UK police push passkeys as account-takeover losses climb to £6.3m

More takeovers are being reported, and each one is producing much more money. Losses grew 5.25 times while reports grew 34% ^[13][3]. Each report in 2025/6 therefore carried about 3.9 times the loss of a report a year earlier ^[14]. The ratio is per report, not per victim.

The money comes from the trust attached to the account. In one popular version, the criminal poses as the account owner and pretends to be in trouble so the victim sends funds ^[5]. "What starts with one compromised account can quickly impact family, friends and colleagues as fraudsters exploit trusted relationships to commit further fraud," said Chief Superintendent Amanda Wolf, head of Report Fraud operations ^[11].

The Lloyds Bank figure quoted alongside the Report Fraud data measures something else. In November 2024 the bank said 70% of concert ticket scams reported since August involved Oasis, with victims losing £346 on average and up to £1,000 in some cases ^[10]. That covers concert ticket fraud in general. It does not size the account-takeover problem.

Passkeys deal with the takeover itself. There is no password for a criminal to guess or steal, and the passkey is cryptographically tied to the legitimate website ^[7][8]. The NCSC puts its case in terms of phishing. "Passkeys are simpler, faster and more secure to use, raising our national resilience against phishing attacks whilst leaving password headaches behind," said Jonathon Ellison, director for national resilience at the National Cyber Security Centre ^[9].

The data on password habits comes from a vendor. A NordVPN survey of 4,896 UK participants, published on October 6, found 96% answered its question on creating a strong password correctly, but only 16% knew to store one in a password manager ^[12].