In short: for an adult gay, bisexual or questioning man who isn't out, account security isn't a geek topic. It's the lock that separates a private life from an outing. A password reused on a forum that was breached in 2019, a session left open on a flatmate's computer, a phone number still attached to an old account, an inbox with no second factor: these are the four doors almost every intrusion goes through. Once the inbox is compromised, everything else falls, because that's what lets anyone reset the other passwords. This guide sets out the real routes an intrusion takes, the settings that hold up in real life, and what to do — in France and Belgium — when the account is already lost.
This article describes personal security practices, public schemes and the general legal framework. It does not constitute personalised legal advice. In France: the public platform Cybermalveillance.gouv.fr (diagnosis and referral); 17 Cyber for online guidance; the Interior Ministry's PHAROS platform for illegal content; the SOS homophobie helpline on 01 48 06 42 41; the CNIL (French data protection authority) for personal data; emergency numbers 17 or 112, text messages to 114. In Belgium: Safeonweb (Centre for Cybersecurity Belgium), reports to suspect@safeonweb.be, Unia on 0800 12 800, Lumi on 0800 99 533. Everyone referred to here is an adult.
Why a hacked account costs more when you're not out
When the mainstream press covers account hacking, it talks about money: bank cards, fraudulent purchases, ransom. For a man who uses man-to-man video chat without having told his family, his partner or his employer, the loss isn't financial. It's informational.
An open inbox means:
- a history of sign-ups (LGBTQ+ organisations' newsletters, account confirmations, VPN invoices);
- the ability to reset the passwords of almost every other service, since the reset link lands there;
- old attachments you'd forgotten about;
- and, often, a complete contact list — in other words, the exact list of people a blackmailer can write to.
It's that last point that turns a technical incident into a risk of being outed. The classic scenario isn't "we've taken your account", it's "we've taken your account and we're writing to you from your own address to tell you what we plan to do with it".
Let's recall the law, because it's on your side. Sexual orientation is sensitive data within the meaning of Article 9 of the GDPR: disclosing it without consent isn't an indiscretion, it's unlawful processing of a special category of data. Blackmail is punishable under Article 312-10 of the French Criminal Code (five years' imprisonment and a €75,000 fine), and fraudulent access to an automated data processing system under Article 323-1 (three years and €100,000). In Belgium, Article 550bis of the Criminal Code penalises hacking. None of these provisions requires you to be out in order to be protected.
The four real points of entry
1. The reused password
This is by far the number one cause. You created an account on some website eight years ago with the email address you still use and a password you reckoned was "strong enough". That site was breached, the database circulated, and your address + password pair now sits in a file being resold. Attackers have nothing to break: they simply try the combination elsewhere. This is what's known as credential stuffing.
The useful reflex: go and check. Have I Been Pwned, run by researcher Troy Hunt, lets you find out which known breaches an address appears in. Firefox Monitor and modern password managers run the same check continuously.
2. The session left open
A browser on the family computer, a shared tablet, a workstation at the office, a device lent out for an evening. The session no longer asks for a password: you just open the tab. No technical skill required, and that's precisely what makes it so common in the situations described in our guide to still living with your parents or to student flat-sharing.
3. Targeted phishing
An email that mimics your email provider, your bank, a platform. The fake emails of 2026 are polished: correct logo, flawless wording, a domain name that's almost right. The only reliable safeguard is to never enter a password from a link you've received, but to type the service's address yourself.
4. Physical access to the device
An unlocked phone for fifteen seconds is enough to install a surveillance app or read messages. Both ANSSI (the French national cybersecurity agency) and the CNIL point out that screen locking is the first security measure, well ahead of advanced settings. A laptop security cable makes sense in a shared office; so does a simple six-digit code rather than a four-digit one.
The foundations: three settings that change everything
A password manager, and a single password to remember
The principle is simple: one unique, long password per service, stored encrypted, protected by a single passphrase you memorise. Since 2022 the CNIL has recommended passwords of at least 12 to 15 characters, or the use of a manager precisely so you no longer have to memorise them.
Two points specific to our subject:
- Choose a manager that doesn't give away its contents. Many display a list of sites in plain view as soon as you open them. If someone unlocks your phone, they see the names. Go for a tool that requires biometrics or a code every time it opens, not just on first launch.
- Write your master passphrase down somewhere physical and neutral. A password notebook with a combination lock filed away with your paperwork is less risky than a "passwords.txt" file on your desktop. If you lose that phrase, you lose everything.
Two-factor authentication, but not by text message
Turning on a second factor for your inbox is the highest-return move in this article. It stops a stolen password from being enough on its own. But not all second factors are equal:
| Method | Withstands a stolen password | Withstands phishing | Withstands physical access to the phone |
|---|---|---|---|
| Text message | Yes | No | No |
| Authenticator app (6-digit codes) | Yes | Partly | Depends on the lock screen |
| Physical security key (FIDO2) | Yes | Yes | Yes (the key stays with you) |
Text messages remain vulnerable to SIM swapping: someone obtains a new SIM card for your number and receives your codes. ANSSI and ENISA have for several years recommended favouring authenticator apps or, better still, hardware keys. A FIDO2 security key in USB-C format, kept on your keyring, also blocks phishing: even on a perfectly imitated fake site, the key refuses to authenticate because the domain name doesn't match.
