UK Social Media Scam Losses Soar 400% as Hackers Hijack Accounts to Trick Friends and Family

Criminals who hack email and social media accounts are increasingly using victims' identities to deceive their friends, relatives, and colleagues, with reported losses reaching £6.3 million in the 2025-26 financial year.

The figure represents a 417% increase from £1.2 million a year earlier, while the number of reports rose by 34%, according to Report Fraud. The figures were released on 5 October as Report Fraud launched an awareness campaign urging people to strengthen their online accounts and reduce the risk of account takeovers.

Hackers Turn Trusted Accounts Into Fraud Tools

Once criminals gain access to an email or social media account, they can exploit the victim's existing relationships to make fraudulent messages appear genuine. Report Fraud says compromised accounts have been used to promote fake investments and event tickets, while criminals have also impersonated account owners to ask their contacts for money.

One case involved a hacked Instagram account that criminals used to advertise tickets to an Oasis concert. The victim's friends were persuaded to send £1,400 after believing they were communicating with the account owner. The case highlights why account hacking can affect more than the person whose login details have been compromised.

Fake Family Emergencies Add Pressure

Criminals can also exploit family relationships by pretending to be relatives who urgently need financial help. The tactic is commonly known as the Hi Mum Scam, in which fraudsters impersonate children contacting their parents through messaging services.

The supplied source also cites Santander data showing that, among its customers, fraudsters pretending to be someone's son were the most successful at extracting money, followed by scams involving daughters. Such messages can appear more convincing when criminals have access to personal information or a genuine account belonging to the person being impersonated.

Reported Losses Do Not Show the Full Scale

The £6.3 million figure covers reported stolen sums and should not be interpreted as the total amount lost through account hacking across the UK. Report Fraud said reports involving email and social media account hacking increased by 34% during 2025-26, making it the most reported form of hacking in its UK figures. Other reported incidents involved compromised gaming and streaming accounts, as well as travel and online delivery accounts.

Authorities Recommend Passkeys

Report Fraud's awareness campaign encourages people to use passkeys where they are available. The National Cyber Security Centre recommends passkeys as a more secure alternative to passwords. Where passkeys are unavailable, Report Fraud advises people to use strong passwords and enable two-step verification.

Users are also encouraged to review their privacy settings and limit the amount of personal information they make publicly available. Details such as birthdays, locations, family relationships and pet names can potentially help criminals create more convincing fraudulent messages.

Verify Unexpected Requests for Money

A message should not be treated as genuine simply because it appears to come from a familiar account. Report Fraud advises people to verify unexpected requests for money through another communication method, such as a phone call or separate message.

Chief Superintendent Amanda Wolf, Head of Report Fraud Operations, said account hacking can affect more than the original victim because criminals can use compromised identities to target other people. Anyone who believes their account has been hacked can report the incident to Report Fraud and follow National Cyber Security Centre guidance on recovering access and limiting further damage.

The sharp rise in reported losses highlights how a compromised account can become a gateway to further fraud, particularly when criminals use an existing relationship to make their requests appear trustworthy.