A Stranger Added a Missouri Family to a Group Text. It Appeared to Be the Setup for an Extortion Scam
Security experts say AI now automates the targeting — public photos scraped from social media, and hacked email contacts that show who’s related to whom. The protective steps are simple ones: private profiles, two-factor logins, and never paying.
By Sean Anees Saifi · Capital Wealth · Published Thursday, September 10, 2026 · Source: The Wall Street Journal, September 9, 2026 edition (Personal Journal)
Key Points
Last month a Missouri father was added to a group text from an unknown California number that also included his wife, his son-in-law, the son-in-law’s parents and then his 16-year-old son.
The sender posted a photo of his 24-year-old daughter from her public Facebook page, then a fabricated, compromising image of her, apparently to set up a demand for money; the family blocked and reported the number.
Security experts say AI now automates this kind of targeting by scraping social media and public photos, while a hacked email account’s contacts can reveal phone numbers and how people are related.
Criminals tend to run open-weight AI models on their own machines rather than consumer chatbots that could flag the abuse, and teenage boys have lately been a key target of such schemes.
Experts advise private social accounts, strong unique passwords with two-factor authentication, ending unknown signed-in sessions, refusing to pay, and reporting the sender to the FBI’s Internet Crime Complaint Center (IC3).
$0
what experts say to pay an extortion demand
2FA
two-factor logins on every account
Private
the setting for Facebook and Instagram
IC3
the FBI’s complaint center for reports
Security experts say AI tools and hacked email contacts let criminals map who’s related to whom, turning an ordinary family group text into a target.
In one line: Extortion scams now use AI, public photos and hacked contacts to reach whole families, so lock down the accounts together — and never pay a demand.
Last month, a Missouri father was added to a group text from an unknown California number. His wife was on it. So were his son-in-law and the son-in-law’s parents, and then his 16-year-old son. The sender posted an ordinary photo of his 24-year-old daughter, taken from her public Facebook page, then followed it with a fabricated, compromising image of her — apparently the setup for a demand for money. The family blocked the number and reported it. His daughter says she worries the image could resurface.
How the scheme finds a family
Security experts say AI now automates this kind of targeting, scraping social media and public photos. A hacked email account can supply the rest: phone numbers, and a map of who’s related to whom — the kind of detail that lets a stranger gather in-laws from two households into one thread. The criminals tend to run open-weight AI models on their own machines rather than mainstream chatbots, which could flag the abuse. Teenage boys have lately been a key target of what experts call sextortion, and fake e-vites that steal email logins are a growing scam of their own. This family checked; its wedding e-vite was real.
What a family can do
The defenses are ordinary, and that’s the point. Set Facebook and Instagram to private and accept only people you actually know. Use strong, unique passwords and turn on two-factor authentication. Check which devices are signed in to your email and social accounts, and end any session you don’t recognize — changing a password alone may not kick an intruder out. If a demand arrives, don’t pay. Block the sender and report the number or username to the FBI’s Internet Crime Complaint Center, known as IC3. Paying buys no promise of silence. “If you do pay, will it guarantee they won’t? Not necessarily,” says Steve Grobman, McAfee’s chief technology officer.
The same day’s Personal Journal carried the story of a romance scam that turned a mother against her daughters, covered elsewhere in this edition. Both schemes work the ties between relatives, which makes a family’s digital footprint — public photos, shared contact lists, the email accounts that hold everyone’s numbers — part of what a plan protects now, alongside the insurance and the estate documents. Sit down together, teenagers included, and go account by account. It’s an evening’s work, and it’s far easier before a stranger’s number appears in the family thread.
What It Means For Your Portfolio
Avoid — never pay; block the sender and report it to the FBI
A family’s public photos and shared contact lists are now raw material for extortion, so private profiles, unique passwords with two-factor logins and a firm rule never to pay belong in the household plan alongside the insurance.
General planning principles, not advice for anyone in particular: consumer protection now reaches the family’s digital footprint. Private social accounts, strong unique passwords, two-factor authentication and a periodic check of signed-in devices are low-cost safeguards. If an extortion demand arrives, experts advise not paying, blocking the sender and reporting it to the FBI’s Internet Crime Complaint Center.
In the book, there’s no position tied to this story, and nothing is bought or sold on it. The work is structural rather than tactical — the same unglamorous category as naming a trusted contact on each account: safeguards set up while nobody needs them, so a stranger’s message finds the doors already locked.
