I Do Know Your Passwords e-mail scam: how to spot it and what to do
I Do Know Your Passwords is a typical sextortion scam that urges for a $1000 worth BTC payment to cancel the release of a compromising video clip.
The false message claims that there was malware installed on the user's computer system which provoked the affected browser to act as an RDP and keylogger and the hacker was supposedly able to record a private video of the victim by accessing his camera and computer screen remotely.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Do it yourself · free Remove I Do Know Your Passwords e-mail scam yourself 3 steps, about 9 minutes, no software needed.
Start the steps
I Do Know Your Passwords e-mail scam: summary
| Name | I Do Know Your Passwords |
|---|---|
| Type | Email scam/sextortion scam |
| Aim | The hackers who spread this message aim to threaten gullible users that they will release a private video if the victims do not agree to transfer the demanded sum of money |
| Danger | The criminal might add specific attachments to the scam message such as various PDF files or Word documents that might carry dangerous malware inside. Also, by paying the crooks, you risk transferring a big sum of money for nothing |
| Wallet | 13ajfLBScsUNSJ3t65fsCmT1TRkQCUMYA1 is the Bitcoin wallet address provided in the email scam message where the victims are supposed to transfer the money |
| Ransom | Hackers are a LITTLE BIT greedy – they urge for $1000 in BTC to be transferred in a 48-hour duration, otherwise, the recorded private video will be sent to all accessed contacts of the victim accounts |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Symptoms | A sextortion e-mail demanding payment |
|---|---|
| Evidence | 5 write-ups by security sites; details still limited |
| Arrives as | |
| Pretends to be | A hacker who claims to have taken over your device |
| Claim | They recorded you through your camera and will send the video to your contacts |
| Asks for | A crypto payment |
| First seen | 26 November 2019 |
| Facts checked | 6 October 2026 |
What the I Do Know Your Passwords e-mail scam e-mail looks like
Text of a sextortion e-mail demanding payment, as people saw it
Hello,
I do know your passwords (check this email subject for one of the passwords), I do know about your daily life, I do know about your internet activities but you do not know anything about me, and you must be wondering why you are getting this email, right? I installed a malware on the adult (porn) website and guess what, you visited this website to have fun (you know what I mean!). While you were watching the porn, your web browser started functioning as an RDP+keylogger, which gave me access to your display screen and camera. Right after that, my software collected all of your contacts from your Facebook account, Messenger account, and email account, then, I created a double screen video. The first part shows the video you were watching (you have a nice taste lol), and the second part shows the recording of your camera (it is you!).
You have two options -
1. First option is to ignore this email. In this case, I will send the recorded video clip of yours to all of your contacts and just imagine the humiliation you will feel from this. Don't forget that this can also affect your relationship as well.
2. Second option is to pay me $1000. We will call it a donation. In this case, I will right away delete your video and all of your information I have about you (including your contact lists) and you will never hear from me again. You can continue your daily life like this never happened.
You will make the payment via Bitcoin. If you do not know about Bitcoin, search Google for "how to buy bitcoin". You can also get the Bitcoin from sites like Bitstamp, Coinbase, Kraken, Localbitcoins, etc.
Bitcoin (i.e. BTC) address to which you need to send is -
[payment address omitted], [payment address omitted]
It is Case-Sensitive, so make sure to copy and paste it, or, you can also scan this QR image to get the BTC address:
If you are thinking to go to the police, good luck, I have taken every step to make sure that this email cannot be traced back to me. You have 48 hours to pay me. I have a special Facebook pixel in this email, and at this moment, I know that you have read this email. If you want proof, reply to this email, and I will send your video to 4 of your contacts.
From our report of Nov 2019 · not reviewed since
Malware delivery techniques
Regarding the findings of cybersecurity experts from LosVirus.es, various malicious software gets delivered through email spam campaigns.
Mostly, hackers add infectious payload as an attachment of a Word, PDL, or Excel document/file to the questionable email messages.
