Engagement as Evidence: How Scammers Mine Your Social Media Activity to Build Blackmail Campaigns

When most Americans think about social media risk, they imagine a stray embarrassing photo or an overshared political opinion. What they rarely consider is that the quiet, invisible layer of their online behavior — the posts they like, the accounts they follow, the groups they join — functions as an open intelligence file for anyone willing to read it carefully. Extortionists, it turns out, are very willing.

A growing body of law-enforcement reports and cybersecurity research documents a systematic practice in which bad actors treat social media engagement as reconnaissance data, using it to identify vulnerable targets and build coercive campaigns tailored with unsettling precision. Understanding how this pipeline works is the first step toward disrupting it.

The Reconnaissance Phase: Reading the Room Before Making a Move

Before a scammer sends a single threatening message, they typically spend time watching. Social media platforms surface an enormous amount of behavioral data publicly, by default. A Facebook profile's liked pages can reveal religious affiliation, political leanings, relationship status, and financial anxieties. An Instagram following list can expose a person's romantic interests. A Reddit post history can disclose medical conditions, family conflicts, or workplace frustrations.

This passive intelligence gathering requires no hacking. It requires only patience and a willingness to read what people have already made visible. Organized extortion groups — many of which operate from overseas and run what amount to industrialized fraud operations — use this data to sort potential targets by exploitability. Someone who publicly engages with content about debt relief, divorce proceedings, or addiction recovery, for example, may be flagged as a person with secrets worth threatening.

Automated scraping tools accelerate the process. Scripts can harvest engagement data from thousands of public profiles in hours, feeding the results into spreadsheets that criminal operators review for high-value targets. The operation resembles a sales funnel more than a crime scene.

Sextortion: The Most Documented Variant

The FBI's Internet Crime Complaint Center has recorded a dramatic rise in sextortion cases over the past several years, with financial losses reaching into the tens of millions of dollars annually. The targeting mechanism frequently begins with social media reconnaissance.

In a common scenario, a scammer identifies a target — often a teenage boy or a middle-aged man — based on public engagement patterns suggesting loneliness or romantic frustration. They create a fabricated female persona, initiate contact through Instagram or Snapchat direct messages, and escalate the conversation toward explicit image exchange. Once an image is obtained, the extortion demand follows immediately.

What makes these schemes particularly effective is the personalization. The scammer already knows the target's employer from their LinkedIn, their family members from their Facebook, and their hometown from their Instagram geotags. The threat to distribute compromising images is accompanied by a list of specific people who will receive them — people the target actually knows. That specificity is what produces panic, and panic produces payment.

In 2022, the FBI and multiple state law-enforcement agencies issued joint warnings after a wave of sextortion cases linked to West African criminal networks resulted in at least a dozen suicides among young male victims in the United States. The social media profiling phase was central to how those operations selected and approached their targets.

Financial Blackmail: A Less Visible but Equally Serious Threat

Sextortion receives most of the public attention, but financial blackmail schemes built on social media intelligence represent a parallel and growing threat. In these operations, scammers identify individuals who appear professionally prominent or reputationally vulnerable — executives, physicians, attorneys, clergy — and threaten to fabricate or amplify damaging claims unless a payment is made.

The leverage material is sometimes entirely synthetic: a scammer claims to possess compromising information they do not actually have, gambling that a person with professional standing will pay to make the threat disappear rather than risk the allegation becoming public. The credibility of the threat depends on the scammer demonstrating they know enough about the target to be believable. Social media provides that foundation.

In other cases, real information obtained through social media — a comment made in a closed Facebook group that was screenshotted and shared, a past association with a controversial figure visible through tagged photos — becomes the raw material for coercion. The target's own digital history is used as a weapon against them.

Why Platform Privacy Defaults Fail Users

A significant part of the problem is structural. Major social media platforms are designed to maximize engagement, which means maximizing visibility. Default privacy settings on platforms including Facebook, Instagram, X (formerly Twitter), and TikTok typically make a user's likes, follows, and activity either fully public or accessible to a broader audience than most users realize.

Furthermore, even when a user locks down their own profile, their activity on public posts — comments, reactions, shares — remains visible to anyone who looks at those posts. A person can have a fully private Instagram account and still leave a detailed behavioral trail across public content they interact with.

Platform terms of service technically prohibit scraping and harassment, but enforcement is inconsistent and reactive. By the time a complaint is processed, the damage is frequently done.

Practical Steps to Reduce Your Exposure

Reducing your vulnerability to social media-based extortion does not require abandoning these platforms entirely. It does require treating your engagement activity as public information and making deliberate choices about what you expose.

Audit your privacy settings now. On every platform you use, navigate to privacy settings and restrict who can see your likes, followers, following list, and tagged content. On Facebook specifically, use the Privacy Checkup tool to review each category of visibility. On Instagram, switch to a private account if public visibility is not essential to your use case.

Be selective about what you engage with publicly. A like on a post about financial hardship, relationship problems, or personal health is a data point. Consider whether that engagement needs to be public, or whether a private message to the person who posted it serves the same purpose.

Limit cross-platform linkage. Avoid using the same username across platforms, and do not publicly connect your LinkedIn professional identity to your Instagram personal identity unless there is a specific reason to do so. The aggregation of your professional and personal profiles creates a richer target profile.

Be cautious about direct message solicitations from unfamiliar accounts. Unsolicited contact from accounts you do not know — particularly those with limited post history, stock-photo profile images, or an unusually rapid escalation toward personal topics — should be treated with suspicion. Do not share images or personal information with contacts you have not verified through independent means.

Know how to report and document. If you receive an extortion message, do not pay. Payment rarely ends the demands and frequently invites escalation. Document everything — screenshots with timestamps — and report to the FBI's Internet Crime Complaint Center at ic3.gov, as well as to local law enforcement. The Cyber Civil Rights Initiative also provides resources specifically for victims of image-based extortion.

The Broader Principle

Every action you take on a social media platform is, in some sense, a publication. The architecture of these services encourages users to think of engagement as casual and ephemeral — a quick tap, a passing share. In practice, that data persists, aggregates, and can be read by anyone with the inclination to look. Scammers have that inclination in abundance.

The most effective defense is not paranoia but deliberate visibility management: knowing what you are making public, why, and what that information might communicate to someone whose intentions are not benign. Your engagement history tells a story. It is worth deciding, consciously, how much of that story you want available to strangers.