If you go for a key, get two: one on you, one registered as a backup and stored elsewhere. Losing your only key with no printed backup codes is a quick way to lock yourself out.
Recovery addresses, the blind spot
Open the recovery settings of your main inbox and look at what's in there. Very often: an old address you no longer use whose password is weak, or a phone number that's no longer yours. An attacker doesn't go at the wall, they go at the service door. Clean it up: a single recovery address, active, itself protected by a second factor.
Separating identities, properly
Discretion isn't about hiding everything behind one very secure account, it's about compartmentalising. If one door gives way, it mustn't open the whole house.
A realistic compartmentalisation comes down to three levels:
- Your administrative identity: bank, tax office, employer, health, family. An email address in your name, a number everyone knows, a password manager, a second factor.
- Your everyday social identity: shopping, newsletters, assorted sign-ups. Ideally aliases (most providers let you create disposable addresses that forward to your main one).
- Your intimate identity: anything to do with your emotional and sexual life, LGBTQ+ organisations, dating or video chat platforms. A separate address that doesn't contain your name, isn't listed as a recovery option for the first one, and whose password has never been used anywhere else.
The most common trap: using your level 3 address for a delivery, or your level 1 number to sign up to a platform. Reverse phone-number lookup works very well, and it's one of the mechanisms we set out in the article on what gay dating apps and video chat really expose.
For the device itself, an encrypted microSD card or a hardware-encrypted external drive lets you keep off your phone whatever doesn't need to live there permanently. Full-disk encryption is on by default on recent phones; on computers you often have to switch it on yourself (BitLocker, FileVault, LUKS).
The account is already lost: the procedure
Order matters. Every minute spent looking for help is a minute during which the intruder is reading your messages.
1. Take back the inbox first. Not social media, not the platform: email, because it controls everything else. From a device you're sure of, start the recovery process, change the password, then — this is the part almost everyone forgets — go into the security settings and sign out of all active sessions.
2. Check what the intruder left behind. In your email settings, systematically review:
- auto-forwarding rules (a filter quietly copying your mail elsewhere is a blackmailer's favourite tool);
- automatic replies;
- authorised third-party apps;
- recovery addresses and numbers, which have often been changed;
- the login history, which you should save as a screenshot.
3. Change passwords in order of sensitivity, starting with anything that could be used to harm you: social accounts, online photo storage, platforms linked to your intimate life. Then the bank.
4. Document before deleting. The temptation to wipe everything is strong. But with no record, no complaint goes anywhere. We set out the full method in reporting, blocking and preserving evidence: timestamped screenshots showing the full URL, exported messages, storage on a medium only you control. A small hardware-encrypted external hard drive, kept away from the device concerned, does exactly that job.
5. Report it and file a complaint. In France, Cybermalveillance.gouv.fr offers a diagnostic pathway and points you in the right direction; the 17 Cyber service allows a first online contact with law enforcement. Fraudulent access to an account and blackmail are separate offences: mentioning both in your complaint avoids it being downgraded. If personal data has been exposed through a service's fault, the CNIL can be contacted. In Belgium, Safeonweb centralises reports, and Unia handles discrimination based on sexual orientation.
6. Never pay. A blackmailer who gets paid comes back. That's the consistent finding of investigators and support organisations alike. If the threat of being outed is explicit, our guide to homophobic entrapment and blackmail arising from a video chat describes the full sequence, including the option of getting ahead of it with the people who matter to you.
Three habits worth more than ten tools
Run an audit twice a year. Half an hour, a coffee, and a list: which accounts still exist in my name, which of them hold anything sensitive, which have no second factor. Forgotten accounts are the most dangerous, because nobody is watching their alerts.
Lock the screen every single time. Not "when I leave the room": every time the device leaves your hands. It's the most effective and least expensive measure, and it doesn't depend on buying anything. A privacy screen filter usefully rounds things out on a train or in an open-plan office, by making the screen unreadable from an angle.
Decide in advance who you'll call. The worst moment to go looking for a number is just after discovering an intrusion. Keep two or three contacts somewhere outside your phone: someone you trust, the SOS homophobie helpline (01 48 06 42 41) or Lumi in Belgium (0800 99 533), and the Cybermalveillance.gouv.fr address. If the incident takes a psychological toll — and it often does — our article on coping after an online homophobic attack lists the available support services.
Key takeaways
Account security isn't a never-ending discipline. It comes down to a small number of decisions taken once: a password manager, a second factor on your main inbox that isn't a text message, cleaned-up recovery addresses, three compartmentalised identities, and a screen that locks. The rest is maintenance.
And if the intrusion has already happened: the inbox first, then the forwarding filters, evidence before deletion, a complaint before negotiation, and never a single euro paid. This site's safety page recaps the basics, and the video chat glossary defines the technical terms touched on here.
One last thing, which isn't technical at all: a hacked account isn't your fault. Data breaches come from companies that failed to protect their databases, fake emails are crafted by professionals, and the overwhelming majority of victims had done exactly what they'd been told to do. Shame is one of the blackmailer's weapons. Taking that weapon away from him is part of fighting back.
