Cyber extortion is no longer an isolated individual crime in Libya, but a recurring pattern confirmed by official figures. In the first quarter of 2025 alone, the Ministry of Interior’s Department for Combating Information Technology Crimes recorded 135 cybercrime cases, including 104 cases involving social media pages. These cases involved action taken against 149 pages, 188 devices, and various seized items. These figures represent only the reported portion; the majority of victims, particularly women, do not reach police stations in the first place.
In the same context, a report by the High National Elections Commission on electronic violence against women (January–June 2025) found that 89% of the sample of posts analyzed constituted violent speech against women through insults, stigmatization, and mockery, while Facebook alone accounted for approximately 97% of these posts.
This guide is divided into four sections
Understanding the risks, prevention, what to do if you become a victim, and resources. You can read it in full or go directly to the section you need right now.
Quick checklist (just two minutes)
☐ Two-factor authentication is enabled on Facebook, WhatsApp, Instagram, and Snapchat
☐ Privacy settings are limited to "Friends," not "Everyone," on every platform
☐ I do not accept friend requests or messages from accounts I do not personally know
☐ I know the appropriate reporting number for my situation (listed in the table below)
☐ I understand that any image I post publicly can be used outside its original context
If you checked all five, you are in a good position. If not, the next section explains how to improve your situation.
First: Understanding the Risks—How Do Extortionists Actually Operate?
Libyan security agencies uncovered a series of cases during 2025 and 2026 that clearly map out the methods used by perpetrators:
Pattern One—
Account hacking and theft of private photos (Sabratha, June 2026): A person was apprehended after hacking Snapchat accounts and taking family photos belonging to at least 18 girls, then extorting money from them. The case was uncovered only after one of the families filed an official report. → Exploited vulnerability: a weak password or the absence of two-factor authentication.
Pattern Two—
AI-generated manipulation (Brega, June 2026): A suspect was apprehended after obtaining completely ordinary photos of girls and using artificial intelligence techniques to turn them into fabricated obscene images to extort them. This is the most dangerous method: the victim did nothing wrong and did not share any sensitive content in the first place. → Exploited vulnerability: ordinary personal photos posted publicly, with nothing "offensive" about them to begin with.
Pattern Three—
Cross-border networks (Central Region, May 2025): A suspect was arrested for extorting citizens through Facebook and WhatsApp. Investigations revealed the involvement of associates outside Libya who used fake accounts and international numbers to conceal their identities. → Exploited vulnerability: excessive trust in a message or unfamiliar number simply because it seemed "personal" or "urgent."
Pattern Four—
Fake AI-generated "customer service" pages (July 2026):
During July 2026, the Tahaqaq team dealt with a case involving a citizen who encountered a technical problem with his banking app. He searched for his bank’s name on Facebook and found a page called "Customer Service" that appeared completely convincing: recent posts, seemingly genuine comments, and even a sponsored advertisement at the top of the search results. He contacted the page and followed "account reactivation" instructions sent by someone who spoke confidently—within minutes, LYD 100,000 and USD 5,000 had disappeared from his account. This is not an isolated case: the Tahaqaq team identified more than 80 impersonation advertisements targeting banking-service users in just 25 days during July 2026.
What is striking is that these advertisements no longer rely on poor-quality images or badly written text as they did in the past. Instead, they use artificial intelligence to generate high-quality images and videos, along with grammatically sound text that mimics the style of banks’ official statements. The team even identified cases in which a bank’s logo had been redesigned with slight changes—such as the thickness of the font, the shape of a letter, or a shade of color—that are difficult for the human eye to notice but sufficient to deceive automated detection systems and extend the lifespan of the fake advertisement before it is removed.
Even institutions were not spared: In June 2026, the Central Bank of Libya was subjected to a cyberattack, following which vast amounts of data were published on the dark web. The bank categorically refused to negotiate or respond to the extortion demands and adhered exclusively to the legal process. This is precisely the principle we recommend to every victim: responding to one demand does not end the story; it opens the door to what comes next.
Additional General Rules:
- Do not accept friend requests or messages from accounts you do not personally know, no matter how convincing they seem or whether they claim to represent an official entity.
- Do not search for your bank’s "customer service" through Facebook or Google.
- Always use the official app installed on your phone, the number printed on your bank card, or the official bank website you saved in advance.
- Any page that appears in search results or as a sponsored advertisement—no matter how professional it looks or whether it carries the correct logo—can be completely fabricated using artificial intelligence, as happened in the July 2026 case above.
- Use strong, different passwords for each account, and never share a verification code with anyone, regardless of their pretext.
- Assume that any image you post publicly—even if it is "completely ordinary"—can be used outside its original context, including for AI-generated manipulation.
- Do not negotiate with the extortionist or pay. Responding to one demand rarely ends the story; it usually opens the door to a larger demand.
Third: If You Are a Victim Right Now—6 Immediate Steps
1_Do not pay or respond to any demand
. Local and international documented experience confirms that payment does not stop extortion; instead, it proves to the extortionist that you are a source of income. One documented testimony concerns a victim who sold her phone and all her gold in response to escalating demands. The threats did not stop until all her resources had been exhausted.
