London: The amount of money stolen by criminals who hack into email and social media accounts and impersonate their owners has increased by more than 400 percent in the UK in a year, official figures show.
Hackers are increasingly taking control of accounts to pose as victims and target their friends, relatives and colleagues. One common tactic involves using compromised profiles to advertise fake tickets for sold-out concerts and other events.
According to the UK’s Report Fraud service, operated by the City of London Police, reported losses linked to email and social media account hacking reached £6.3 million in the 2025-26 financial year, up from £1.2 million in 2024-25.
The actual amount is likely to be considerably higher, as many victims do not report scams. Some may feel embarrassed about falling victim, while others may not consider reporting relatively small financial losses worthwhile.
Impersonation Scams
In one case, a music fan’s Instagram account was hacked and used to promote fake tickets for an Oasis concert. The fraudsters persuaded her friends to send money for the tickets, stealing £1,400 in total. The victim said the criminals copied her identity so convincingly that her friends and family believed they were communicating with her.
Another growing form of impersonation involves criminals sending WhatsApp or text messages pretending to be a child or relative facing an emergency and urgently asking for money. The scam, commonly known as the ‘Hi mum’ scam, has also targeted parents and families.
Santander data showed that, among its customers, scammers pretending to be someone’s son were the most successful at convincing people to send money, followed by fraudsters posing as daughters.
Ch Supt Amanda Wolf, head of Report Fraud operations, stated that account hacking can have consequences beyond the immediate cyberattack, leaving victims locked out of accounts, concerned about stolen information and worried that criminals could use their identity to target people they know.
Wolf added that one compromised account can quickly lead to further fraud as criminals exploit trusted relationships between family members, friends and colleagues.
Report Fraud is now running an awareness campaign encouraging people to strengthen their online security by using passkeys where available. Passkeys use a device and biometric authentication to verify a user’s identity, offering protection that does not rely on traditional passwords.
ALSO READ | Revolut’s rapid rise reshapes Europe’s banking landscape
