Blackmail and extortion across borders: how we handle a cross-border case from start to finish

By Yair Cohen, Solicitor specialising in internet law

If you are being blackmailed or extorted online and the person doing it, or the platform holding your images, sits in a different country from you, the case can usually still be stopped. The work has a clear shape: we protect you now with an emergency injunction and an anonymity order, we identify who is behind the account using a UK disclosure order, we obtain the evidence from the platform even where it is a US company, and we hold the position with a court order while that work is done. This article sets out how we handle a cross-border blackmail or extortion matter end to end, the routes we combine on each side of the border, and why a UK firm can sometimes do what a purely domestic lawyer at home cannot.

We act for clients in the UK and for international clients, particularly in the United States, where the blackmailer or the evidence is connected to this country. The reason the cross-border position matters is simple. English law gives a victim three things that are hard to get from the US courts alone: an emergency injunction against the wrongdoer, a court order to unmask an anonymous blackmailer, and remedies that are not blocked by the First Amendment or by the Section 230 immunity that protects US platforms.

What makes a blackmail case cross-border

A blackmail or extortion case becomes cross-border the moment the people, the evidence and the harm are not all in the same country. In our experience that happens in a few familiar ways. The victim is overseas, often in the United States, while the blackmailer appears to be in the UK. The blackmailer is overseas while the victim is here. Or, most commonly of all, nobody is quite sure where the blackmailer is, but the images and the messages sit with a platform that is a US company, such as Instagram, Snapchat, WhatsApp or a dating site.

The good news is that a case does not have to be tidy to be winnable. What matters is that at least one of the important pieces, the wrongdoer, the evidence or a place to enforce against, has a connection to a country whose courts can give you a real remedy. England is very often that country, because the remedies here are strong and the courts are willing to act quickly. The job is to work out where each piece sits and then to pick the route in each place that gets you the result.

Step one: protecting you now with an injunction and anonymity

The first thing we do is stop the threat from being carried out, and the fastest way to do that is usually an emergency injunction combined with an anonymity order, which a specialist solicitor can often obtain within a day or two. An injunction is a court order that forbids the blackmailer from publishing or sharing the material, or from contacting or harassing you. An anonymity order keeps your real name off the public court file, so the case proceeds under initials and only the judge and the lawyers know who you are.

There is no standalone civil claim called "blackmail" in English law, so it is worth understanding what the injunction is actually built on. Blackmail is a criminal offence under section 21 of the Theft Act 1968. The civil injunction that protects you is built on the law of harassment, under the Protection from Harassment Act 1997, and on the misuse of private information, where you have a reasonable expectation of privacy in what the blackmailer is threatening to expose. That is the well-established footing on which these orders are granted, and the same footing is available to an overseas victim whose blackmailer or evidence is here. Our page on emergency blackmail injunctions explains how the orders are obtained and how quickly.

For an overseas client this step also answers the question we are asked most: do I have to travel, and will my name come out? The answer to both is usually no. We can bring the entire application on your behalf and, in most cases, under a pseudonym with a court order anonymising you, so the matter is handled remotely and your identity stays between you, the judge and us.

You do not have to be in the country, and in most cases you do not even have to be named. The whole point of the anonymity order is that the matter can be dealt with without the very exposure the blackmailer is threatening you with.

A jurisdiction point that matters for overseas victims

There is one quirk of English law worth understanding early, because it shapes which claim we bring for a victim who lives abroad. For harassment, English law generally treats the wrong as happening where the victim is, rather than where the perpetrator is. So if you are in the United States with no real connection to the UK beyond being targeted by a UK-based blackmailer, a claim built only on harassment can raise a question about whether the English court is the right place to bring it.