You always have to be aware of such content and not open any clipped payload if you are not sure about its safety. Also, scan the attached data with an antivirus program to make sure that it does not include any malicious content. The same is valid for bogus hyperlinks inserted - you should not enter them.
Continuously, always check the sender and his email address. Make sure that it does not sound suspicious or irrelevant. Also, check the content of the received email message for possible grammar or style mistakes. Official companies will not send you emails filled with mistakes or misunderstandings.
How to tell the I Do Know Your Passwords e-mail scam e-mail is fake
From our report of Nov 2019 · not reviewed since
- Once you receive this message, you should get rid of it immediately.
- DO NOT believe in any information it provides you with and DO NOT open any attached files
- If you have scanned your computer with reliable antivirus and the program has detected some malicious infections on your computer, the malware might have compromised some system files of yours.
- Try repairing them by employing a tool such as
- Malwarebytes Labs has reported this autumn about a new way of such scamming messages coming from ChaosCC hacker group that also claimed to hold the victims' private videos and demanded Bitcoins in exchange for not releasing them.
Is I Do Know Your Passwords e-mail scam dangerous? What the senders want
From our report of Nov 2019 · not reviewed since
I Do Know Your Passwords - an email scam letter that fakes to have recorded a private video of the user and threatens to load it up on the web
I Do Know Your Passwords is a typical sextortion scam that urges for a $1000 worth BTC payment to cancel the release of a compromising video clip.
The false message claims that there was malware installed on the user's computer system which provoked the affected browser to act as an RDP and keylogger and the hacker was supposedly able to record a private video of the victim by accessing his camera and computer screen remotely.
I Do Know Your Passwords scam claims to have recorded a double video where you can see what type of adult content the victim was watching and what he was doing while viewing it. Continuously, the crooks try to scare the victim by claiming to have got hold of the contact lists that are saved in the user's Facebook, Messenger, and email accounts.
The deliverers of I Do Know Your Passwords email scam threaten to send the recorded private video to each person that is found on the accessed contact lists and humiliate the victim who supposedly has been involved in private activities while watching adult-related video clips on the Internet sphere. This will happen if the affected user does not agree to pay the $1000 ransom within 2 days:
According to I Do Know Your Passwords criminals, if the victim tends to cooperate and decides to transfer the demanded sum, the recorded video, and all private information will be eliminated permanently right away and the hacker will leave the user alone. Additionally, the message requires the transfer process to be completed by Bitcoin cryptocurrency.
Usually, bad actors require some type of cryptocurrency payment as this currency guarantees the anonymity of the process and allows the cyber crooks to stay untrackable.
Continuously, it is known that the scammers try to avoid their messages being sent to the Spam section as frequent as possible. These people manage to place the written information in a PDF document and attach it to the email message itself so that it travels straight to the inbox section. This way the crooks are sure that I Do Know Your Passwords virus reaches the targeted victims.
Keep in mind that you should be careful with these types of attachments as some of them might carry malicious products inside. The hackers might try to benefit in even a more advanced way and hide a Trojan virus or other type of malware in a particular attached file or document and deliver it to the user clipped to the I Do Know Your Passwords email scam message.
In addition, if you start reading I Do Know Your Passwords, the first thing you should notice is that the criminals threaten that the victim's passwords have also been accessed and they seem to provide on of the passwords in the email's subject line. Check if your email address was truly compromised during some data breach activity by visiting haveibeenpwned.com.
Also, check if your system is still secured as there is a risk of some type of malware sneaking into your computer system via such email messages. For this purpose, try scanning your machine with a reliable antivirus program. If the tool alerts to have found dangerous malware, you should investigate your system for corrupted files or entries. If you find some, try repairing them with a tool such as .
You need to remove I Do Know Your Passwords from your email box and make sure to change your email account password in case it got leaked or compromised somehow. While creating passwords, ensure that they contain multiple numbers, letters, and some symbols. Additionally, you can also secure your accounts with two-factor or multi-factor authentication.
