Interactive Visualisation

Sextortion Anatomy Map

Sextortion attacks follow a predictable 7-stage script. Each stage is designed to move a victim further in before they realise what is happening. Click any stage to see what the attacker does, what the victim experiences, and the psychological lever being pulled.

Attacker actions
Victim's experience
Psychological lever
Breaking the cycle

Tap any stage to expand the detail

Attacker does this
Victim feels this
Creates a fake persona on social media or a dating app
1
Receives a connection request from an unknown but attractive profile
Attacker
Sets up a convincing fake profile — usually an attractive photo (often AI-generated or stolen from someone else), a plausible job description, and mutual interests. The profile may be weeks or months old to appear established.
Victim
Has no reason to suspect anything yet. The request seems like a normal connection. There is mild curiosity or flattery from the attention of an attractive stranger.
Psychological lever: Novelty & Flattery
New social contact from someone attractive triggers a small dopamine response. The brain is primed to view this person positively before any trust has been established.
Red flags at this stage
  • Profile photo looks too perfect or symmetric (possible AI generation)
  • Very few posts, all recent — account appears new despite an old-looking setup date
  • No mutual connections with anyone you actually know
↓
Begins intensive messaging — flattery, shared interests, emotional attention
2
Begins to feel genuinely seen and valued — the connection feels real
Attacker
Mirrors the victim's language and interests. Responds quickly. Asks personal but non-threatening questions. Expresses early romantic or emotional interest. This is called "love bombing" — an overwhelming volume of positive attention designed to accelerate trust formation.
Victim
Begins to invest emotionally. The conversation feels like it is "going somewhere." The attacker has become part of the daily routine — they respond faster and more warmly than most real relationships. This person feels important.
Psychological lever: Love Bombing / Manufactured Intimacy
Sustained positive attention triggers oxytocin — the brain's bonding chemical. The attacker is manufacturing the neurological feeling of a genuine relationship. This takes days, not weeks.
Red flags at this stage
  • Intensity of emotional expression feels disproportionate to time spent together
  • They always seem available — responds at any hour, never busy
  • Early claims of deep connection: "I've never felt like this before"
↓
Suggests moving to a more "private" platform — WhatsApp, Telegram, Snapchat
3
Agrees — it feels like natural progression of a growing relationship
Attacker
Moves the conversation to a platform with less oversight and more media-sharing capability. This is also a test: if the victim complies, they are deeply invested. Moving platforms reduces the chance of the original platform's reporting tools being used later.
Victim
Experiences this as a step toward more intimacy and privacy. The trust already built makes this feel natural. There is no alarm signal — this is exactly how real relationships develop online.
Psychological lever: Incremental Compliance
Each small step the victim takes — accepting a request, continuing conversation, switching platforms — increases their psychological investment. Saying no becomes harder with each "yes" already given. The relationship feels worth protecting.
Red flags at this stage
  • Push to move platforms happens quickly — within days of first contact
  • Framing the platform move as for "privacy" or "so we can talk properly"
  • They resist video calls on the new platform, always citing technical problems
↓
Initiates sexual conversation and requests intimate images or video
4
Feels safe enough to comply — and may have already received fake intimate content first
Attacker
Often "shares" intimate content first (always someone else's image, or AI-generated) to normalise the exchange and create a false sense of reciprocity. Once the victim's content is received, the trap is set. The attacker may immediately screenshot or record the live video before the victim can disconnect.
Victim
Believes they are in a private, trusted exchange with someone they care about. The reciprocity of the attacker sharing first made it feel mutual and safe. The idea that this content could be weaponised has not entered their thinking.
Psychological lever: Reciprocity & False Safety
Receiving intimate content from someone creates a strong norm of reciprocity. The victim believes the exchange is private and symmetrical. In fact, the attacker's content is not their own, and the victim's content is immediately being preserved.
Red flags at this stage
