Your Facebook, Instagram or email account is hacked and used to scam your contacts for money or fake tickets
Criminals hack email and social media accounts via phishing or credential stuffing, then impersonate the owner to contacts — demanding urgent money or selling fake event tickets. Report Fraud recorded 44,355 reports in 2025–26 and £6.3m stolen, a 417% rise.
Also known as: social media account takeover UK, Facebook account hacked scam UK, Instagram account hijack fraud, email account compromised UK, fake tickets from hacked account, chain hacking social media UK
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Do not send money to someone asking for it through social media, even if the message comes from a known account — always call or text the person on a number you already have to confirm it is really them
- 2 If your account has been taken over: use another device to go through the platform's account recovery process immediately; do not delay, as criminals can lock you out by changing the recovery email or phone number within minutes
- 3 Warn all your contacts immediately through another channel that your account has been compromised and to ignore any requests for money or purchases that appeared to come from your account
- 4 Once you regain access: change your password to a unique strong one, review and remove all active sessions, revoke any connected third-party apps you did not authorise, and enable two-step verification using an authenticator app rather than SMS
- 5 Switch to passkeys on every platform that supports them — passkeys cannot be stolen by phishing and are the most effective protection against account takeover
- 6 If anyone you know sent money because of messages from your compromised account, advise them to contact their bank immediately and report to Report Fraud
- 7 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.
Red flags
- ⚠ A message arrives from a known friend or family member on Instagram, Facebook, WhatsApp or email saying they are in an emergency and urgently need you to send money — even if the account looks exactly like theirs
- ⚠ The same contact tries to sell you event tickets through social media — a hacked account is often used to sell non-existent tickets to someone the owner's followers trust
- ⚠ You suddenly cannot log in to your own account even though you know your password — the criminal has changed your credentials after taking over
- ⚠ Contacts start getting in touch to ask why you are sending them unusual messages or asking for money — your account has been compromised
- ⚠ A 'forgot password' or account recovery request you did not make is sent to your email or phone — someone is attempting to hijack your account through the recovery process
- ⚠ You receive a verification or authentication code by SMS that you did not request — someone is trying to access your account on a new device
Sources
- Report Fraud / City of London Police — Switch to passkeys: email and social media account hacking sums stolen rise by more than 400% (5 October 2026)
- PSNI — Social Media and Email Hacking campaign from Report Fraud (October 2026)
- Infosecurity Magazine — £1M Lost as UK Social Media and Email Account Hacks Skyrocket (earlier reference)
- IntelligentCISO — Stolen money from social media and email hacking rises 400%, Report Fraud finds (5 October 2026)