Losses from account takeover fraud in the United Kingdom have escalated dramatically, with reported theft amounts rising more than fourfold over a twelve-month period, according to data from the national fraud reporting service managed by the City of London Police’s economic crime division.
The recorded value of funds stolen through compromised email and social media accounts reached £6.3m during the 2025-26 financial year, up from £1.2m the previous year. Investigators note that actual losses likely exceed these figures considerably, as many victims fail to file official reports due to embarrassment or because individual losses are modest in scale. Scammers frequently exploit hijacked accounts by leveraging the trust inherent in established personal relationships, using them to perpetrate secondary fraud against the account holder’s network of contacts.
One prevalent variant involves fraudsters marketing counterfeit event tickets, particularly for high-demand concerts and entertainment events, to the compromised account owner’s friends and family members. Another common approach uses impersonation through text-based platforms, where criminals pose as relatives claiming to face emergencies requiring immediate financial assistance. Banking data has indicated that impersonations claiming to be adult sons prove particularly effective at convincing victims to transfer money, followed by impersonations of daughters.
Authorities emphasize that account compromise creates cascading harm beyond the initial victim. Ch Supt Amanda Wolf, leading Report Fraud operations, stated that compromised accounts can rapidly extend the scope of fraud to encompass broader social networks as criminals weaponize established relationships of trust. In response, Report Fraud has initiated a public awareness initiative promoting stronger account security practices, specifically encouraging adoption of passkey authentication where available. Passkeys authenticate users through device-specific and biometric verification methods that cannot be compromised using conventional password attack techniques.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI