On 10 August 2026 the FBI and the NCAA announced a joint programme on the sexual exploitation of student-athletes. It is an education and referral partnership rather than an investigative one: athletes and athletic department staff are to be taught how the offence works, given routes to report it, and connected to support. The FBI’s Cyber Division framed the exposure in terms of visibility, noting that student-athletes maintain large public-facing social media followings, in many cases expanded further by name, image and likeness activity.
The scale behind the announcement is in the FBI’s own reporting. Its Internet Crime Complaint Center received more than 75,000 sextortion-related submissions during 2025, of which more than 5,700 were referred to the National Center for Missing and Exploited Children as involving minors. An earlier national alert covering October 2021 to March 2023 recorded over 13,000 reports of financially motivated sextortion of minors and at least 12,600 victims, most of them boys.
The offence is measured in hours, not weeks
What makes this category different from most online harm is the speed. In reporting on the FBI’s warning to young athletes, ESPN documented cases in which every known victim who died by suicide did so within twenty four hours of the offender’s first contact, and most within hours. Braden Markus, a fifteen year old football player, died twenty seven minutes after first contact. Jordan DeMay received the first message at 10.19pm and was dead by approximately 3.45am, around five hours later. The men responsible in the DeMay case, Samuel and Samson Ogoshi, were each sentenced to seventeen and a half years in September 2024.
Australian data describes the same compressed window. The Australian Institute of Criminology surveyed 1,953 Australians aged 16 to 18 in mid-2024 and found that among those who had been sexually extorted, 45.9% were threatened less than a day after first contact and 58.6% within a week. Half of those who met the offender online were asked to move the conversation to another platform, most often Snapchat, Instagram or WhatsApp.
The FBI has also described a shift in who is targeted, from predominantly female victims toward males aged fourteen to seventeen, with athletes attractive precisely because a public profile and a college pathway give an offender leverage. The Bureau’s child exploitation unit put it plainly in that reporting: school athletes have a larger online footprint, and they have more to lose.
Every documented case begins in private
Read the case reporting and a consistent structure appears. The offender builds a plausible profile, often using stolen photographs, follows the target and their friends so the account looks legitimate, opens with something unremarkable, establishes rapport, and moves to a request for an image. The moment an image arrives, the approach turns to extortion. Instagram is the platform named most often in the reporting.
None of that sequence happens in public. It happens in a direct message, between two accounts, in a conversation nobody else is party to. It is not a post that can be flagged, a comment that can be hidden, or a hashtag that can be tracked. By the time anything about it is visible externally, the harm has already occurred.
The measurement problem the sector has documented itself
The sport sector has invested seriously in monitoring online abuse, and the published work is careful about what it covers.
World Athletics published a four-year longitudinal analysis in December 2024 spanning Tokyo, Oregon, Budapest and Paris, examining more than 1.4 million posts and comments across 2,438 athletes. It is the most substantial dataset of its kind. It also states its own boundary explicitly: the study "excluded direct messaging or non-targeted abuse conversation; where the athletes were mentioned but not directly tagged, suggesting the issue is even greater than the study highlights".
The International Olympic Committee published its Online Abuse and Sport report on 7 August 2026, drawing on the AI monitoring it ran at Paris 2024 and Milano Cortina 2026. Across both Games it analysed some 4.3 million posts and comments and verified around 25,000 abusive messages. Its Paris figures were 10,200 verified abusive messages from roughly 20,000 monitored accounts; at Milano Cortina, 14,500 from just over 6,000 accounts. On the IOC’s own numbers that is a rise of about 42% in verified abuse against roughly a third as many monitored accounts. Every public description of that service refers to posts and comments.
This is not a criticism of either body. Both are measuring a real harm rigorously, and World Athletics deserves credit for stating the limitation of its own dataset rather than leaving a reader to infer it. The point is narrower and more uncomfortable. The surface the FBI and the NCAA have just prioritised is the one the sector’s measurement infrastructure was never built to see.
What sits alongside it
Direct messages are not only a sextortion vector. The NCAA published research in November 2025 finding that 36% of Division I men’s basketball players had received betting-related abuse on social media in the previous year, and that in a survey of 7,493 Division I athletes, 48% reported facing online abuse of some kind. Where a betting market exists there is a motivated, identifiable counterparty, and a private channel to reach the athlete through.
The pattern holds across the categories. Public abuse is loud, measurable and increasingly well covered. Private abuse is targeted, escalates quickly, and is where the conduct that ends careers and lives actually takes place.
What detection in the private layer requires
Guardii was built for this surface. Three properties matter, and they are properties of the architecture rather than the feature list.
Detection happens before the athlete reads the message. Abusive or predatory inbound content is identified and suppressed at the point of arrival, so protection does not depend on the target absorbing the abuse first. In an offence that can conclude within twenty seven minutes, an approach that begins after the athlete has read, understood and chosen to report is not operating on the relevant timescale.
Reporting does not require re-exposure. Where a person must re-read what was sent in order to escalate it, the reporting rate reflects what victims can bear rather than what happened. The record is assembled from the incident log, at a time of the athlete’s choosing.
The record is built to survive challenge. Content is committed in a form that establishes what was sent, when, and by whom, without requiring anyone to read it in order to hold it. That is a stronger privacy position and a stronger evidentiary position at once, and for a governing body facing a duty of care question it is the difference between an allegation and a record.
The FBI and the NCAA have told the sport sector where this harm lives. It lives in the inbox.