Hacked Instagram and email accounts now used to sell fake gig tickets

According to Guardian News and Media, the amount stolen by criminals who hijack people's emails and social media accounts has risen by more than 400% in a year, reaching £6.3m in 2025-26 compared with £1.2m the year before. The figures come from the Report Fraud service run by the City of London police, which holds national responsibility for economic crime.

The scam does not start with a stranger. It starts with someone the victim's friends and family already trust: the victim's own Instagram or email account, taken over by a hacker.

How the account takeover becomes a theft

Once a hacker controls an account, the next step is not to target the account owner. It is to target the people around them. The Guardian reported the case of a music fan whose Instagram was hijacked by hackers who used her identity to advertise tickets to an Oasis gig. Her friends and family believed they were buying tickets from her. They were not. The hackers impersonated her well enough that £1,400 was stolen from people who trusted her, not a stranger.

This is the step the scam depends on. A hacked account does not need to fool the person it belongs to. It needs to fool everyone who already trusts that person. A message from a friend's real account, asking for money for a ticket, does not look like fraud. It looks like a favour.

A related version works without hacking an account at all. In the “Hi mum” scam, a criminal sends a WhatsApp or text message pretending to be someone's child or relative in an emergency, asking urgently for cash. Santander data shows fraudsters pretending to be someone's son were the most successful at extracting money this way, followed by daughters. The method is different but the mechanism is the same: borrow a relationship the victim already trusts, then ask for money through it.

Ch Supt Amanda Wolf, head of Report Fraud operations, said being hacked “isn't just a cyber issue, it's personal,” leaving victims locked out of accounts and unsure what information has been accessed. She added that what starts with one compromised account “can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud.”

The true scale is likely higher than the reported figures show. Many victims do not report the crime, often from embarrassment, or because the amount lost was small enough to let slide. Report Fraud is now launching a campaign urging people to move from passwords to passkeys where available, since a passkey uses a person's own device and biometrics and cannot be hacked the way a password can.