Sums reported stolen from email and social media account hacking in the 2025-’26 financial year rose to £6.3 million, up from £1.2 million in 2024-’25, an increase of 417%. So says Report Fraud, formerly known as Action Fraud, the UK’s national reporting center for fraud and cybercrime.
Reported incidents in the UK were up by 34% from the previous year. Other types of hacking were also identified, including gaming and streaming account takeovers, as well as the compromise of travel and online delivery accounts.
As part of Cybersecurity Awareness Month, Report Fraud launched an awareness campaign, urging the public to protect their online accounts from hackers by switching to passkeys and securing accounts.
Hacking, in the context of online accounts, refers to criminals gaining unauthorised access someone’s email, social media, or other online account to commit further fraudulent activity such as impersonating the account owner to defraud family and friends by asking for money or offering fake tickets.
One of the most common themes identified from reports is compromised accounts being used to impersonate family members and friends.
PIPCU recommended best-practices
The Police Intellectual Property Crime Unit (PIPCU) of the City of London Police advises the use of passkeys wherever they are available. They are more secure and easier to use. Where passkeys are unavailable, use strong passwords, for example generated by a password manager. You should also enable 2 Step-Verification if you can.
Who has access to the content you’re posting? Make sure your privacy settings are configured so that it’s only visible to the people you want to see it, for example only your friends.
Beware of sharing personal details online: try not to share too many personal details that a fraudster could use to build a picture of you. They can use facts, such as your birthday, where you live, family relationships or pet names to steal your identity or make their fraud more convincing.
If you are contacted by someone you know via social media or email: don’t automatically trust that person is who you think they are. Contact them through another route, such as in person, by sending an SMS or phoning them.
Why it matters
“What starts with one compromised account can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud,” said Amanda WolfChief Superintendent and Head of Report Fraud Operations. “Switching to passkeys and enabling two-step verification adds a strong extra layer of security and makes it much harder for criminals to gain access to your accounts.”
Jonathon Ellison, Director for National Resilience at the National Cyber Security Centre (NCSC) added that “Passkeys are simpler, faster and more secure to use, raising our national resilience against phishing attacks whilst leaving password headaches behind.”
Further reading
Switch to passkeys: Report Fraud warning as email and social media account hacking sums stolen rise by more than 400 per cent. Press release. October 5, 2026. Police Intellectual Property Crime Unit (PIPCU) of the City of London Police
