Consumer Ransomware ('Your Files Are Encrypted')
Malware locks or encrypts your files and demands a crypto ransom to restore them — often arriving through a malicious attachment, download, or fake update.
Think a message like this reached you? You can check it right now.
What this scam is
Ransomware is real malware that encrypts your files or locks your device, then displays a demand to pay (usually crypto) for a decryption key. It typically enters through a malicious email attachment, a pirated or fake software download, or a bogus 'update.' Paying does not guarantee recovery and funds crime. Good backups, caution with attachments/downloads, and up-to-date security software are the defenses; some cases have free decryptors.
What it usually looks like
- Files renamed/unopenable and a ransom note on your screen.
- A demand for crypto to decrypt.
- Origin from an attachment, pirated download, or fake update.
- A countdown before the price 'increases.'
Common warning signs
- Sudden loss of access to your files.
- A ransom note demanding crypto.
- Recent risky downloads or attachments.
- Pressure to pay before a deadline.
Example wording scammers use
“All your files have been encrypted. Pay 0.03 BTC within 72 hours to receive your decryption key.”
“Your computer is locked due to illegal activity — pay the fine to unlock.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- A crypto ransom.
- To exploit lost access to your data.
- Repeat victimization.
This is general safety information, not professional advice. It is not legal, financial, medical, or immigration advice, and it does not create a professional relationship. For your own situation, speak with a qualified professional or the official organisation involved. If you are in immediate danger, contact your local emergency number.
What to do
- Disconnect the device from networks; do not pay immediately.
- Keep offline backups so you can restore without paying.
- Check resources like No More Ransom for free decryptors.
- Avoid pirated software and unexpected attachments; keep security software updated.
What to do if you already responded
- If you are overwhelmed or thinking about harming yourself, call or text 988 (Suicide & Crisis Lifeline, US) — it is free, 24/7, and confidential.
- Restore from clean backups after wiping, or seek professional help.
- Report to ic3.gov and CISA.
- Report at reportfraud.ftc.gov.