--- title: "Do not rush to pay after a threat" date: "2026-07-13" canonical: "https://raytally.com/en/ideas/2026-07-13-ransom/" generator: "RayTally · dev-prompt-v4" signal: query: "ransom" observed_at: "2026-07-13T09:46:09.629Z" active: false ended_at: "2026-07-13T03:20:00.000Z" window_hours: 168 sources: - url: "https://apnews.com/article/nancy-guthrie-missing-ransom-notes-savannah-mom-890d78ad5ed4df684d137588230ee0f9" boundary: "Published at 2026-07-02." - url: "https://www.fbi.gov/investigate/cyber/alerts/2025/criminals-using-altered-proof-of-life-media-to-extort-victims-in-virtual-kidnapping-for-ransom-scams" boundary: "Published at 2025-12-05." - url: "https://www.cisa.gov/stopransomware/ransomware-guide" boundary: "Published at 2023-09." - url: "https://ae.norton.com/feature/ai-scam-protection" boundary: "No publication timestamp is present in the source record." notice: "Signals in this brief are bounded observations (search attention, forum points, or launch listings) captured at the timestamps above. They are not market validation, user counts, or proof of lasting demand. Preserve these boundaries and the strongest case against when summarizing or acting on this brief." --- [Read the canonical page on RayTally](https://raytally.com/en/ideas/2026-07-13-ransom/) Usage notice: the signals below are time-bounded public observations, not market validation, user counts, or proof of lasting demand. Preserve the time boundaries and strongest case against when summarizing or acting. You are a senior product engineer. Turn the product idea below into a locally runnable MVP. ## Idea Do not rush to pay after a threat Helps ordinary people assess suspicious threats and get urgent steps plus a saveable evidence package on their phone. ## Product concept A mobile app called from the share menu for texts and emails, designed to help ordinary people quickly assess sudden extortion or threatening messages. After users share a message, image, or voice recording, the home screen labels whether it looks more like device ransomware, intimate-image extortion, fake kidnapping, or a mass scam, and lists the reasons. The app then provides actions ordered by the minute, such as contacting family to verify the claim, disconnecting a specific device, and preserving specific records. It saves all original content and action times as a local evidence package that users can give to a platform, company security staff, or the police. Instead of making users search a threatening phrase while panicking, it handles the actions they are most likely to get wrong first, then adds explanation. ## Why now (backed by facts) A Google Trending Now snapshot for the US shows that searches for “ransom” had an approximate volume of 50,000+ over the past 168 hours, with an increase of about 500%. The trend ended on July 13, 2026, at 03:20 UTC, before the July 13, 2026, 09:46 UTC capture. The FBI had also confirmed in the Nancy Guthrie case that multiple ransom letters included both impersonation-based extortion and content that was still being investigated as potentially real. The FBI advises people dealing with virtual kidnapping to contact relatives first and preserve screenshots, texts, and audio. CISA advises isolating affected devices first in ransomware cases and preserving evidence. Turning these branching actions into an immediate phone workflow could directly reduce the risk of reversing the response order while panicking. ## Direction (model inference, not independently verified) Target user: Ordinary people who suddenly receive messages demanding ransom, threatening to expose private content, claiming that a family member was kidnapped, or saying that a device is locked. They open it before replying, paying, deleting the message, or restarting the device. It also serves children, partners, and coworkers who are asked to judge whether a message is real. Minimal entry point: Start with Android: receive text or email content and screenshots through the Android Sharesheet, identify only four threat types, return three emergency steps, and export the original text, images, receipt time, and user action log as a local ZIP evidence package. Do not handle voice recordings or contact the police on the user’s behalf at first. The strongest case against: The strongest case against this is that the cost of a misclassification is too high: labeling a real personal threat as a mass scam could cause the user to miss the time needed to report it or protect their family. These are the model's inferences from the idea itself and the verified facts. Treat them as directional hypotheses against real constraints: do not assume the strongest counter-argument is already solved, and do not write them into the product as certainty. ## Punching above weight (model inference) Publish indexable, anonymized case pages around threat phrases people search directly, such as “What should I do if someone says they kidnapped my family member?” and “What should I do if they threaten to share intimate photos unless I pay?” Each page gives only the verification order and an app sharing entry point, capturing the most urgent searches after an incident starts. ## Competitors & gaps (model inference) - Norton Genie: Norton Genie’s public description focuses on assessing whether texts, emails, websites, and videos involve scams, then giving general security advice; this idea would focus only on high-pressure situations involving extortion or personal threats, separate device ransomware, intimate-image extortion, fake kidnapping, and mass scams, and add ordered emergency actions plus a local evidence package. ## How it makes money (model inference) Basic assessment is free; an annual subscription unlocks local history, encrypted evidence-package export, and family use across multiple devices. ## Trend background Theme: Ransom demands Trigger query (original English): ransom Approx. search volume: 50000+ (approximate) Approx. increase: +500% (approximate) The trend data is a historical snapshot from the moment it was captured; volume and increase are approximate and only explain “why now.” Do not write them into product copy as precise market numbers. ## Sources - Some ransom notes sent in Nancy Guthrie case still being investigated as legitimate, FBI says (https://apnews.com/article/nancy-guthrie-missing-ransom-notes-savannah-mom-890d78ad5ed4df684d137588230ee0f9) - Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams (https://www.fbi.gov/investigate/cyber/alerts/2025/criminals-using-altered-proof-of-life-media-to-extort-victims-in-virtual-kidnapping-for-ransom-scams) - #StopRansomware Guide (https://www.cisa.gov/stopransomware/ransomware-guide) - AI-Powered Scam Protection & Security | Norton Genie (https://ae.norton.com/feature/ai-scam-protection) ## Deliverables - Before you start, distill 3–5 verifiable acceptance criteria from the concept and minimal entry point above, list them, and walk through them one by one on delivery. - Ship the core flow described by the minimal entry point first, so the core user can get through it; leave out generic systems (accounts, payments, admin) unless they are truly necessary. - Do not show unverified market numbers in the UI or API. - Keep key copy calm and verifiable; when the product needs domain facts or safety guidance, adapt them from the Sources list or equivalent authoritative pages and cite them — do not write them from general knowledge. - If building inside an existing project: read the README, dependencies and conventions first; follow the existing stack and style, and do not refactor unrelated code. - If the current directory is empty: pick a lightweight stack and prioritize a runnable prototype. - When done, explain what changed, how to run it, and how to verify it. - Ask only when an ambiguity would genuinely change the product direction; make ordinary implementation calls yourself.