Police in Northern Ireland logged 560 social media and email hacking reports in FY25/26 as UK losses from account takeovers surged 417% to £6.3m; the public are being urged to switch to passkeys and turn on two-step verification during Cybersecurity Awareness Month.

Detective Inspector Darren McCracken, Police Service of Northern Ireland, said: "Your email and social media accounts hold the keys to your personal life and when hackers compromise them, the fallout can be devastating. My message to the public is to protect your identity and digital footprint by taking immediate action: use passkeys, use strong passwords, and enable two factor authentication where possible. A few simple changes today can help prevent becoming a victim tomorrow."

Report Fraud is warning of sharp increases in financial losses linked to email and social media account hacking, with stolen sums rising by 417 per cent in 2025/26 to £6.3 million, up from £1.2 million in 2024/25. Nationally, this type of hacking remains the most commonly reported form of cybercrime, with the number of reports up by a third (34 per cent) year on year. Other account takeovers highlighted include gaming and streaming platforms, as well as travel and delivery services.

To coincide with Cybersecurity Awareness Month, Report Fraud has launched a campaign today (5 October 2026) urging people to secure their online accounts by adopting passkeys and strengthening protections.

In this context, hacking refers to criminals gaining unauthorised access to someone's email, social media or other digital accounts, often to impersonate the victim and trick family and friends into sending money or buying fake tickets. One common theme is compromised profiles being used to pose as trusted contacts.

Chief Superintendent Amanda Wolf, Head of Report Fraud Operations, said: "For most people, being hacked isn't just a cyber issue, it's personal. It can leave victims locked out of important accounts, worried about what information has been accessed, and concerned that criminals may use their identity to target others.

"What starts with one compromised account can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud.

"The good news is that there are simple steps people can take to protect themselves. Switching to passkeys and enabling two-step verification adds a strong extra layer of security and makes it much harder for criminals to gain access to your accounts." Jonathon Ellison, Director for National Resilience, National Cyber Security Centre (NCSC) said: "We know that most cyber harm to individuals starts with criminals attempting to steal login details, which is why we strongly encourage users to choose passkeys where they are available across digital services and use two-step verification where they aren't.

"Passkeys are simpler, faster and more secure to use, raising our national resilience against phishing attacks whilst leaving password headaches behind.

"Reporting scams is an effective way to make yourself a harder target to cyber criminals and protect others too. Cyber security is a shared responsibility, and the NCSC provides a range of resources and support to help everyone stay safe online."

Maureen Costello, Vice President, UKI and SSA - Google Cloud, said: "For over two decades, Google has been dedicated to protecting people from online scams and fraud. Beyond technical protections, empowering users to spot risks and secure their accounts is essential to online safety. We strongly support the UK authorities' campaign and look forward to partnering across the industry to keep citizens safe online."

Dr Elisabeth Carter, Criminologist and Forensic Linguist at Kingston University, said: "The financial and psychological impacts of social media and email hacking ripple well beyond the initial harm. When victims have their identity stolen through hacking, it can then be used as the very tool that criminals need to target, gain trust and then harm that person's friends, family and trusted contacts. This increases the financial harm, exposes many others to identity theft and compounds the psychological harms to the original victim beyond the initial hack, knowing that it was their identity that convinced their contacts to respond."

How to reduce your risk of being hacked:

- Use passkeys wherever available. They are both more secure and easier to use.

- If passkeys aren't an option, use strong, unique passwords (a password manager can help) and enable 2 Step-Verification.

- Review privacy settings so only intended audiences (for example, friends) can see your posts.

- Limit the personal details you share online, such as your birthday, address, family ties or pet names, which can help fraudsters steal your identity or craft convincing scams.

- If someone you know contacts you through email or social media, don't assume it's genuine. Verify via another channel, such as in person, SMS or a phone call.

If you've already been hacked:

- Report it to Report Fraud at reportfraud.police.uk or by calling 0300 123 2040.

- You can also report online at www.psni.police.uk/report, call 101, or dial 999 in an emergency.

- The UK's National Cyber Security Centre has step-by-step guidance on limiting the damage and regaining access: www.ncsc.gov.uk/guidance/recovering-a-hacked-account