UK police-led the national cyber reporting service urged households to switch to passkeys and two-step verification after stolen sums from email and social-media hijacks reached £6.3 million in the 2025-26 financial year, up from £1.2 million the year before.
Scale of the problem
The agency said account takeover remained the most reported cybercrime type in Britain, with report volumes up about a third year on year. Other hijacking categories cited in the release included gaming, streaming, travel, and delivery accounts, where reused passwords let criminals pivot into payment details.
Launching a Cybersecurity Awareness Month campaign on Sunday, officials argued that phishing kits have industrialised credential theft, making password-only defences inadequate for mainstream users.
Why passkeys matter
Passkeys bind logins to device hardware, reducing reliance on one-time codes sent by SMS, which SIM-swap attackers target. NCSC director for national resilience Jonathon Ellison said users should adopt passkeys where platforms offer them and fall back to multi-factor authentication elsewhere.
Recovery steps if you are locked out
NCSC guidance tells victims to regain control through provider recovery flows, change passwords on any account that shared the compromised credential, and report incidents to the reporting service so intelligence teams can trace mule networks. Ellison stressed that reporting makes individuals harder targets and protects others.
Corporate angle
Employers remain liable under UK GDPR if work email is breached and personal data leaks. IT teams should enforce phishing-resistant authentication on Microsoft 365 and Google Workspace, not only consumer services. Banks increasingly treat email compromise as a precursor to authorised push payment losses, tightening refund policies when customers ignore warnings.
Platform roll-out
Major UK banks, retailers, and telcos now offer passkeys on iOS and Android, but uptake remains uneven on legacy web portals. The campaign encourages users to check security settings menus rather than waiting for marketing emails that mimic phishing templates.
Ellison said NCSC will refresh its guidance for small businesses that rely on shared mailboxes, where passkeys are harder to deploy without identity governance tools.
Banking liaison
UK Finance members are aligning refund policies for authorised push payment losses with stronger customer authentication. Victims who ignore on-screen warnings may still face partial liability, making prevention through passkeys the cheaper path for households and lenders alike.
Telecom operators are also tightening SIM-swap checks after high-profile cases in which attackers intercepted one-time codes. Combined with passkeys, those controls reduce but do not eliminate social-engineering calls that trick users into approving logins manually.