An email lists my password and claims it recorded me. Is that real?

1. Do not reply, send money, or open attachments. A known password or address does not prove a recording exists.
2. Change the exposed password anywhere it still works and enable two-step sign-in.
3. Save the threat, then report it as phishing. In the US, report extortion at IC3.gov.

Get help if

There is actual evidence of account access, real intimate material, or a specific threat to your physical safety.