The amount of money reported as stolen through compromised email and social media accounts in the UK jumped to £6.3 million during the 2025‑26 financial year, a rise of more than 400 % compared with the £1.2 million recorded in the previous period, according to the City of London police’s Report Fraud service.
Scale of the Surge
Official figures show a steep increase in losses linked to account hijacking, with the total reported by victims climbing from £1.2 million in 2024‑25 to £6.3 million in 2025‑26. Authorities caution that the true scale is likely higher, as many incidents go unreported owing to embarrassment or because the individual sums involved appear modest.
How the Scams Operate
Criminals frequently gain control of a person’s Instagram, WhatsApp or other social profiles and then impersonate that individual to deceive friends and family. A common tactic involves advertising fake tickets to sold‑out events – such as the Oasis gig highlighted in a Guardian case where a music fan’s compromised account was used to extract £1,400 from her contacts. Another prevalent scheme, dubbed the “Hi mum” scam, sees fraudsters pose as a child or relative in an urgent situation, demanding immediate cash transfers via text or messaging apps. Santander’s internal data indicates that, among its customers, pretenders posing as sons were the most successful at extracting funds, followed by those masquerading as daughters.
Police Guidance and New Protections
Chief Superintendent Amanda Wolf, who heads the Report Fraud unit, stressed that account compromise is not merely a technical issue but a deeply personal violation that can leave victims anxious about data exposure and fearful that their identity will be used to target others. She warned that a single breached account can quickly ripple out to affect family, friends and colleagues as fraudsters exploit trust to commit further offences. In response, Report Fraud is launching an awareness campaign urging the public to adopt passkeys where available – a device‑based, biometric authentication method that resists the typical password‑theft techniques used by hackers.
Why it Matters
The sharp rise in losses underscores how cybercriminals are increasingly weaponising personal relationships to siphon money, turning trusted online connections into conduits for fraud. As more victims suffer not only financial harm but also emotional distress from having their identity misused, the need for stronger authentication habits and swift reporting becomes critical. Without broader uptake of secure login practices and greater public vigilance, the upward trend in account‑based scams is likely to continue, putting both individuals and their wider social circles at risk.
