- Reported losses from account hacking rose from £1.2m to £6.3m.
- Account takeovers made up 69 per cent of reported cybercrime cases.
- Report Fraud is urging people to use passkeys to secure their accounts.
Criminals stole £6.3 million from people after hacking their email and social media accounts in the 2025-26 financial year, more than five times the amount reported a year earlier, according to new figures from Report Fraud.
The losses rose from £1.2m in 2024-25, representing an increase of more than 400 per cent. Report Fraud, the national service run by the City of London Police, said account hacking was also behind 44,355 cybercrime reports during the year, accounting for 69 per cent of all such reports.
The figures are based on crimes reported to authorities, meaning the true scale is likely to be considerably higher. Some victims do not report scams because they are embarrassed, while others may not consider it worthwhile when relatively small amounts of money have been lost.
The growing problem is not simply about criminals stealing access to an account. Increasingly, they are stealing the trust attached to it.
When your own account becomes the scam
One common tactic is to take control of someone's social media account and then use their identity to approach friends and relatives.
Fraudsters can advertise fake tickets for sold-out concerts or other events, making the offer appear to come from someone the victim knows. In one case highlighted by the Guardian, hackers took over an Instagram account and used it to sell fake Oasis tickets, resulting in £1,400 being stolen from the victim's friends.
The impersonation can be convincing because the criminal is operating from a genuine account and may already have access to the victim's photographs, contacts and conversations.
A similar tactic is behind the so-called “Hi mum” scam, in which criminals send WhatsApp or text messages pretending to be someone's child or another relative who urgently needs money.
The scam relies on emotion rather than sophisticated technology. A message appearing to come from a son or daughter can be enough to make someone act quickly without checking who is really on the other end.
Ch Supt Amanda Wolf, head of Report Fraud operations, said: “For most people, being hacked isn’t just a cyber issue – it’s personal.”
She warned that victims can be locked out of important accounts and left concerned about what information has been accessed and whether criminals will use their identity to target others.
“What starts with one compromised account can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud,” she said.
The risk is part of a broader cybercrime problem facing the UK. The government’s Cyber Security Breaches Survey for 2025-26 found that 43 per cent of businesses had experienced a cyber breach or attack during the previous 12 months. Among businesses that had experienced breaches, takeovers or attempted takeovers of websites, social media accounts or email accounts were reported by 5 per cent.
Why passkeys are being pushed
Report Fraud is now urging people to strengthen their accounts by switching to passkeys where they are available.
Unlike a traditional password, a passkey uses a device and biometric authentication, such as a fingerprint or facial recognition, to verify the user. The credentials are designed to resist common attacks such as phishing because there is no password for criminals to steal or trick people into revealing.
The advice comes as criminals continue to look for ways to exploit the growing amount of personal information held online.
Andrew Bud, founder and chief executive of iProov, said social media had become “one of the most potent” channels for impersonation fraud.
He said criminals could either create an account pretending to be someone trusted or attempt to take over a genuine account by exploiting password-reset processes.
Strong identity and biometric verification could help prevent both types of impersonation, Bud said.
For users, the immediate lesson is less complicated: securing an account is no longer just about protecting your own money or personal information. If criminals get inside, they can use your identity and your relationships to target the people who trust you most.
And with reported losses from these account takeovers rising from £1.2m to £6.3m in just one year, that trust is becoming increasingly valuable to criminals.
