Criminals in the UK are increasingly hijacking email and social media accounts to carry out scams, with reported losses rising to £6.3 million in 2025-26. Authorities warn the true scale may be higher, urging adoption of passkeys to improve security.
Criminals are stealing far more money by taking over people’s email and social media accounts and then posing as them, with official UK figures showing a surge in reported losses over the past year. According to the City of London Police’s Report Fraud service, the amount recorded in the 2025-26 financial year climbed to £6.3m, up from £1.2m a year earlier. The rise highlights how account compromise has become a gateway not only to online intrusion, but to fraud carried out through trusted personal networks.
One common tactic is to use a hacked profile to advertise non-existent tickets, often for sold-out concerts, to friends and relatives who believe they are dealing with the real account holder. The Guardian has previously reported on victims whose social media accounts were used to push fake Oasis tickets, with money taken from contacts who thought they were helping a friend. Other scams rely on urgent messages sent through WhatsApp or text, in which criminals pretend to be a child or relative in trouble and ask for cash immediately. Santander has said that, among its customers, imposters claiming to be someone’s son have been particularly effective, followed by those claiming to be a daughter.
The police say the true scale of the problem is likely higher than the official total because many victims never report it. Some feel embarrassed, while others decide the sums lost are too small to pursue. Amanda Wolf, who heads Report Fraud operations, said account takeover is rarely just a technical issue. In comments reported by the service, she said it can leave victims locked out of important accounts, uncertain what information has been accessed and worried that criminals may exploit their identity to target other people. She added that a single compromised account can quickly spread harm to family, friends and colleagues.
Report Fraud is now backing an awareness drive that urges people to switch to passkeys where those are available. A passkey uses a person’s device and biometric checks, rather than a password, to verify identity. The service, which was launched nationally earlier this year, is intended to give victims and businesses in England, Wales and Northern Ireland a single route for reporting cyber crime and fraud, while also improving intelligence for law enforcement.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
