That "your account will be locked" text is after your private photos

Still Online is not an emergency service. If you or someone else is in immediate danger, call your local emergency number.

On August 10, 2026, the FBI issued a public warning about people breaking into ordinary personal accounts for one specific reason: to find intimate photos and videos, and then sell them.

This is worth understanding even if you think it does not apply to you, because the way in has nothing to do with photos. It is a text message about your account being locked.

What's happening

The FBI describes attackers getting into social media and personal accounts, taking any sexually explicit images or videos they find, and posting or selling that content on criminal marketplaces. Usually the account owner has no idea it happened.

The detail that makes this worse than ordinary theft is what gets attached. The FBI says the stolen content is often posted alongside the victim's personal information: name, date of birth, email address, phone number, social media username. That turns a theft into an open invitation. The agency's word for what follows is re-victimization, and it lists harassment, sextortion, stalking, and other targeted attacks, including cases where the stolen material is advertised on the victim's own social media page.

Targets are chosen in two ways. Sometimes it is a specific person, who may or may not know the attacker. Sometimes it is whoever happens to be reachable.

How they get in

The FBI names three methods, and none of them require any real technical skill.

A text asking you for a code. You get a message saying your account is about to be disabled or locked unless you reply with a verification code. While you are reading it, the sender triggers a password reset on your real account, which sends you a genuine code from the real platform. If you pass that code along, they reset your password and they are in.

Emails that look like support. Look-alike domains and addresses imitating platform customer service, warning you about a new login, with a link to change your password. The link is the trap.

Guessing. High volume attempts against accounts using lists built from data leaks, social media, and public sources. When the attacker knows the person, those lists include birthdays and name variations.

The middle one deserves a second look, because it is the reason this catches careful people. The code you receive is real. It really did come from the platform. Nothing about it looks fake, because nothing about it is fake. The only false part is the person asking you for it.

What to do now

The single rule that stops most of this: no legitimate platform will ever ask you for a verification code, a temporary password, or a PIN reset code. Not by text, not by email, not on a call. The FBI states this plainly. Anyone asking is not who they say they are.

• If a code arrives that you did not request, treat it as a warning that someone is trying to get into your account. Do not share it. Change your password by going to the app or site yourself.
• Do not use links in emails or texts about account problems. Open the app or type the address yourself.
• Turn on multi-factor authentication, which means a second step beyond your password, on any account that offers it.
• Use long, unique passphrases and PINs that are not built from names, birthdays, or anything else connected to you.
• The FBI also suggests thinking about whether intimate images need to stay in accounts that are reachable from the internet. Worth considering going forward. It is not a comment on anything you have already done.

If it has already happened

None of this is your fault. Having private photos is not a mistake, and it does not stop being a crime because of what was taken.

Secure the account first if you still can: change the password, sign out other sessions, turn on multi-factor authentication.

Save evidence before anything else. Screenshots, links to where content appeared, usernames, dates, any messages you have received.

If someone contacts you demanding money, do not pay and stop replying. Payment does not end it.

Report it through the proper channel for your country, which you can find on our Get help page. If intimate images of you are circulating and you are 18 or over, StopNCII.org is a free tool that creates a digital fingerprint of an image on your own device, so participating platforms can block it without the image ever being uploaded.

Then tell one person you trust. This is not something to carry alone, and the shame belongs to the person who took it.