A new warning has been issued after financial losses were reported through hacked social media and email accounts during the 2025/26 financial year.
Key Figures and Trends
Report Fraud confirmed the total losses in its ‘hacking – social media and email’ category reached a significant amount.
During the same period, a notable increase in reports was recorded, with a rise in the number of cases compared to the previous year.
Most incidents involving financial loss occurred in the second half of the year.
Why the Increase?
Report Fraud suggests the spike may reflect changes to its reporting service, not a true rise in attacks.
The data comes from self-reported cases and does not confirm actual incidents.
There is no breakdown of how much was lost to family or friends, or how many cases involved fake tickets or urgent money requests.
How the Scam Works
Criminals gain access to genuine accounts through phishing or reused passwords.
Once inside, they message contacts—friends, relatives—using the real profile name and picture.
They may ask for urgent money, claim to need help, or offer fake event tickets.
Because the message appears to come from a trusted source, it is harder to spot as a scam.
What to Do Before Paying
- Do not send money immediately.
- Call the person using a known phone number.
- Verify the request directly—ask about tickets or urgent needs.
- Check if the request is normal for that person.
- If it seems urgent or unusual, stop and verify.
- If you can’t confirm independently, do not pay.
Account Security Measures
Report Fraud is promoting the use of passkeys where available.
A passkey uses your phone’s fingerprint, face ID, or PIN to log in—no password to type.
This reduces the risk of passwords being stolen or reused.
If passkeys aren’t available, enable two-step verification (2SV).
2SV adds a second check—like a code or device approval—when logging in.
Even if a criminal has your password, they still need the second step.
What to Do If Your Account Is Hacked
Go directly to the official website or app of the account.
Look for a recovery or support section.
Check your email filters and forwarding rules—some may have been altered without your knowledge.
Look for any shared banking details or links you did not set up.
Where to Report Suspicious Activity
People in England, Wales, and Northern Ireland can report fraud to Report Fraud.
People in Scotland should report to Police Scotland on 101.
Suspicious emails can be sent to report@phishing.gov.uk.
Suspicious texts can be forwarded to 7726—free of charge.
Why This Matters
Even genuine accounts can be used to deceive people.
Seeing a friend’s name or profile picture is no longer proof of authenticity.
Users must now verify messages independently—especially those asking for money.
Limitations of the Data
Report Fraud does not hold detailed data on who was targeted—only that a financial loss occurred.
There is no breakdown of scam types or the proportion involving family members.
The figures may reflect reporting changes, not actual increases in attacks.
For more on how to protect your digital life, see our latest tips.
The National Cyber Security Centre recommends using passkeys and two-step verification as standard security practices.
Sources & further reading
AI-generated illustration.
