The Screenshot Is Not Proof: How Virtual-Kidnapping Scammers Fake a Loved One’s Distress
The FBI warns that altered photos and videos are being used as fake proof of life in virtual-kidnapping extortion. Here is a measured family verification plan, what to do under a deadline, and when to contact law enforcement.
A frightened call says a loved one has been taken. A screenshot or short clip appears to show them in distress. The caller gives you minutes to send money. In a December 2025 public-service announcement, the FBI warned that criminals are using altered photos and videos—sometimes drawn from material posted online—as supposed “proof of life” in virtual-kidnapping extortion. The image can feel more convincing than the voice, but it still does not establish where the person is or whether an abduction occurred.
- Take the threat seriously, but do not let the caller control every communication channel. If there may be immediate danger, contact local law enforcement or emergency services.
- Try to reach the loved one directly using a number or account you already know, or ask a trusted nearby person to check in.
- Do not send money or share private codes solely because a stranger sent an alarming image. Ask police for guidance and preserve the messages.
What “virtual kidnapping” means here
In many virtual-kidnapping schemes, the caller claims a person has been abducted and demands ransom, but the intended victim is not physically held by the caller. The threat is real as an extortion attempt, and the distress can be intense; the claim of custody may be fabricated. The FBI’s warning adds a troubling prop: an altered image or video that appears to show the missing person. Public social-media photos can give a criminal material to manipulate, while a dramatic message and countdown discourage the family from stopping to verify.
This distinction is not a reason to dismiss every report as fake. A family member could genuinely be in danger, and no article can determine that from a phone call. Treat the situation as urgent, use independent contact routes, and involve law enforcement if there is a credible threat or anyone may be missing. The safer response is not “ignore it”; it is “do not let an unknown caller be the only source of information.”
Why the image can feel like proof
People are wired to react to a familiar face in distress. A cropped picture, a short video, or a live-looking feed can override ordinary caution—especially when the caller knows a relative’s name, workplace, school, or recent trip. Those details can come from public posts, data exposure, or ordinary online research. A frightening visual can also make the family believe that only immediate payment will keep the person safe.
But images travel easily. A photo may be old, taken from a public account, or altered; a clip can be edited or generated. A sender can attach a real image to a false story. Conversely, a low-quality or awkward image does not prove nothing happened. Families should not try to conduct a forensic investigation in the middle of a crisis. Focus on contact, time, safety, and professional help—not on whether a face or background “looks right.”
A calm verification sequence
| Step | What to do | Why it helps |
|---|---|---|
| 1. Slow the demand | Say you are contacting authorities and end or pause the call if safe. Do not promise payment or follow instructions to stay isolated. | A countdown is designed to prevent independent checks; a short pause restores options. |
| 2. Call the person | Use a saved number, workplace line, school contact, or another channel you already trust—not a number supplied by the caller. | A separate route tests the story without relying on the extortionist’s channel. |
| 3. Ask a trusted nearby person | Contact a family member, coworker, travel companion, or neighbor who may physically know the person’s status. | Someone nearby may confirm safety faster than repeated calls to an unreachable phone. |
| 4. Contact law enforcement | If danger may be immediate or the person cannot be reached, call local emergency services or law enforcement and explain the threat and evidence. | Authorities can advise what information to provide and what steps fit the situation. |
| 5. Preserve evidence | Save call logs, messages, account names, payment instructions, and the original media. Note times and exact demands. | Accurate records help investigators and payment providers assess the case. |
Agree on a family code word before a crisis
A family code word can help distinguish a real emergency from a stranger’s story, but only if it is agreed in advance and kept private. Choose something ordinary enough to remember but not guessable from public profiles. Decide what to do if someone forgets it: hang up, contact the person through a saved number, and call a trusted family member. Do not post the code word or send it in a group chat that includes people who do not need it.
It is also useful to agree on a simple “I am safe” check-in plan for travel or late arrivals. Share expected arrival windows and who to contact if plans change. This is not about constant tracking; it is about giving relatives a known next step so a threatening caller cannot define the only path to information.
Public posts deserve a little thought. Avoid posting real-time travel itineraries, school pickup routines, full names of children, or details that identify when a household is empty. Privacy settings reduce casual exposure but do not guarantee that a photo cannot be copied. Families may decide to share vacation photos after returning rather than while away.
What not to do under pressure
- Do not rely on a single visual. A photo or clip is one piece of information, not independent confirmation.
- Do not move the conversation to a secret channel. Secrecy can isolate the target and prevent a second person from noticing contradictions.
- Do not share new personal information to “prove” identity. The caller may use answers to improve the story or target relatives.
- Do not send cryptocurrency, gift cards, or a wire just to buy time without independent advice. Payments may be hard to recover and may encourage further demands.
- Do not accuse or post the suspect’s identity publicly. Preserve evidence and let authorities assess it; public confrontation can create additional risk.
If the caller has a real person’s voice, do not assume that voice alone authenticates the situation. Familiar speech can be imitated or recorded from public material. Equally, the absence of a familiar voice does not establish that the threat is false. Use a separate contact method, a prearranged code word if available, and law enforcement guidance.
If money or information has already been sent
Contact the bank, wire company, payment app, or cryptocurrency exchange immediately using its official contact information. Ask whether the transaction can be stopped or flagged. Preserve the conversation and any transaction identifiers. Report the incident to local law enforcement and to the FBI’s Internet Crime Complaint Center at IC3.gov if it involved online communication or electronic payment. Reporting does not guarantee that money can be recovered, but acting quickly may preserve options.
After the immediate threat is addressed, check whether the person’s social accounts or phone number were compromised. Change passwords from a trusted device, secure email, review recovery methods and active sessions, and alert close contacts not to trust unexpected money requests. If someone may genuinely be missing, continue working with law enforcement rather than relying on messages from the extortionist.
Care for the people receiving the threat
A person who nearly paid—or did pay—should not be blamed for reacting to what looked like a loved one in danger. The attacker is using fear and a short deadline on purpose. Help by staying on the line, taking notes, calling the relative through a known number, and speaking with authorities. If several family members are involved, designate one person to communicate with police and one to make independent contact attempts, so the group does not fragment into panic and duplicate the caller’s instructions.
For other official-looking threats that use urgency and authority, see our guide to government impersonation. The same protective principle applies: verify claims through a channel you chose, not through contact details supplied by the person applying pressure.
The key point
A disturbing image is a reason to act, not proof that an unknown caller’s story is true. Contact the loved one independently, involve emergency services when there may be immediate danger, preserve evidence, and do not let a stranger’s deadline prevent verification. Prepared families can make that first minute less chaotic by agreeing now on a code word and a trusted check-in route.