In blackmail and sextortion cases we can usually get past that, because harassment is not the only route, and often not the best one. What the blackmailer is really threatening is the disclosure of your private information, and English law has two well-established common-law claims aimed squarely at that: misuse of private information and breach of confidence. Both are about the threatened disclosure itself rather than the course of harassing conduct, and the wrong the perpetrator intends to commit, publishing your private material, is something they intend to carry out from here in the UK. That is usually enough to let us bring the claim and apply for an injunction against a UK-based perpetrator even though you are overseas.

Breach of confidence is a particularly good fit where the private information was shared inside a relationship of trust, for example intimate images or secrets passed between partners that one of them now threatens to expose. English law has long protected information given in confidence, and that protection does not fall away simply because the relationship has.

Step two: identifying a UK blackmailer with a Norwich Pharmacal order

Where the blackmailer is anonymous, the next step is to find out who they are, and the English route for this is a Norwich Pharmacal order. This is a court order that requires a company that has become caught up in the wrongdoing, such as the platform, bank or payment processor, to hand over the information it holds that can help identify the person behind an account. The jurisdiction comes from the case that gave it its name, Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133, and it has been used in internet cases for years.

For a US reader, the simplest comparison is a third-party information subpoena: it is aimed not at the wrongdoer but at the innocent company that holds the data trail. The disclosure does not always produce everything, an IP address may be missing or an email may be a throwaway, but combined with open-source intelligence it is frequently enough to establish who we are dealing with. We pair the court order with our own identification work, which you can read about at how we identify anonymous internet users using open-source intelligence, and our page on disclosure orders to unmask anonymous online users sets out the wider picture. Identification is not guaranteed against a sophisticated overseas operator, and we give you a realistic view of the prospects on the first call.

Step three: reaching evidence held by a US platform under 28 U.S.C. § 1782

Where the evidence sits with a US-headquartered platform, the English order is not the end of the story, because a US company is not always required to comply with it. The route that solves this is a discovery application in the United States under 28 U.S.C. § 1782, which lets a litigant obtain evidence located in the US for use in legal proceedings abroad. In practice we coordinate with US counsel in the relevant federal district, support the application with an English witness statement, and feed what comes back into the English action.

This is the heart of the cross-border advantage. A purely domestic lawyer in the victim's home country may have no way to compel a foreign platform or to bring the wrongdoer before a court, while a US-only lawyer may have no civil injunction to offer and may be blocked by Section 230 and the First Amendment. By using the English remedies and the US discovery route together, we can usually reach both the wrongdoer and the evidence. Our page on advice on 28 U.S.C. § 1782 discovery applications explains how that procedure works in more detail.

Step four: holding the position and bringing the matter to an end

While the identification and disclosure work is being done, the injunction holds the position, so the threat cannot be carried out in the meantime. This is the part overseas clients find hardest to believe is possible: that the material can be locked down before anyone has been named, and stay locked down while we work out who is behind the account. Once the blackmailer is identified and served with the order, many matters simply stop, because the leverage a blackmailer relies on is anonymity and the victim's silence, and both have gone.

From there, the routes to a final resolution are the ones you choose, and we talk you through which is worth pursuing in your situation. They are a civil claim for damages and a permanent injunction, a harassment claim where the conduct is a course of behaviour rather than a single threat, or a criminal complaint to the police, which an overseas victim can support without it taking the matter out of their hands. Where intimate images are involved, there is also a specific criminal offence under section 66B of the Sexual Offences Act 2003, in force since 31 January 2024, of threatening to share an intimate image, and that offence applies even if the image does not actually exist.

What each route reaches, and what it does not

No single route reaches everything. The strength of a cross-border matter is the combination, and it helps to know what each one gives you and where each one stops.

A Norwich Pharmacal order reaches the records held by a company that has been caught up in the wrongdoing, which on most internet matters means the platform, the bank or the payment processor. What it typically produces is account holder data, IP addresses, payment details, and the messages and metadata the company holds. What it does not produce is the records of a third company that is not before the English court, and a US-based platform is not always compelled to comply. That is the point at which the § 1782 application picks up.

