UK account hack losses reported to police reached £6.3 million in the 2025/26 financial year, up from £1.2 million a year earlier, according to the City of London Police's first annual assessment of its Report Fraud service. The 417% jump is a count of reports and recorded losses, not proof that attacks increased at the same rate.
The assessment covers victim reports submitted across England, Wales and Northern Ireland during the year ending March 31. It found that the number of people reporting a financial loss after an account hack rose from 226 to 2,325.
Those figures arrived during a change in the machinery used to collect them. Report Fraud replaced the older Action Fraud service in a formal launch in January. Police said 92% of account-hacking reports involving a financial loss were recorded in the second half of the financial year, which overlapped with that transition.
The force cautioned that better identification and recording of incidents accounts for some of the year-on-year difference, making a direct comparison with the previous year unreliable as a measure of underlying attack volume.
Why are UK account hack losses rising so sharply in the data?
The available evidence points to a reporting change as one factor, rather than establishing a fivefold rise in real-world offending. Report Fraud was designed to collect more useful detail from victims and private-sector participants, information police can use for intelligence analysis, prevention and investigations.
Victims submit contact information, details of suspected fraud or cybercrime, losses or attempted losses, and information on suspects where known, according to the service's privacy information. The City of London Police, the national lead force for fraud, says the information may also be shared lawfully with police, government bodies, financial institutions and other partners where necessary.
Account hacking is only one measure of cybercrime
The assessment recorded 64,608 reports of cyber-dependent crime in 2025/26, a category for offences that require computer networks, such as hacking and malware. Account hacking was its largest component, at 44,355 reports. Across all cyber-dependent crimes, reported losses were £14.3 million, up 90%, with an average reported loss of £220 per victim, compared with £155 a year earlier.
These are three different measures: 2,325 victims reported a financial loss linked to account hacking; 44,355 account-hacking reports were logged overall; and £14.3 million covers reported losses across the broader cyber-dependent-crime category. They should not be treated as interchangeable totals.
Nor does the £6.3 million account-hack figure capture every loss that may follow a compromise. Police said a criminal who takes over an email or social-media account may then use it to commit fraud, while the victim may report the later fraud without knowing about the initial intrusion. In that case, the loss can be recorded under a separate fraud category.
Because Report Fraud relies on voluntary submissions, the reported figures likely represent only part of the total cybercrime harm. The new assessment offers a fuller administrative record of what reached police, but it does not settle how many account takeovers occurred nationwide.
This story draws on original reporting from The Record.