  • Pressure to share even if you feel hesitant — framed as proof of trust
  • Live video requests where the camera on their side is blurry or they are in shadow
  • Requests escalate gradually — each step is small compared to the last
↓
Reveals the trap — shows the captured content and names specific contacts who will receive it
5
Experiences shock, shame, and panic — and becomes completely isolated
Attacker
The persona switch is immediate and total. The attacker shows proof they have the content, may display a list of the victim's real contacts or friends pulled from social media, and delivers a clear demand: pay within a stated window or the content gets distributed. The deadline is artificial but creates immediate paralysis.
Victim
The emotional whiplash — from intimacy to extortion — is designed to be disorienting. Shame activates immediately. The instinct is to solve the problem alone and quickly, which is exactly what the attacker is counting on. Telling anyone feels unthinkable.
Psychological lever: Shame as Isolation
Shame is not collateral damage — it is the primary tool. A victim who feels ashamed will not report to police, will not tell family, and will try to solve the problem alone. Isolation removes every resource the victim has to resist the attack. The attacker depends on silence to operate.
What victims are told at this stage
  • "Do not tell anyone or I will send it immediately"
  • "I have your contact list — I know everyone who matters to you"
  • "You have 2 hours to pay. After that I start sending."
↓
Accepts payment — then immediately demands more
6
Pays hoping it will end — and discovers it does not
Attacker
Accepts the payment, issues a brief "thank you," then immediately returns with a new demand — often double the previous amount. The threat is escalated: "I still have the content. Pay again or it goes out now." The payment proved the victim will pay, making them a high-value target.
Victim
Feels the ground drop away. The payment that was supposed to end it has made things worse. The sense of helplessness intensifies. At this point, many victims have depleted savings, borrowed money, or are considering increasingly desperate options.
Psychological lever: Sunk Cost & Escalation Trap
Having already paid makes the victim feel they must continue paying — otherwise the previous loss was pointless. This is the sunk cost fallacy weaponised. Each payment is treated as partial evidence that paying more will eventually resolve the situation. It will not.
Critical fact
  • Paying never stops the cycle — it confirms willingness to pay and escalates demands
  • Most victims who pay once are approached for a second and third demand
  • Many attackers share victim lists with other operators — payment marks you as a verified target
↓
Continues demands indefinitely — or stops if the victim cuts contact entirely
7
Trapped between paying endlessly or facing the feared exposure
Attacker
If the victim continues to engage, demands continue indefinitely. If the victim goes silent and blocks all contact, attackers often do NOT follow through on distribution — it requires effort and provides no further financial gain. The threat of exposure is worth more as a threat than as an action.
Victim
Continued engagement — even to argue or plead — signals that pressure is working and keeps the cycle alive. The most counterintuitive but effective action is to stop all contact and report immediately. The attacker depends entirely on continued engagement to extract further payment.
Psychological lever: The Bluff
Distribution is the threat, not the goal. Distributing content produces nothing. Continued threats extract payment. Most attackers are running multiple simultaneous extortion campaigns — they move to easier targets when one victim stops engaging. Silence and reporting is more effective than any payment.
What research shows
  • The majority of sextortion attackers do not follow through on distribution when contact is cut
  • Those who do follow through are not stopped by payment — they distribute regardless
  • Reporting to cybercrime.gov.in or calling 1930 begins a documented record that can assist law enforcement
✓
Breaking the Cycle
What actually works — and why
Step 1
Stop all contact immediately
Block on every platform. Do not respond, argue, or plead. Any engagement signals that pressure is working.
Step 2
Do not pay anything
Payment confirms willingness to pay and escalates demands. It has never ended a sextortion campaign.
Step 3
Tell someone you trust
Shame is the attack's main weapon. A trusted person provides perspective and breaks the isolation the attacker depends on.
Step 4
Report to authorities
File at cybercrime.gov.in or call 1930. Preserve all evidence — screenshots, messages, profile links — before blocking.