A § 1782 discovery application reaches records held by a US-headquartered company, by way of a subpoena issued out of a US federal court for use in the English proceedings. What it typically produces is the same kind of platform-side data that a Norwich Pharmacal order would have produced if the company were UK-based, plus the ability to seek documents and depositions where the US court permits. What it does not produce is the wrongdoer's own private records, only the trail the platform holds.

Open-source intelligence work, run by our investigators in-house, reaches what is publicly accessible to anyone with the right tools and training: licensed people-search databases, ownership and corporate records, breached-data archives, social media footprints, dark-web mentions, and the connections between accounts that look unconnected on the surface. What OSINT produces is identity, location, and the pattern of behaviour from outside the platforms. What it does not produce is the records the platform holds internally, which is why it pairs with the court orders rather than replacing them.

The three routes are different tools for different kinds of evidence, and most matters use two or three of them in some combination. The first call works out which combination fits the facts and the budget you are working with. Our work for international clients sits within our cross-jurisdiction internet law practice for international clients, and the wider picture is on our internet blackmail and sextortion solicitors page. For US clients specifically, our sextortion and online extortion help for US clients page is written for the way these cases reach us from the United States.

What the timeline looks like, from first call to final order

A fast-moving matter runs in days to a few weeks. A more involved one runs across a few months. The shape changes with how urgent the threat is, what evidence we have to work with, and whether the wrongdoer is already identified.

The first call is a same-day or next-day affair, depending on when you reach us. We take a full account of what has happened, what evidence you have, and where the wrongdoer and the platform appear to be. On that call we tell you whether an injunction is realistic, what the next steps would be, and what each route would cost in pounds. Nothing is committed at that point.

If we move forward, the preparation of the application takes a few days. A without-notice emergency injunction can often be lodged within a week of the first instruction, sometimes sooner, and the court will list it for hearing quickly. In urgent cases, including out-of-hours and weekends, an interim order can be obtained within hours.

If the order is granted on a without-notice basis, the court fixes a return date a few days later. The return date is when the other side comes to court and has the chance to make their case for why the order should not continue. That is when the order either continues until trial or is varied, and the work of the next stage begins.

The identification work, by Norwich Pharmacal or § 1782 or OSINT or some combination, runs in parallel with the injunction holding the position. Court orders on a platform typically take a few weeks to land. A § 1782 application moves at the pace of the US federal court hearing it, which varies by district. OSINT can complete in days where the public footprint is rich.

Once the wrongdoer is identified and served with the court order, many matters stop. Where they do not, the final resolution is either a settlement, a permanent injunction at trial, or a criminal complaint that takes its own course.

How an English emergency injunction actually works

The without-notice application is the procedural backbone of the work. It means the application is heard without the other side being told first, which is what allows the order to take effect before the wrongdoer has the chance to react. It is reserved for cases where notice would defeat the purpose of the order, which an injunction against a blackmailer almost always is.

The application is supported by a witness statement and a duty of full and frank disclosure. The client, through us, has to put before the court all the material facts, including any that cut against the order being granted. That duty is taken seriously, and the witness statement is the document the case rises or falls on at the without-notice stage.

The client also gives a cross-undertaking in damages. This is a promise to compensate the other side for any loss the injunction causes them if it turns out, later, that the order should not have been granted. For most clients in these cases that exposure is theoretical, because a blackmailer cannot show any legitimate loss from being prevented from blackmailing someone. The undertaking has to be given, and we explain what the realistic exposure looks like before it is.

The order itself names what the wrongdoer is forbidden from doing, the persons and platforms it binds, and the date for the return hearing. It is served on the wrongdoer as soon as they are identified, and on any platform that is required to hold material under it.

The return date is the second hearing, usually within a week or two of the original order. The other side is present this time and can argue for the order to be varied or discharged. Where the order continues, the matter then runs on to identification, disclosure, and a final resolution.