I Do Know Your Passwords is not the only type of scam seeking to swindle the user's money and threatening that private content will get exposed if the payment demands are refused. Other similar email scam examples include:
Sextortion scams are one of the most popular email scam variants that have appeared to be successful for some criminals regarding their frequent distribution. The scammers used the 1KE1EqyKLPzLWQ3BhRz2g1MHh5nws2TRk BTC address to which already around $2500 worth transfers were performed.
- Jeanson J. Ancheta email scam.
- I sent you an email from your account scam.
- I infected you with my private malware (RAT) email scam.
What to do about the I Do Know Your Passwords e-mail
The message is a bluff sent to millions of addresses.
Nothing needs to be removed from your PC.
Step 1: Stop replying and keep the evidence
I Do Know Your Passwords works only while you keep answering. Stop the conversation, block the sender, and save the evidence first:
- screenshots of the messages
- the addresses used and any account
- wallet numbers
Do not follow up with a "recovery service" that contacts you later, since those are usually the same people. On Windows 11 and Windows 10, Windows + Shift + S takes the screenshots.
Full procedure with screenshots: What to do after paying a scammer
Step 2: Change the password the message quotes
A real password in the subject or the text comes from an old data breach, not from your webcam or PC. Change it on every account where you still use it, starting with e-mail, and turn on two-step verification there.
Check which breaches your address appears in on our breaches page. Nothing needs to be removed from the Windows 11 or Windows 10 PC because of this message.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 3: Report it
Report the scam where it reaches the people who can act: in the US to the FTC at ReportFraud.ftc.gov and to ic3.gov if you lost money, in the UK to Action Fraud, and in the EU to the national police or consumer authority.
Include the sender, the addresses, the amounts and screenshots. Mark the message as phishing or spam in your mail or messaging app as well, which trains the filter for everyone.
The mail apps on Windows 11 and Windows 10 have the same report buttons as their web versions.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online.
One of the basic means to add a layer of security - choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features.
However, if you want true anonymity, we suggest you employ a powerful VPN - it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable.
Family photos, work documents, school projects - these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur:
- power cuts
- Blue Screen of Death errors
- hardware failures
- crypto-malware attack
- even accidental deletion
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, can be your only hope to retrieve your invaluable files.
From our report of Nov 2019 · not reviewed since
Removal instructions for I Do Know Your Passwords and potential malware
Remove I Do Know Your Passwords immediately if you ever received it in your email box.
There is no need for keeping a questionable email message that seeks to swindle your money by providing you with false claims. Also, avoid opening any attached files or documents that might come clipped to the sextortion email scam.
If these antivirus programs discover any malware, there might be some compromised components on your system. Try repairing them with a tool such as .
[GI=method-1]In case some type of malware managed to sneak into your Windows computer system and performed some malicious activities, you should boot your machine to Safe Mode with Networking:
[GI=method-2]If you have spotted some questionable or malicious changes on your machine, you can try reversing them by launching the System Restore feature on your affected PC:
Questions about I Do Know Your Passwords e-mail scam
Should I pay the amount demanded in "I do know your passwords (check this email subject for one of…"?
No. There is nothing to buy back, so paying achieves nothing except encouraging more e-mails. Payments made in crypto cannot be reversed, and people who pay are often contacted again with a higher demand.
The best response to "I do know your passwords (check this email subject for one of…" is no response: report it as spam or phishing, delete it, and change any password it shows.
If you have already paid, keep the transaction record and the e-mail and report both to the police or your national cybercrime service, which collects these wallets to warn others.
Is my webcam hacked after "I do know your passwords (check this email subject for one of…"?
There is no sign of that in the e-mail itself. Real webcam spying needs a remote-access program on the PC, and that would show up as an unknown program in Installed apps, an unexpected camera light or a security alert. The message "I do know your passwords (check this email subject for one of…" offers no such evidence.
