Cybercrime Reporting & Prevention

Cybercrime Reporting & Prevention

1. Understanding the Cybercrime Landscape

Cybercrime falls into two broad categories — both equally reportable and serious:

• Cyber-dependent crimes: Offences that can only be committed using a computer, network, or digital device — hacking, malware, ransomware, distributed denial of service (DDoS) attacks, and unauthorised access to systems.
• Cyber-enabled crimes: Traditional crimes amplified by digital technology — online fraud, identity theft, phishing, online harassment and stalking, child exploitation, and the sale of illegal goods on the dark web.
• Scale: The Office for National Statistics estimates 2.7 million cyber-related fraud offences and 1.3 million computer misuse offences in England and Wales annually. The vast majority go unreported — often because victims are unsure who to contact or feel embarrassed.
• Cost: The average financial loss for UK cyber fraud victims is approximately £1,500, though some cases (investment fraud, business email compromise) result in six- and seven-figure losses.

2. Action Fraud — The UK’s National Reporting Centre

Action Fraud is the UK’s national reporting centre for fraud and cybercrime, operated by the City of London Police. All reports feed into the National Fraud Intelligence Bureau (NFIB) for assessment and investigation:

• Report online: actionfraud.police.uk — available 24/7. The online reporting tool asks structured questions to capture key details: what happened, when, how you were contacted, financial losses, and any suspect details.
• Report by phone: 0300 123 2040 (Monday to Friday, 8am-8pm). For live, ongoing cyber-attacks where you are at immediate risk, call 999.
• What to report: Online fraud (phishing, investment scams, purchase scams, romance fraud, business email compromise), hacking, malware, ransomware, identity theft, and any cyber-enabled financial crime. Action Fraud also handles doorstep, mail, and phone fraud.
• What Action Fraud does NOT handle: Lost or stolen property without a fraud element, civil disputes, or matters already under investigation by another force. For online harassment or stalking (not involving fraud), report directly to your local police on 101.
• After reporting: You receive a National Crime Reference Number (NCRN). Your report is assessed by the NFIB and disseminated to the appropriate police force for investigation. Not every report results in an individual investigation — reports are analysed for patterns and links across cases. High-harm, high-value, and linked cases are prioritised.
• Reporting helps everyone: Even if your individual case is not investigated, your report adds to intelligence that disrupts criminal networks. It also feeds into the Suspicious Email Reporting Service (SERS) and the takedown of fraudulent websites and phone numbers.

3. National Cyber Security Centre (NCSC)

The NCSC (ncsc.gov.uk) is part of GCHQ and is the UK’s technical authority on cyber security. While it does not investigate individual crimes, it provides essential guidance, threat intelligence, and reporting mechanisms:

• Suspicious Email Reporting Service (SERS): Forward phishing emails to report@phishing.gov.uk. The NCSC’s automated system analyses the email, identifies malicious links, and works with hosting providers and registrars to take down fraudulent websites. Since launching in 2020, SERS has led to the removal of millions of scam URLs.
• Suspicious text messages: Forward scam texts to 7726 (free — spells SPAM on a phone keypad). Your mobile network operator will investigate and can block the sender.
• Cyber Aware campaign: The NCSC’s public awareness programme promotes six key protective behaviours — see Section 5.
• Organisational guidance: The NCSC provides Cyber Essentials (a government-backed certification scheme for SMEs), 10 Steps to Cyber Security (board-level guidance), and sector-specific guidance for charities, legal practices, and local government.
• Exercise in a Box: A free online tool that helps organisations test and practise their response to a cyber-attack in a safe environment — covering ransomware, phishing, and supply chain attacks.
• Early Warning service: Free for UK organisations — notifies you of relevant threats and vulnerabilities detected by NCSC’s monitoring systems.