What a cross-border case costs and what to expect

Every matter starts with an initial consultation with a solicitor, so you know where you stand before committing to anything further. On that call we tell you whether an injunction is realistic, which of the cross-border routes your case is likely to need, and what it should cost. A case settled with a single firm approach to an identified blackmailer costs far less than one needing an emergency injunction, a Norwich Pharmacal order and a § 1782 application in the US, so the answer to "what will it cost" depends on what the case turns out to need. We set out how we charge below.

As for outcomes, the realistic shape of a resolution is usually this: the material is contained and not published, your name is kept out of the public record, the blackmailer is identified, and once served with a court order the threats stop. We are also straight with you about risk. No solicitor can guarantee that a determined, anonymous, overseas blackmailer will be identified or caught, and the cross-border routes add time and cost that a purely domestic case would not carry. We would rather say so on the first call than after you have committed to a route that cannot reach the person doing this to you.

A cross-border matter we handled

One matter shows how the pieces fit together. Our client, a married US businessman who visited the UK for work, met a woman through a dating site. After their messages turned explicit, a payment he made exposed his identity, and the demands began. Over ten months she extracted around £125,000, backed by threats to tell his family, while he told no one and, in his distress, deleted much of the evidence.

We recovered enough of the emails and payment records to prove the blackmail, established the blackmailer's true name and address, and then applied for an emergency injunction. We first had our client anonymised so his name never appeared on the court file, and the injunction was granted without notice and served on the blackmailer in person, which brought the matter to an abrupt end. The full account is on our XLD v KZL blackmail injunction case study. His own reflection was that he wished he had come to us sooner. We have also acted for US clients in other cross-border internet matters, including identifying an anonymous UK online critic for a US client and defending US brands in UK and European disputes, which shows the same cross-border approach applied across different kinds of case.

Frequently asked questions

What happens if the platform disclosure produces only a fragment, not a full identity?

This is common, and the in-house OSINT work is what bridges the gap. A Norwich Pharmacal disclosure might produce an IP address that is shared, an email registered under an alias, or a payment trail to an offshore account. Our investigators take that fragment and work outwards through licensed databases, archived account footprints and pattern-matching across platforms. In most cases the fragment is enough to reach an identity once the OSINT work is layered on, although it is not guaranteed against a sophisticated overseas operator.

How quickly can the threat be stopped?

An emergency injunction can often be obtained within a day or two, and in genuinely urgent cases the same day, including at weekends, when the court will hear an out-of-hours application. The injunction holds the position while the identification and disclosure work is done, so the threat is contained from the start.

Do I have to travel to the UK or be named in court?

No. You do not need to be present, and in most cases you do not need to be identified either. We can bring the entire application on your behalf, under a pseudonym, with a court order anonymising you, so the matter is handled remotely and only the judge and your legal team ever know your real identity.

What is a cross-undertaking in damages, and does it apply to me?

It is the promise the client gives when applying for a without-notice injunction, that they will compensate the other side for any loss the injunction causes them if it turns out, later, that the order should not have been granted. In a blackmail or extortion case the realistic exposure is small, because a blackmailer cannot show any legitimate loss from being prevented from blackmailing someone. The undertaking is a formal requirement, and we explain what it means in your specific case before it is given.

What happens if the wrongdoer ignores the order once it is served?

The first answer is contempt of court, which is a separate breach the wrongdoer can be brought before the court on, and which can carry a fine, an order for costs against them, or in serious cases imprisonment. The second answer is that the order can be reinforced. We can apply to add provisions to it, extend it to additional platforms, or seek the wrongdoer's committal where the breach is clear. In practice, an order that has been served and made enforceable is rarely tested by a wrongdoer who has now been named.

What does a cross-border case cost, and how does that scale with each route?

It depends on what the case needs. A matter resolved with a single firm approach to an identified blackmailer costs far less than one needing an emergency injunction, a Norwich Pharmacal order and a § 1782 application in the US. Each route added carries its own preparation and court time, and we give you a costs range you can plan against on the first call, before any commitment is made.