Hacked accounts used to scam friends and family: losses rise to £6.3m

What's happened

Criminals who break into email and social media accounts are using them to con the account owner's friends and family. Report Fraud, the national fraud reporting service run by City of London Police, said on 5 October that reported losses from email and social media hacking reached £6.3 million in 2025-26, up from £1.2 million the year before. That's a rise of 417%, and the number of reports rose by 34%.

The police say much of the increase reflects better recording through the new Report Fraud service, rather than a true surge in attacks. The real figure is likely to be higher, because many victims don't report it.

In one case, criminals took over a music fan's Instagram account and used it to sell Oasis tickets. Her friends sent £1,400, thinking they were dealing with her. "For most people, being hacked isn't just a cyber issue – it's personal," said Chief Superintendent Amanda Wolf, head of Report Fraud operations.

A related scam is doing the rounds by text. On 13 October Which? warned about a "Hi mum" message from someone pretending to be an adult child, asking you to contact them on a new number because of an emergency. One version says they're "very upset right now", gives a WhatsApp number and, eventually, asks for money.

The warning signs

• A friend selling tickets or goods on their social media, and asking for a bank transfer.
• An urgent request for money from a familiar account, or from a "new number" that says it's your son or daughter. Santander found fraudsters posing as a son were the most successful, followed by those posing as a daughter.
• A request to read out or forward a code sent to your phone. Which? says sharing a code like this can hand a scammer access to your account.

What it could cost: a worked example

This is an illustration, not a real case. Priya sees a post on her friend Kate's Instagram: two concert tickets she can no longer use, £180 each. Priya messages Kate's account, gets a friendly reply and sends £360 by bank transfer to the account details she's given. The tickets never arrive, and Kate later posts that she was hacked.

Because Priya paid by bank transfer, she can ask her bank for a refund under the reimbursement rules that began on 7 October 2024. Her bank should normally pay her back within five business days, but it can keep an excess of up to £100, so she could get as little as £260 back. The Payment Systems Regulator says banks can refuse if a customer was "grossly negligent", but that's a high bar.

A quick phone call to Kate on the number Priya already had would have stopped it.

What to do now

1. Check before you pay. If a friend or relative asks for money or sells you something online, call them on a number you already have, or ask them in person.
2. Lock down your own accounts. Report Fraud says switch to passkeys where they're offered, and otherwise use strong passwords and turn on two-step verification, starting with your email.
3. Share less. Report Fraud says birthdays, locations, family relationships and pet names "can potentially help criminals".
4. If you've been hacked, follow the National Cyber Security Centre's recovery steps: contact the provider, change your passwords, log out other devices, and tell your contacts to be wary of recent messages from you.
5. If you've paid, call your bank straight away on the number on your card, or call 159.
6. Report it to Report Fraud online or on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101. Forward scam texts to 7726.

Your questions answered

What's a passkey?

It's a way of logging in that uses your device and your fingerprint or face instead of a password. Report Fraud says passkeys are much harder to hijack than passwords, and the National Cyber Security Centre recommends them.

Will I get my money back?

If you paid by bank transfer on or after 7 October 2024, you can claim within 13 months, for up to £85,000. If your bank refuses, complain, then go to the Financial Ombudsman.

Should I report a hacked account if I didn't lose money?

Yes. Report Fraud says that if you think your account has been hacked, you should report it, then follow the National Cyber Security Centre's guidance on getting back in. The police say many victims never report, so the true scale is likely to be higher than the figures show.

Ways to save

A password manager makes it easier to use a different strong password for every account. If you're choosing one, check NordPass for current offers, and Kaspersky if you also want security software.

Sources: IBTimes UK: account hacking losses rise, The Record: UK account-hack losses surge, Which?: latest scam alerts, NCSC: recovering a hacked account, Payment Systems Regulator, Report Fraud