2_Do not delete anything
. Conversations, messages, photos, and threatening accounts are your evidence. Keep screenshots showing: the account name and link, the date and time of the messages, and the full text of the threat.
3_Stop communicating after documenting everything
Do not argue with, plead with, or negotiate with the extortionist; every additional interaction gives them new tools for applying pressure. Document everything, then stop responding (you can block them after completing the documentation).
4_Secure your accounts immediately
Change your passwords, enable two-factor authentication on all your accounts, and log out of unknown devices through each app’s settings.
5_Report to the competent authorities
(see the reporting table below)
6_Tell someone you trust
Isolation is the extortionist’s most powerful weapon. The documented cases were resolved only when the victim or their family broke the silence, as happened in the Sabratha case.
An Important International Tool for Protecting Private Images
If the threat concerns private or intimate images (real or fabricated), StopNCII.org—an international initiative that works with Facebook, Instagram, TikTok, and other platforms—provides a free service that prevents the image from being posted on these platforms without uploading the image itself to any entity (a digital fingerprint is created on your device only). If the victim is under 18, the dedicated service is TakeItDown.NCMEC.org.
Common Mistakes to Avoid
- Amicable settlement through intermediaries and acquaintances:
It may provide temporary relief, but according to legal experts, it implicitly encourages the perpetrator to repeat the crime against another victim and offers no protection if they resume the threats.
-Surrendering to the idea of "scandal":
The suspect in the Brega case created entirely fake images from innocent photos; in other words, the existence of an "image" is no longer proof of anything, and the law and security agencies understand this.
- Delaying the report:
The three-month legal deadline makes delay costly. Document everything and report early, even if you have not yet made a final decision; an initial consultation through Tahaqaq or the Libyan Organization for Law and Cyber Services does not obligate you to do anything.
Why Shouldn’t You Be Ashamed to Report It?
Many victims of fraud and extortion fear society’s view of them and the embarrassment they may feel more than they fear financial loss. In one case recently handled by the Tahaqaq team, a victim who lost LYD 100,000 and USD 5,000 in a banking scam chose to remain silent and not document his story, despite the team’s efforts to convince him that publishing it—even under a pseudonym—could protect others from falling into the same trap. This is understandable on a human level, but it has broader consequences: according to a study issued by the United Kingdom’s National Trading Standards authority, only 32% of fraud victims report their cases to the authorities, meaning that the vast majority of criminal patterns remain undocumented and unknown to the relevant authorities. Silence does not protect you; it conceals information that could help uncover recurring patterns and prevent new victims from being targeted in the same way you were. Remember: you are the victim, not the perpetrator—and reporting, not silence, is what prevents what happened to you from happening to someone else.
Fourth: Frequently Asked Questions
Will I be punished if I report, even if the stolen content is sensitive?
Legally, being the victim of a hack should not make you responsible for content stolen from you. However, complete documentation (Step 2 above) is what practically protects you before making any report.
What if the extortionist is outside Libya?
This does not invalidate the case. The May 2025 case documented a network involving associates outside Libya that was tracked, with its local member apprehended despite the use of international numbers and fake accounts.
Does reporting mean that my name will become public?
Reports submitted through the official channels mentioned above, as well as through the Tahaqaq platform, are handled confidentially as a standard operating procedure in this type of case.
What Does the Law Say?
Law No. (5) of 2022 on Combating Cybercrime is currently the only specialized legislation. Article 10 criminalizes unauthorized access to individuals’ data and accounts, with penalties of up to life imprisonment in cases involving the publication of protected data online. But the full truth must be stated: the law has faced widespread human rights criticism for granting the executive branch powers of surveillance and blocking without judicial authorization. Moreover, extortion specifically—in the sense of threats and coercion—has no explicit provision in the law, so courts generally rely on Articles 429 and 430 of the general Penal Code. As for the draft law on combating violence against women, prepared in 2017, it is still awaiting approval. In practice, a threat without execution is classified as a misdemeanor (imprisonment of up to two years or a fine), while carrying out the threat and publishing the content elevates the offense to a felony carrying a harsher penalty.
Tahaqaq’s Role
Tahaqaq monitors recurring patterns of impersonation and extortion cases in Libya and turns them into preventive material available to everyone, such as this guide. It also provides a confidential channel for receiving victims’ reports at tahaqaq.ly/report, as well as a comprehensive guide to protection from digital and banking fraud at tahaqaq.ly/guide. Every documented case and every testimony shared, even under a pseudonym, adds to our collective understanding of perpetrators’ methods—and therefore of ways to thwart them before they occur.
Sources of the figures cited in this guide
The two official publications of the Libyan Ministry of Interior dated March 30, 2025, and May 13, 2025.
The High National Elections Commission report on electronic violence against women (January–June 2025).
Verified press reports on the Sabratha and Brega cases (June 2026) and the cross-border network (May 2025).
Monitoring by the Tahaqaq team of the banking-fraud case and the impersonation-ad campaign (July 2026).
The United Kingdom’s National Trading Standards authority study on fraud-victim reporting rates.
