Someone Is Threatening to Share My Photos: What to Do

Someone you met online, or someone using a friend's account, now says they have intimate photos or a recording of you. They want money, or more images, and they say they will send everything to your family, friends or followers if you do not do it quickly.

Take a breath. You have more control than it feels like right now. Do not pay, stop replying, keep the evidence and report the account. Then use the free tools that help stop images spreading, and make a police report.

This guide covers each step in order, what to do if you are under 18, where to report in Malaysia, and how to look after yourself.

Last checked: 29 September 2026.

#What Should You Do If Someone Threatens to Share Your Intimate Images?

Do not pay and do not send anything else. Stop replying, but keep the conversation and your account. Screenshot the threats, the profile and any payment details, then report and block the account in the app. If you are 18 or over and still have the image on your device, open a case at StopNCII.org; if you were under 18 when it was taken, use NCMEC's Take It Down and tell an adult you trust. Make a police report. If money has already left your account, call your bank or the NSRC on 997 first.

#This Is Not Your Fault

Instagram's page on dealing with blackmail says it plainly: if this is happening, it isn't your fault, and it is against the rules for anyone to share or threaten to share your intimate images, videos or messages without consent. The US National Center for Missing and Exploited Children (NCMEC) says the same on its sextortion page: the blackmailer is to blame, not you, even if you made a choice you regret.

Many people who are targeted feel ashamed and try to handle it alone, which is what the person threatening you is counting on. You are dealing with a crime, and you are allowed to ask for help, whether the images are real or faked.

#Why Paying Rarely Makes It Stop

Paying feels like the fastest way to end it. The organisations that handle these cases say otherwise.

Cooperating or paying rarely stops the blackmail. (NCMEC, sextortion guidance)

A payment shows that the threats work, and it often leads to a second demand. The person also keeps whatever they claim to have, so paying buys nothing you can check.

#Your First Hour: A Calm Safety Checklist

Work through these in order. You can ask a friend to sit with you while you do them.

1. Stop replying. Do not argue, plead, negotiate or threaten them back. You do not owe them an answer.
2. Do not pay and do not send any more photos or videos, whatever deadline they give.
3. Keep the conversation. Do not delete the chat, the messages or your own account; NCMEC says deleting them can make it harder to stop the blackmailer.
4. Take screenshots of the threats, their profile page and any payment instructions (see the evidence checklist below).
5. Report the account inside the app where the threat arrived, then block it.
6. Make your own profiles private for now and review who can see your friend or follower list.
7. If you are 18 or over and have the image on your device, open a StopNCII.org case. If you were under 18 when it was taken, use Take It Down.
8. Tell someone you trust, then make a police report.

#What Evidence Should You Keep?

Evidence helps the platform remove the account and helps the police investigate. The PDRM public FAQ lists proof such as chat screenshots, links, social media usernames, phone numbers, recipient account numbers and receipts. Capture what applies to you:

• Screenshots of every threatening message, with the date and time visible.
• The blackmailer's profile page, username and profile link on each app they used. Copy the link as text as well as taking a picture.
• Any other accounts, phone numbers or email addresses they used.
• Payment instructions: bank account numbers, e-wallet IDs or QR codes they sent.
• If you already paid: receipts, bank statements and transaction reference numbers.
• A short written timeline: when contact started, when the threats began and what was demanded.

#How Do You Report the Account on Instagram, Facebook and Other Apps?

Report from inside the app, on the profile or the chat where the threat arrived. Your report on Instagram is anonymous, according to Instagram's page on reporting a post or profile, so the account will not see who reported it.

• Instagram: its guidance on threats to share private images says to report the person, block them and contact local law enforcement. Instagram's page for when someone shares an intimate photo adds that removed images are photo-matched to help stop them being shared again on Instagram, Facebook and Messenger.
• Facebook: the Facebook Help Center page on threats to share nude or sexual images sets out four steps: document the post, report it to local law enforcement, report it to Facebook, and block the person. It also reminds you that you have the right to say no.
• Messages on Meta apps: Meta's newsroom says it offers a dedicated option to report messages that threaten to share private images, removes accounts it finds engaging in sextortion and, where appropriate, reports them to NCMEC and law enforcement.
• Other apps: use the report option on the profile or chat and pick the closest reason, such as threats, blackmail or harassment. Menu wording varies by app, version and language.

If the images have already been posted somewhere, report each post separately and note every link. Our guide to removing intimate images that are already online covers that stage in detail.

