Online blackmail or extortion threats: evidence first

If you are reading this in a hurry#

Do not pay. Do not reply beyond what you have already said. Do not delete the messages, the chat, the account or the photos — however much you want to. If anyone is in immediate danger, call the police now. If a child is involved in any way, this is a child-safety emergency: report to the police and at cybercrime.gov.in immediately.

Then take screenshots of everything, with dates and the sender's details visible, and report at the National Cyber Crime Reporting Portal — cybercrime.gov.in — or call the 1930 helpline. Everything else in this guide can wait an hour. Those steps cannot.

This guide is for individuals, professionals and businesses in India facing a demand backed by a threat to publish: intimate images, private messages, allegations about a business, confidential documents, or content that is simply fabricated. It explains what the law calls this, what to preserve and how, where to report, what the platforms and Google can do, and what Spy Monk does and does not do. It is not legal advice. Extortion is a crime, and the authorities and a qualified lawyer are the right people to act on it.

What is happening, in legal terms#

Indian law does not care whether the threatened material is real, embarrassing or fabricated. It cares about the threat. Under section 308 of the Bharatiya Nyaya Sanhita, 2023, a person who intentionally puts another in fear of injury and thereby dishonestly induces them to deliver property or anything of value commits extortion, punishable with imprisonment of up to seven years, a fine, or both. Under section 351, threatening another with injury to their person, reputation or property with intent to cause alarm or to compel them to act is criminal intimidation; the punishment rises where the threat is to impute unchastity to a woman, and an additional term applies where the threat is made by anonymous communication or with the sender's identity concealed — which describes most online extortion.

Where intimate images are involved, further provisions apply: capturing, publishing or transmitting an image of a person's private area without consent is an offence under section 66E of the Information Technology Act, 2000, and publishing or transmitting sexually explicit material is an offence under section 67A; voyeurism is an offence under section 77 of the BNS. Whether and how these apply to a particular case is for the police, the prosecutor and the courts; the point for you is simpler. The person threatening you is describing a crime they intend to commit, and you are the complainant, not the wrongdoer.

Why paying does not work#

People pay because they believe it will end. It almost never does. A payment proves that the threat works, identifies you as someone who pays, and is frequently followed by a second demand, a third, or the sale of your details to others who will make their own. Organised sextortion operations run on exactly this model and target thousands of people at a time. If you have already paid, that does not weaken your complaint — record the payment details, because they are evidence that helps the police trace the account.

Negotiating alone is the same mistake in slower motion. Every message you send gives the extortionist information and time. The only conversations worth having are with the police, the platform and your lawyer.

What to preserve, and how#

Evidence is the thing most victims destroy, out of shame or panic, in the first hour. It is the thing the police and the platforms most need.

• The full conversation, in every channel: WhatsApp, Instagram, Telegram, SMS, email, calls. Screenshots that show the sender's number or handle, the date and time, and the complete thread, not just the threatening lines. Export the chat where the app allows it.
• The sender's identifiers: phone numbers, handles, profile URLs, display names, email addresses, and any UPI ID, bank account, wallet or QR code they gave for payment. These are what the 1930 system and the police act on.
• Any content they have already posted — a profile, a post, a video — with the URL and date.
• Payment records, if you paid: transaction IDs, time, amount, recipient.
• Your own timeline: when contact began, what was demanded, what was said, in a dated note.

Two cautions. First, do not forward, download or store intimate images of anyone, including yourself, beyond what the police ask for; possessing or transmitting such images can itself raise legal issues, and the platforms and police handle the material. Describe it; do not circulate it. Second, do not block the account until your evidence is saved; blocking can hide the thread from you.

In Spy Monk, this evidence goes into a blackmail or extortion case opened with URGENT priority. Every screenshot, export and note is fingerprinted with SHA-256 and timestamped on upload, and the case timeline records what you did and when. The value is not the technology; it is that weeks later, when a platform or an officer asks what was said on which day, you can show them a file that has demonstrably not changed since you saved it.

