Stolen sums from email and social media account hacking surged by 417% in the last year, with thieves stealing £6.3million, according to new figures. Police have also recorded a 34% surge in the number of people falling victim to email hacking, which remains the most reported cybercrime in the UK.
Reported stolen sums from email and social media account hacking rose to £6.3 million in the 2025/26 financial year, up from £1.2 million in 2024/25, it has been revealed.
Campaign urges public to switch to passkeys
As part of Cybersecurity Awareness Month, Report Fraud has launched an awareness campaign urging the public to protect their online accounts from hackers by switching to passkeys and securing their accounts.
Hacking, in the context of online accounts, refers to criminals gaining unauthorised access to someone’s email, social media, or other accounts to commit further fraud, such as impersonating the account owner to defraud family and friends by requesting money or offering fake tickets.
One of the most common themes identified from reports is compromised accounts being used to impersonate family members and friends.
Advice for protecting accounts
Chief Supt Amanda Wolf, Head of Report Fraud Operations, said: "For most people, being hacked isn't just a cyber issue, it's personal. It can leave victims locked out of important accounts, worried about what information has been accessed, and concerned that criminals may use their identity to target others."
She added: "What starts with one compromised account can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud. The good news is that there are simple steps people can take to protect themselves. Switching to passkeys and enabling two-step verification adds a strong extra layer of security and makes it much harder for criminals to gain access to your accounts."
Report Fraud advises using passkeys wherever they are available, as they are more secure and easier to use. Where passkeys are unavailable, strong passwords generated by a password manager are recommended, along with enabling 2-Step Verification where possible.
Users are also urged to check privacy settings to ensure content is only visible to intended audiences, and to avoid sharing personal details online that fraudsters could use to build a picture of them. If contacted by someone known via social media or email, people should not automatically trust the identity and should contact the person through another route, such as in person, by SMS, or by phone.
Support from tech and security leaders
Jonathon Ellison, Director for National Resilience at the National Cyber Security Centre (NCSC), said: "We know that most cyber harm to individuals starts with criminals attempting to steal login details, which is why we strongly encourage users to choose passkeys where they are available across digital services and use two-step verification where they aren't. Passkeys are simpler, faster and more secure to use, raising our national resilience against phishing attacks whilst leaving password headaches behind."
Maureen Costello, Vice President, UKI and SSA - Google Cloud, said: "For over two decades, Google has been dedicated to protecting people from online scams and fraud. Beyond technical protections, empowering users to spot risks and secure their accounts is essential to online safety. We strongly support the UK authorities’ campaign and look forward to partnering across the industry to keep citizens safe online."
Nathaniel Gleicher, Global Head of Counter Fraud and Director of Security Policy at Meta, said: "Scammers are relentless, and they often hack people's accounts to run their scams. That's why we're constantly rolling out new protections to keep people safe and to shut out threat actors. Passkeys are resistant to guessing or theft by criminals, or exploit via malicious websites or scam links. This makes them a powerful defence against common account takeover tactics."
Dr Elisabeth Carter, Criminologist and Forensic Linguist at Kingston University, said: "The financial and psychological impacts of social media and email hacking ripple well beyond the initial harm. When victims have their identity stolen through hacking, it can then be used as the very tool that criminals need to target, gain trust and then harm that person’s friends, family and trusted contacts. This increases the financial harm, exposes many others to identity theft and compounds the psychological harm to the original victim beyond the initial hack, knowing that it was their identity that convinced their contacts to respond."
For anyone who has been hacked, Report Fraud can be contacted at reportfraud.police.uk or by calling 0300 123 2040. In Scotland, cybercrime is reported to Police Scotland directly on 101. The NCSC has published guidance on minimising damage and regaining access to accounts.