If you want to check, open Windows Settings, go to Privacy and security, then Camera, and look at which apps used the camera recently. Run a Windows Security scan. If both look normal, the threat is just words.
Could I Do Know Your Passwords be a genuine message?
We checked it, and it is not. A hacker who claims to have taken over your device is only the costume. The message exists to get a crypto payment, and real companies handle that inside your account, after you sign in normally, not through links, attachments or phone numbers in a message you did not expect.
Scammers copy logos and footers perfectly, so the design proves nothing. The sender address, the link target and the request are the reliable signs, and all three point to a scam here. Delete it, and if you are worried, check your account directly.
Why does I Do Know Your Passwords say that they recorded you through your camera and will send the video to your contacts?
Because that story works. A problem that needs fixing, a deadline and a simple solution make people act before they check.
The claim that they recorded you through your camera and will send the video to your contacts is the same for everyone who received I Do Know Your Passwords; it was written once and sent in bulk. Nothing about your own situation triggered it.
If you are unsure, look at the real account or service the normal way, without using the message. The claim will not be there, which settles the question. Then report the message.
What does I Do Know Your Passwords want from me?
In the end, a crypto payment. Everything else in I Do Know Your Passwords, from the logo to the deadline, is there to get you to that point without stopping to think.
Knowing the goal helps you judge your risk. If you did not give it, you lost nothing and can delete the message. If you did, the steps in this guide are ordered by what you handed over:
- passwords first
- then card and bank details
- then documents and anything you installed
- ran
Act on the highest item on that list first.
I opened the message. Is my computer infected?
Opening and reading a message is safe in modern mail apps and browsers; images and text do not install anything by themselves. Your PC is at risk only if you opened an attachment, ran a downloaded file, or followed instructions to paste a command or install a program.
If you did none of that, delete the message and move on. If you did, disconnect from the internet and run a full scan and the Microsoft Defender offline scan. Do not reply to the sender or click links in the message later either.
What is the single best habit against scams like this?
Never act on a message through the message itself. If something claims to be from a hacker who claims to have taken over your device and asks you to sign in, pay, call or open a file, close it and go to the service the way you always do:
- a bookmark
- the app
- the number on your card
Real problems will be visible there. This one habit defeats almost every phishing, invoice, delivery and account-suspension scam, regardless of how convincing the design is, because the scammers can copy the look but not the real account.
Should I scan my PC after I Do Know Your Passwords?
Yes, it is a quick way to rule out one possible cause. Open Windows Security and run a full scan; it takes about half an hour.
If it finds nothing and there are no unknown programs or extensions, the account problem behind an e-mail that begins "I do know your passwords (check this email subject for one of…" most likely started with a leaked or phished password.
If it finds a stealer or trojan, remove it first, then change your passwords from another device, then sign out of all sessions, because stolen cookies keep working until you do.
How urgent is I Do Know Your Passwords?
Urgent enough to act today, not urgent enough to panic. The sign reported, an e-mail that begins "I do know your passwords (check this email subject for one of…", means someone is using or testing your details. Changing the password and turning on two-step verification takes ten minutes and usually locks them out.
If a payment is involved, the sooner the bank knows, the better the chance of getting it back. Do not respond to calls or messages that arrive right after the incident, even if they claim to be from your bank: call the bank yourself.
Will Fortect remove I Do Know Your Passwords?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For I Do Know Your Passwords, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Bit Degree: Understanding the Different Types of Cryptocurrency (read October 6, 2026)
- Malwarebytes Blog: The lucrative business of Bitcoin sextortion scams (updated) (read October 6, 2026)
- LosVirus: LosVirus.es (read October 6, 2026)
- FTC: How to recognize and avoid phishing scams (read October 6, 2026)
- CISA: Recognize and report phishing (read October 6, 2026)