Where to report#

The police. For any threat to safety, or where you simply want to go in person, your local police station can register the complaint. Take your evidence.

The National Cyber Crime Reporting Portal. cybercrime.gov.in, run by the Ministry of Home Affairs, accepts complaints about cyber crime and routes them to the relevant State or Union Territory police. It has a separate track for crimes against women and children, where certain complaints can be made anonymously, and a general track for other cyber crime. The 1930 helpline is the companion number, particularly important for financial fraud, where early reporting improves the chance of freezing funds. Keep the acknowledgement number.

The platform. Report the account under the platform's harassment, extortion or intimate-imagery policies through its dedicated forms. Under rule 3(2)(b) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended with effect from February 2026, an intermediary must take reasonable and practicable steps within two hours of an individual's complaint to remove or disable content that shows the person in a private act, or impersonates them, including artificially morphed images (see the first 48 hours of an impersonation). The platform's grievance officer must acknowledge complaints within 24 hours and resolve them within seven days.

Google. If intimate images of you — real, or AI-generated using your likeness — appear in Search results, Google provides a dedicated process to request their removal; you sign in, open the image result and use the removal option for sexual images of yourself. Removal from Search does not remove the image from the hosting site, which is a separate report. Personal information such as your phone number, address or ID documents published to harm you can also be reported under Google's personal-information and doxxing policy.

Record every reference number in the case. The sequence matters less than completeness: police, portal, platform, Google, as the facts require.

Telling someone#

Extortion works on isolation. Tell one trusted person — a family member, a colleague, a friend — and if you run a business, tell the one person who will own the response. You do not have to tell them everything; you have to stop being alone with it. If the matter concerns a workplace, consider whether your employer or professional body has a route; clinics, firms and institutions should treat a threat against a staff member as an organisational incident.

If the stress is severe, speak to a mental-health professional. This is a crime being done to you, and the reaction you are having is the normal reaction to a crime.

If the content is published anyway#

Sometimes it is, despite everything. Then the earlier work pays off. You have the evidence that the publication followed a demand, which is exactly what the extortion offence requires. Report the published content to the platform under its policies and to the police as a development in your complaint; for intimate imagery use the two-hour route and Google's removal process; for a business, prepare a short, approved holding statement for customers if one is needed — and say nothing about the extortionist publicly beyond that the matter is with the police. Do not engage with the content, the account or the commenters. Record each platform's action and each removal in the case, and verify removals at the source.

What Spy Monk does and does not do#

DRS gives the incident one home: an urgent blackmail or extortion case with fingerprinted evidence, the official routes set out in our guides with their reference numbers recorded in the case, an approval step for any statement you decide to make, and a timeline from the first message to the verified outcome. It sends you an email when monitoring finds a mention assessed as high risk, and where the operator has connected WhatsApp, an approved template alert can reach you there too. A monitoring project with your name and the threatened subject surfaces new coverage in news, search and video sources where enabled.

DRS is not an emergency service and does not replace the police. It does not negotiate with, pay or contact anyone making threats. It cannot take content down, does not file complaints on your behalf, and will not attempt to identify who is behind an account — only a court or a competent authority can direct a platform to disclose that. A dedicated crisis-response workflow with playbooks is a Phase 3 item; today the case, the evidence and the official routes are what the product offers, and this guide does not pretend otherwise.

When to consult a lawyer#

This guide is general information, not legal advice. Consult a qualified lawyer as soon as you can: to help you frame the police complaint; to advise on the platforms' legal duties and what to do if they are not met; to consider court directions for removal or for disclosure of the account holder; to handle any publication that has already occurred, including possible defamation; and to protect you if the extortionist has threatened legal action of their own, which is a common tactic. Preserve the evidence first, report second, and let the lawyer work from a complete record.