#StopNCII.org: Helping Stop Images Spreading

StopNCII.org is a free tool run by the UK Revenge Porn Helpline, part of the charity SWGfL. It helps adults who are worried their intimate images might be shared, not only those whose images already have been. Its how it works page describes the process:

1. You select the image or video on your own device.
2. The tool creates a hash, a kind of digital fingerprint, on your device. Only the hash is sent. The image itself never leaves your phone or computer.
3. You receive a case number and PIN. Write both down somewhere safe, because StopNCII says they cannot be recovered if lost.
4. Participating platforms look for matches and remove matching images that break their intimate image policies.

At the time of writing, StopNCII's partner page displays logos including Facebook, Instagram, Threads, TikTok, Reddit, Snap and X among the companies it works with. StopNCII is also clear about its limits: it cannot remove images from the whole internet, only from participating platforms. To use it, you must be the person in the image, have been 18 or over when it was taken, be 18 or over now, and still have the image or video. If you never had a copy, report to the platform and the police instead.

#If You Are Under 18

If you are under 18, or the images were taken when you were, you are not in trouble for asking for help. Please talk to a parent, relative, teacher, school counsellor or another adult you trust. Facebook's guidance on threats recommends exactly that, and Instagram suggests calling or messaging a trusted adult.

• Take It Down, run by NCMEC, works like StopNCII for images taken before you turned 18. It is free, you can stay anonymous, and your images are never uploaded. It is meant for images you believe have been or will be shared, including when someone is threatening you.
• NCMEC's CyberTipline accepts reports of online exploitation of children. NCMEC's page on getting explicit content removed says its analysts can notify companies and keep following up once you report where the images are.
• In Malaysia, the Social Welfare Department (JKM) asks the public to report child abuse to Talian Kasih on 15999.
• A police report is still important. A trusted adult can go with you to the station.

#Where to Report in Malaysia

You can report to the police even if you have not lost any money. The PDRM FAQ says members of the public can make a report when there is an attempted fraud, a threat or misuse of identity, and that some non-emergency cases can be filed through PDRM's e-Reporting system instead of at a station.

The NSRC FAQ says to contact your bank or 997 as soon as you notice money has gone, and to make a police report as soon as possible after that. It adds that quick action can reduce losses but there is no guarantee of getting money back, and that NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP. The NSRC focuses on money transferred through online fraud, so if you have not paid, the police report is your main route.

MCMC's make a complaint page lists menacing, obscene or indecent online content among the problems it takes complaints about, which helps if a threatening account stays up.

#What If Your Account Was Hacked First?

Sometimes the threat comes from someone who got into your account and found private photos there, or who is messaging you from a friend's hacked profile. Secure your own accounts before anything else, starting with the email account linked to them: change the password, sign out of other sessions and turn on two-factor authentication.

If you are already locked out, the steps in the first hour after an Instagram hack will help, and our guide on reporting a hacked account in Malaysia covers the police and platform side. If a friend's account is threatening you, warn the friend through another channel.

#Mistakes That Make Things Harder

• Paying, or promising to pay later to buy time. It usually brings more demands.
• Deleting the chat or your whole account in a panic, which throws away evidence.
• Confronting the blackmailer or trying to trace them yourself.
• Paying a "hacker" or "recovery agent" who says they can delete the files from the blackmailer's phone. Nobody can prove that has happened, and these offers are often another scam.
• Sharing a password, login code or backup code with anyone who offers help. Legitimate helpers, agencies and platforms never ask for them.
• Keeping it to yourself until the deadline passes. Telling one trusted person makes every other step easier.

#Looking After Yourself While This Is Happening

Fear and panic are normal reactions to a threat like this. Instagram's blackmail page recognises that people in this situation can feel scared, desperate or depressed, and asks anyone thinking about hurting themselves to get support straight away.

In Malaysia, the Ministry of Health's Talian HEAL 15555 is a crisis support line run by Ministry of Health counselling psychology officers. It takes calls about stress, anxiety and panic attacks, depression, suicidal thoughts and self-harm. If you feel you might hurt yourself now, contact emergency services or go to the nearest hospital emergency department.

Once the urgent steps are done, it is fine to take a break. Mute the app and spend time with someone you trust.

#When Outside Help Makes Sense

Everything above can be done on your own, for free, and only the police and the platforms can act on the blackmailer. A second pair of hands can help on the account side: if your Instagram, Facebook or TikTok was hacked and you cannot get back in, or you want help filing clear platform reports. SocialSafe by AwareXone, our recovery service, reviews each request first and works only through official platform routes. We cannot remove content from the internet or from anyone's device, and the platform makes the final decision on every report. You can read about our content reporting support, and our Trust Center explains that we never ask for your password, codes or any intimate image.

#Frequently Asked Questions