FTC: “Sextortion Help” Firms Ran Fear-Based Scam

CyberScoop · Medium sophistication
Last updated October 14, 2026

The FTC sued Dmitry Belkin and multiple companies accused of exploiting sextortion and romance-scam victims through deceptive websites and telemarketing. The complaint says the businesses promised to stop attacks and work with law enforcement, but instead used fear tactics, fabricated “evidence,” upsold costly “phases,” and often denied refunds.

How the scam worked

According to an FTC lawsuit, Dmitry Belkin and a network of businesses marketed themselves as crisis responders for people facing sextortion or romance-scam attacks. The companies advertised that they could stop an ongoing attack, trace the attacker, and coordinate with law enforcement. Victims were sold a Phase 1 package costing between 1,499 and 20,000 dollars, and the complaint alleges the companies instead blocked scammers, fabricated chat transcripts, and used pre-saved geolocation coordinates to make it appear real work was being done.

Why it succeeded

The scheme relied on a scripted approach designed to exploit fear and shame. The complaint describes a call script built around alarming language, including insinuations about child exploitation and legal liability, with employees required to confirm they had used specific keywords during calls. Victims facing reputational and legal fear were less likely to pause and verify claims before paying. The scripts also discouraged victims from contacting law enforcement, framing police involvement as the last thing a victim should do, which cut off an obvious path to independent verification.

What to watch for

  • A provider that claims it can resolve a sensitive, high-stakes incident but actively discourages involving law enforcement
  • Scripted, emotionally charged language referencing catastrophic personal or legal consequences
  • An initial paid package followed by pressure to purchase a second, more expensive phase for vague ongoing monitoring
  • Unhappy customers being redirected to review or complaint channels controlled by the same company rather than independent, official sites

Building resistance

Organizations and individuals can reduce exposure to this type of fear-based extortion scam by treating urgency and fear as signals to slow down rather than speed up. Anyone encountering a crisis-response offer, whether personally or through a colleague seeking help, should independently verify the provider and favor contacting law enforcement or established legal and HR channels directly rather than relying on a vendor's claims. Security and HR teams can use this case as a training example: scripted fear tactics, discouragement of outside verification, and phased upselling are patterns that extend well beyond sextortion scams into other social engineering schemes targeting employees and executives. Building awareness of these patterns, and normalizing a pause-and-verify habit before paying for any emergency service, is a practical defense against this category of fraud.

Key findings

  • FTC lawsuit alleges Belkin and 12 businesses used deceptive marketing and telemarketing to sell “sextortion” protection services they did not provide.
  • Companies advertised “Phase 1” services ($1,499–$20,000) claiming they could stop an ongoing sextortion attack, trace the attacker, and coordinate with law enforcement.
  • FTC alleges the companies instead blocked scammers, fabricated chat transcripts, and used pre-saved geolocation coordinates to mislead customers.
  • After Phase 1, customers were pressured into additional “Phase 2” monitoring services, which the FTC says also were not performed.
  • The complaint describes a call script designed to exploit fear (e.g., insinuations about CSAM/minors and legal liability) and required employees to use specific alarming keywords.
  • Unhappy customers were allegedly routed to a fake Better Business Bureau site and pressured with settlements/non-disparagement to remove negative reviews.

Who’s being targeted

  • Commonly targeted roles: All employees, Executives, HR, Finance (employees may seek reimbursement/payment help), Security/Helpdesk.
  • Affected industries: Consumers/Individuals seeking sextortion help, Digital security and privacy services (as a scam cover).
  • Attack channels: website, vishing.
  • Impersonated: Digital forensics / sextortion protection “experts”, Sextortion protection hotline / incident responder.

Red flags to watch for

  • Uses extreme fear language and catastrophic consequences to rush decisions
  • Discourages contacting real law enforcement (“the last thing you want to do”)
  • High-pressure upsell from an initial package into additional paid “phases”
  • Tries to isolate the victim from trusted help (police, internal security, trusted contacts)
  • Pushes immediate action based on fear and shame
  • Frames itself as the only solution while discrediting legitimate support
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo

Frequently asked questions

What did the FTC allege about these sextortion help companies?

The FTC lawsuit alleges that Dmitry Belkin and 12 businesses sold sextortion and romance-scam protection services they did not actually provide, using deceptive marketing and telemarketing.

How did the scam pressure victims into paying?

According to the complaint, the companies pitched an initial Phase 1 package costing between $1,499 and $20,000, then pressured customers into paying thousands more for additional Phase 2 monitoring services.

Why did the scam discourage victims from contacting police?

The complaint alleges the defendants told victims that law enforcement would not help and that contacting police was the last thing they wanted to do, isolating victims from legitimate support.

What should someone do if offered a paid sextortion crisis service?

Be wary of any provider that discourages contacting law enforcement, uses fear-based language, or pushes expensive phased upsells, and verify the provider independently before paying.

Read the video transcript

Imagine you’re being sextorted… and the ‘rescue’ service turns out to be a scam too. The FTC says Dmitry Belkin’s companies sold ‘Phase 1’ sextortion protection for $1,499 to $20,000, promising to stop attacks and work with police… but instead just blocked accounts, faked chat logs, and used pre-saved location data as ‘proof.’ Their script leaned on fear: lines like, “I’ve seen these situations ruin people’s retirement all from the accusation of being a child predator,” and, “contacting the police is the last thing you want to do,” then pushing you into more paid “Phase 2” monitoring. Here’s the move: if anyone selling “sextortion help” tells you not to involve law enforcement or our security team, stop the call, hang up, and contact real law enforcement or security yourself.

MITRE ATT&CK techniques

Similar attacks

Fake Cops Threaten Arrest to Force Payments

Fake Cops Threaten Arrest to Force Payments

The FBI warns about phone scams where callers impersonate police or federal agents and threaten arrest unless the victim pays immediately. The scams use pressure tactics (keeping victims on the phone, urging secrecy) and push hard-to-trace payments like prepaid cards, crypto, wire transfers, or…

September 21, 2026
FBI: Fake Cops Swindle $1.6B via Threat Calls

FBI: Fake Cops Swindle $1.6B via Threat Calls

The FBI says scammers posing as law enforcement or government officials stole over $1.6B since January 2025, mainly by calling victims and threatening arrest, fines, or legal trouble unless they pay. Variants include jury-duty threats, targeted calls to medical professionals about license issues,…

September 18, 2026
Wall Street Hit by Help Desk Impersonation Calls

Wall Street Hit by Help Desk Impersonation Calls

A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…

August 20, 2026
BlackFile Vishing Poses as IT Support to Extort Firms

BlackFile Vishing Poses as IT Support to Extort Firms

Researchers say the BlackFile extortion group is actively targeting large financial and other organizations using voice-phishing calls where attackers impersonate IT support to get initial access. Victims are then pressured with multimillion-dollar extortion demands and, in some cases, escalations…

August 17, 2026
ShinyHunters Used Phone Pretexts to Bypass MFA

ShinyHunters Used Phone Pretexts to Bypass MFA

A Register podcast transcript describes real-world activity linked to the ShinyHunters cyber extortion crew, including an FBI-related breach and subsequent arrests. It also notes the group’s reliance on social engineering phone calls where attackers impersonate locked-out contractors or employees…

October 12, 2026
ASOS App Push Alert Used to Extort Customers

ASOS App Push Alert Used to Extort Customers

Attackers abused ASOS’s own mobile app messaging to send customers a threatening push notification claiming ASOS’s Snowflake environment was compromised and demanding engagement to avoid a data leak. ASOS confirmed the notification was unauthorized and warned customers to watch for follow-on…

October 9, 2026