How sextortion scams actually work, step by step

According to the Royal Canadian Mounted Police, sextortion follows a pattern designed to look like something else entirely: a new online friendship, moving fast. Alberta RCMP has spent September walking youth through how that pattern works, because the mechanism only succeeds if the target does not recognise it early.

The approach rarely looks like a threat at first. Offenders pretend to be someone the same age as the victim. They build a profile that looks plausible but is often fake or incomplete, and they move quickly, expressing strong feelings almost immediately. That speed is not enthusiasm. It is designed to skip the stage where a person would normally slow down and ask questions.

Where the trap closes

Once trust is established, the offender pushes the conversation off the public platform and onto a private one. This step matters more than any other in the sequence, because private platforms remove witnesses and make screenshots the only outside evidence of what happened. From there, the offender asks for intimate images or video, and once that content exists, the relationship flips. The person who seemed like a peer becomes someone making demands: pay money, or send more content, or the material gets shared.

The scam depends on isolation working in both directions. The victim is isolated from other people who might recognise the pattern, and the offender is isolated from any way of being identified or found. Both of those conditions are set up before the threat ever appears.

The tell, and what to do

The RCMP notice lists what happens after the threat lands, and the first instruction cuts against instinct. Stop all communication with the offender. Do not send money, images, or anything else, because compliance does not end the demand, it confirms the demand works. Save every message, username, profile, and image as evidence. Deactivate the social media account involved, but do not delete it, since deletion can destroy evidence too. Do not accept new friend requests afterward; a new profile reaching out is often the same offender trying again.

Reporting has more than one door. Cybertip.ca takes anonymous reports of online child sexual exploitation. NeedHelpNow.ca helps with getting images removed from the internet. The platform where it happened can act on a report directly, and so can local police.

What the notice does not cover is the moment before any of this starts, the point where a fast-moving new online contact could be checked against these patterns rather than trusted by default. Cst. Scott Sterling of the ALERT Internet Child Exploitation Unit frames the response around bystanders as much as victims: speaking up, offering support, and connecting people to the resources listed above. The mechanism relies on a target who reacts alone. Breaking that isolation, at any point in the sequence, is what interrupts it.