The total amount stolen by criminals who hack into people’s emails and social media accounts and then pretend to be them has risen by more than 400% in a year, official UK data shows.
In many cases, the scammers are hijacking people’s accounts in order to use their identity to sell fake event tickets – such as to sold-out gigs – to unsuspecting friends and family.
The total reported amount stolen via email and social media account hacking reached £6.3m in the 2025-26 financial year, compared with £1.2m in 2024-25, according to the Report Fraud service run by the City of London police, which holds national responsibility for economic crime.
However, the true total may be much higher as many scam victims do not report the crime, often because they feel embarrassed, and sometimes because the individual amount of money involved was relatively small.
The Guardian previously featured the case of a music fan whose Instagram account was targeted by hackers, who used her identity to advertise tickets to an Oasis gig and stole £1,400 from her friends. She said the hackers impersonated her so well that her friends and family genuinely thought they were speaking to her.
Others have been scammed by fraudulent WhatsApp and text messages in which a criminal pretends to be their child or a relative who is in an emergency situation and urgently needs cash. This has been dubbed the “Hi mum” scam.
Data from Santander has shown that among customers of the bank, fraudsters pretending to be someone’s son were the most successful at extracting cash, followed by daughters.
Ch Supt Amanda Wolf, head of Report Fraud operations, said: “For most people, being hacked isn’t just a cyber issue – it’s personal. It can leave victims locked out of important accounts, worried about what information has been accessed, and concerned that criminals may use their identity to target others.”
She added that what starts with one compromised account “can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud”.
Report Fraud is launching an awareness campaign urging the public to protect their online accounts from hackers by switching to passkeys where they are available. A passkey uses an individual’s device and biometrics to authenticate them and cannot be hacked like a password.
