THE UK’s Report Fraud service has launched a public awareness push urging people to switch to passkeys after reporting a sharp rise in cybercrime profits tied to account takeovers. In 2025/6, scams involving compromised emails and social media accounts netted attackers about £6.3m ($8.3m), up from £1.2m ($1.6m) the year before. The number of account-takeover reports also grew by around a third (34%) in the same period.
The service said impersonation of friends and family remains a common tactic used to monetise access, with fraudsters often exploiting trusted relationships to prompt victims to hand over funds or reveal sensitive information. Ticketing scams—where hacked accounts are used to sell non-existent tickets—were highlighted as another lucrative fraud vector.
Experts backing the campaign argue that passkeys offer stronger protection because they remove passwords from the login flow. Passkeys rely on a device PIN or biometric verification and are cryptographically tied to legitimate websites, meaning even if a site is breached, attackers don’t gain access to the user’s private key. Jonathon Ellison of the National Cyber Security Centre described passkeys as simpler, faster and more secure, helping bolster resilience against phishing.
The piece also cites NordVPN data showing lingering weaknesses in password practices among consumers: while 96% of UK participants knew how to create a strong password, only 16% understood how to store it safely, such as in a password manager.