TL;DR: On 5 October 2026, City of London Police and Report Fraud said sums stolen through email and social media account hacking reached £6.3 million in 2025/26, up from £1.2 million, a 417% rise. Reports increased 34%, making it the most reported form of cybercrime in the UK.
What the figures show
In its Cybersecurity Awareness Month warning, City of London Police reported the sharp rise. A recurring pattern is that criminals take over an account, impersonate its owner and trick family and friends into sending money or buying fake tickets. One compromised account can quickly affect relatives and colleagues, said Chief Superintendent Amanda Wolf, Head of Report Fraud Operations.
Red flags
- A friend messages unexpectedly asking for money or a quick favour.
- Someone is selling tickets through a contact's profile at an odd price.
- You are locked out, or receive login codes you did not request.
What police recommend
- Switch to passkeys where they are available.
- Use a password manager and turn on two-step verification.
- Review social media privacy settings and avoid oversharing personal details.
- Verify unusual requests from contacts by phone, text or in person.
If an account has been taken over, follow the NCSC guidance on recovering a hacked account guide. Our pages on grandparent scams versus digital arrest and how to protect elderly parents from phone scams show how impersonation of loved ones is used against older relatives, and what to do after a scam, wherever you live covers recovery steps.
Why a hacked account spreads
The police warning stresses that the damage rarely stops with one person. Once criminals control an email or social media account, they can contact the owner's family, friends and colleagues as someone they already trust, and the requests often sound ordinary: a loan until payday, or tickets for an event. Because the message comes from a real account, the usual doubts fall away. That is why police advise confirming requests by phone, text or in person, and why strong protection on your own accounts also protects the people who know you. Police also advise reviewing social media privacy settings and avoiding oversharing personal details, since the more criminals can learn about you, the more convincing their messages to your contacts become. Tell your contacts quickly if your account has been taken over, so they know to ignore any requests.
Where to report
Report to Report Fraud (Action Fraud) at reportfraud.police.uk or 0300 123 2040 (Police Scotland: 101).
Frequently Asked Questions
How much did losses rise?
From £1.2 million to £6.3 million in 2025/26, a 417% increase, with reports up 34%.
How do criminals profit from a hacked account?
They impersonate the owner to persuade family and friends to send money or buy fake tickets.
What do police advise?
Use passkeys where available, a password manager and two-step verification, check privacy settings, and verify odd requests from contacts through another channel.
What if my account is hacked?
Follow the NCSC's recovery guidance and report it to Report Fraud.
Sources
- City of London Police: Switch to passkeys, Report Fraud warning as account hacking sums stolen rise by more than 400 per cent (Oct 5, 2026)
- NCSC: Recovering a hacked account
- Report Fraud (Action Fraud)
Related Reading
- £101 Million Stolen Through Payment Diversion Fraud as Police Warn Businesses and Public
- Courier Fraud Explained: How Fake Bank 'Investigators' Get Victims to Hand Over Cards and Buy Phones
- Why Politeness Is a Scammer's Best Friend: 53% of Brits Stay on Unwanted Calls Too Long
- UK Scam News: October 2026 Roundup and Warnings
- What to do after a scam, wherever you live