After a friendly start on an adult platform, the conversation is moved to Telegram. Once there, the tone shifts: screenshots, family references, threats to publish - and a payment demand.
Telegram is the channel of choice for this pattern because it bypasses any moderation, lets the operator burn handles, and allows file-sharing of the captured material. By the time the threats start, the platform you originally met them on has no visibility.
If two or more of these match what is happening, treat it as the scam.
If you hear or read these, the script is running.
"Let's move to Telegram, it's more private.
"I have your screen recorded. Don't make me send it.
"Does your wife know about this?
"I found you on Facebook.
Sequential, low-risk actions. Do them in order.
Do not pay. Paying once almost always triggers a second demand.
Take screenshots of every threat with full timestamps visible.
Lock your social profiles (Facebook, Instagram, LinkedIn) to private.
Report to your national cybercrime authority and to the originating platform.
Submit the evidence here so we can map repeat actors.
Aggregated from the reports we have processed in this review window.
Confidential submission - encrypted at rest. We use anonymised patterns to alert others.