teenage boys, usually through social media or gaming platforms, then trick the target into sending an explicit image or convince him one already exists. Once an offender has an image, or claims to, the demand is usually money to keep it from reaching family and friends. FBI Jacksonville adds that offenders also threaten to publish the material, or threaten violence, specifically to pressure a victim into producing more images.

Paying rarely ends it. The FBI's own finding is blunt: "Even when victims comply, scammers often demand more money and escalate the threats." That's why paying should never be part of the plan, no matter how avoiding a sextortion scam gets framed in the moment as a quick fix.

The FBI says offenders are usually located outside the United States, commonly in West African countries like Nigeria and Ivory Coast, or in Southeast Asian countries such as the Philippines. That distance matters less as trivia and more as a practical warning: negotiating with, tracking down, or reasoning with an offender directly isn't a realistic strategy. Reporting through the right channels is.

If a threat has already landed, speed and evidence matter more than damage control. For the person being targeted, the sequence looks like this:

1. Stop responding and don't send money. Compliance doesn't close the loop; scammers often demand more and escalate threats even after a victim pays.
2. Capture the details before anything else. Note the account handle and profile URL, the payment demand, any threat messages with timestamps, and anything the offender claims about who they plan to send images to. Save screenshots or screen recordings where lawful and safe, and leave the conversation itself intact. FBI Jacksonville is explicit that deleting messages from an offender can hurt an investigation.
3. Report the account through the platform's own reporting tools once that evidence is saved.
4. Report to law enforcement. The FBI's warning lists tips.fbi.gov and 1-800-CALL-FBI as reporting channels, while FBI Jacksonville separately directs people to the FBI's Internet Crime Complaint Center at IC3.gov. Either route reaches law enforcement; filing through one is generally enough.
5. Escalate immediately if there's any threat of violence, self-harm, or a sense of immediate danger. Contact local emergency services right away. That's a safety emergency first, a privacy problem second.

For a parent who just found out, the first conversation matters more than any technical step that follows. FBI Director Christopher Wray's message to victims doubles as a script parents can use almost word for word: "It is up to all of us to reassure them that they are not in trouble, there is hope, and they are not alone."

FBI Jacksonville has flagged why that opening matters: shame, fear, and confusion are often what keep a child from asking for help or reporting the abuse in the first place. A calm response makes it easier for a kid to keep talking. Confiscating the phone or leading with blame can wait. Thanking a child for saying something can't.

Sometimes the threat moves faster than a report can. If an image has already been posted or sent to other people, the steps above still apply, with a few additions.

• Avoid contacting the people it was sent to and avoid negotiating directly with the offender to try to force a deletion. The pattern the FBI describes, where compliance invites more demands rather than fewer, applies here too.
• Don't forward, download, or reshare the image itself, even to show someone else as proof. Save identifying details instead: the post's URL, the account that shared it, and timestamps.
• Report the post and the account through the platform's own reporting tools, in addition to the law enforcement channels above.
• Keep the original messages from the offender intact. FBI Jacksonville's guidance is the same here as in the first hour: deleting them can hurt the investigation.
• If classmates are involved, or the material is circulating through a school community, loop in a counselor or another trusted adult outside the household. A situation that has already spread into a kid's social world benefits from more than one adult paying attention.
• Let a parent or trusted adult take over the reporting and platform work where possible, so the young person isn't managing the crisis alone.

The previous sections deal with an active threat. Preventing one means catching the setup before an image ever changes hands, and the FBI describes a common pattern worth watching for.

The red flag is specific: an online contact, often posing as a peer, who pushes quickly toward romantic or sexual territory and either asks for an explicit photo or claims to already have compromising material. Either version is a pressure tactic, and neither requires the offender to actually have anything. A claim of "I already have pictures of you" deserves the same skepticism as a direct request.

The FBI's reported figures skew heavily toward teenage boys approached by someone posing as a teenage girl, which cuts against the common assumption that girls are the primary target. That's worth raising directly with sons, not just daughters, as part of any effort to protect teens from online sextortion.

Profile hygiene limits what a stranger has to work with in the first place. FBI Jacksonville recommends using initials instead of full names, skipping exact birth dates, and leaving photos out of usernames and bios, along with running occasional searches of a child's name or handle to see what's already public.

None of this replaces conversation. FBI Jacksonville's guidance for parents leads with staying engaged: talk through what platforms and games a kid is using, and keep that dialogue open rather than treating it as a one-time warning. A teen who can name the pattern has a clear reason to stop, leave the conversation, and tell an adult.

Account settings can't stop someone from choosing to send a photo; that's what the habits above are for. What account security can do is reduce exposure if a device is lost, a password leaks, or someone tries to break into an account that stores private photos. Call it the mechanical half of online sextortion prevention: it won't stop a con, but it closes a door a con artist could otherwise walk through.

Where an app or account offers FIDO/WebAuthn authentication, use it. CISA's 2022 guidance identifies it as the only widely available phishing-resistant login method and calls phishing-resistant multi-factor authentication the most secure form on offer. It's already built into major browsers, operating systems, and smartphones, so turning it on usually takes a few taps in account settings, not a new app.

If FIDO/WebAuthn isn't an option, an authenticator app is generally preferable to a text-message code, but it isn't foolproof. CISA has documented fake login pages that captured a password and the six-digit code from an authenticator app in a single stroke, handing an attacker everything needed to get in. The rule that holds regardless of method: never enter a one-time code into a link sent by someone else, no matter how urgent it looks.

Treat text and voice codes as a last resort. CISA warns they're vulnerable to SIM-swap attacks and exploitation of telecom signaling protocols, either of which can let an attacker intercept a code before it ever reaches the intended phone.

Keep apps and operating systems updated. FBI Jacksonville lists regular software updates among its basic recommendations for stopping security breaches before they start. None of this is complicated, and together with the habits above, it covers most of how to avoid sextortion scams without treating every online interaction as a threat.

Three practical steps cover most of the ground: talk through what a fast-moving online "relationship" and a sudden request for a photo actually look like, review what's visible on a profile and tighten it, and turn on the strongest login protection an account offers.

None of it requires special software or a long sit-down lecture. A five-minute conversation about what platforms and games are in regular use, repeated occasionally rather than delivered once, makes it easier for a kid to recognize and report a problem when it shows up.

Make one thing clear before any of that: a kid who comes forward gets help, not consequences. The safest household rule is simple. If a stranger asks for an intimate image or threatens to share one, tell an adult immediately. Help comes before punishment, every time.