As Valentine’s Day approaches, threat actors may attempt to prey on individuals seeking companionship or romance. The NJCCIC continues to receive reports of sextortion incidents in which victims are threatened with the release of compromising or sexually explicit photos or videos if they do not pay an extortion demand. Some sextortion threats are not credible, as threat actors are unable to provide proof of such photos or videos. However, there is an increase in reported sextortion incidents in which threat actors pretended to be trusting
potential love interests. In several recent incidents, threat actors posed as attractive females to target their victims, build trust, and convince them to send compromising or sexually explicit photos or videos. Threat actors use social engineering tactics to lure their victims via email, text message, chat, and video chat apps (such as Snapchat, WhatsApp, Skype, and Kik), social media platforms (such as Instagram, Facebook, and Wizz), or dating apps (such as Grindr and
Hinge). They may initiate communication through one of these platforms and then move to other platforms. They build trust with their victims and convince them to divulge personal information—such as phone numbers, family members, employers, and social media account information—before threatening to post the photos or videos to the victim’s social media platforms or release them to family members, friends, or employers. They may also threaten to upload explicit photos or videos to various pornographic websites if payment is not made. Extortion payments are typically demanded to be sent via Zelle, Venmo, Cash App, MoneyGram, Bitcoin, Coinbase, or gift cards. Similar to sextortion, threat actors may engage in romance scams by posing as potential love interests and building trust with a victim to establish a relationship quickly. Eventually, they may create a fake emergency and request the victim send money to help. They may also encourage victims to make cryptocurrency investments that turn out to be scams. Sextortion and romance scams continue to be successful as threat actors change tactics to coincide with trends and topics of interest to increase their likelihood of a reward or payout. To help counteract these scams, the New Jersey Senate passed legislation last year to make sextortion a third-degree crime punishable by up to five years in prison and a $15,000 fine. For victims who are minors or adults with developmental disabilities, the offense would be a second-degree crime punishable by up to 10 years in prison and a $150,000 fine.

Recommendation

The NJCCIC recommends users educate themselves and others on this and similar scams to prevent future victimization. Please review the Beware of Sextortion and Romance Scams NJCCIC product. The NJCCIC also advises against paying ransoms of any kind, as these scams are typically not considered credible threats unless photos or videos are provided. Users are advised to inspect questionable requests for typical indicators of these scams, exercise caution with unsolicited communications, and refrain from providing photos or videos, personally identifiable information (PII), financial information, or funds. Users are encouraged to report cyber incidents via the NJCCIC Cyber Incident Report Form, the FBI’s Internet Crime Complaint Center (IC3) website, and their local police department. Users are also advised to report scams or abuse to associated email providers, social media platforms, or dating apps, especially if there is a violation of terms and conditions or acceptable use policies.

Reporting

The NJCCIC encourages recipients who discover signs of malicious cyber activity to contact the NJCCIC via the cyber incident report form at www.cyber.nj.gov/report.

Please do not hesitate to contact us here at Cyber Command with any questions.