4. Common Cybercrime Types & How to Respond

• Phishing (email, SMS, voice): Fraudulent messages designed to steal passwords, bank details, or install malware. Signs: generic greetings (“Dear Customer”), urgency (“your account will be closed”), suspicious sender addresses, and links that do not match the claimed destination (hover to check). Response: Do not click. Forward to report@phishing.gov.uk. Delete.
• Identity theft: Criminals obtain enough personal information (name, date of birth, address, bank details) to open accounts, apply for credit, or claim benefits in your name. Response: Report to Action Fraud. Contact Cifas (cifas.org.uk) to register for Protective Registration — a flag on your credit file requiring extra verification before credit is issued. Check your credit report with all three agencies. Change passwords and enable 2FA on all accounts.
• Ransomware: Malware that encrypts your files and demands payment (usually in cryptocurrency) for the decryption key. Increasingly targeting individuals through infected email attachments and compromised websites. Response: Disconnect the device from the internet immediately (to prevent spread). Do not pay — there is no guarantee you will get your data back, and payment funds further crime. Report to Action Fraud and the NCSC. Restore from backups. If no backups exist, the No More Ransom project (a partnership between law enforcement and security companies) may have free decryption tools for certain ransomware families.
• Online harassment and cyberstalking: Persistent, unwanted contact causing alarm or distress — including threatening messages, doxxing (publishing private information), and monitoring through spyware. Response: Report to local police on 101 (or 999 if in immediate danger). Preserve evidence — screenshots, message logs, email headers. The National Stalking Helpline (0808 802 0300) and Paladin (paladinservice.co.uk) provide specialist support. Under the Protection from Harassment Act 1997 and the Online Safety Act 2023, cyberstalking carries up to 10 years’ imprisonment.
• Investment and purchase scams: Fake investment opportunities, counterfeit goods, non-delivery of purchased items. Common on social media and auction sites. Response: Report to Action Fraud and the platform where the scam occurred. If you paid by credit card, contact your provider for a Section 75 claim (purchases over £100). For debit cards, use the chargeback scheme. Check the FCA’s ScamSmart register for investment firm warnings.

5. The Six Cyber Aware Behaviours (NCSC)

The NCSC’s Cyber Aware programme recommends six simple, high-impact protective behaviours for individuals and small businesses:

1. Use a strong and separate password for your email. Your email account is the gateway to all other accounts (password resets flow through it). Make its password long (12+ characters), unique, and composed of three random words. Use a different password for every other service.
2. Create strong passwords using three random words. The NCSC recommends this method over complex character substitution (which humans find hard to remember and computers find easy to crack). Example: “OakPenguinCandle45” is strong and memorable.
3. Save your passwords in your browser. Modern browsers (Chrome, Edge, Firefox, Safari) securely store and sync passwords. They also warn you if a password has been compromised in a known data breach. This is safer than reusing passwords or writing them down, and far more practical than trying to memorise dozens of unique passwords.
4. Turn on two-factor authentication (2FA). Also called two-step verification. After entering your password, you provide a second factor — typically a code from an authenticator app or a text message. This means a stolen password alone is not enough to access your account. Enable 2FA on email, banking, social media, and any service holding payment information.
5. Update your devices and software. Install security updates promptly — they patch vulnerabilities that criminals actively exploit. Turn on automatic updates on your phone, computer, tablet, and smart devices. Do not ignore update prompts for weeks.
6. Back up your data. Follow the 3-2-1 rule: at least three copies of important data, on two different types of storage, with one copy stored off-site (or in the cloud). Backups protect against ransomware, device failure, theft, and accidental deletion. Test that you can restore from your backups — a backup you cannot restore is not a backup.

6. Local Police Cyber Units & Regional Organised Crime Units (ROCUs)

Beyond Action Fraud and the NCSC, enforcement happens at regional and local levels:

• Regional Organised Crime Units (ROCUs): Each of the 9 English regions plus Wales and Scotland has a ROCU with a dedicated cybercrime unit. These units investigate complex, cross-border cybercrime and provide digital forensics support to local forces. They also lead on serious and organised cyber-dependent crime.
• Local police forces: Every force has a cybercrime or digital investigations capability. For cyberstalking, harassment, and crimes with a local suspect, report directly to your local force on 101. Many forces now have dedicated Cyber Protect officers who provide free advice to individuals and businesses on prevention.
• National Crime Agency (NCA): The NCA’s National Cyber Crime Unit (NCCU) leads the UK’s response to the most serious cybercrime threats — including nation-state attacks, major ransomware operations, and dark web criminal marketplaces. The NCCU does not take reports directly from the public — reports flow through Action Fraud and are escalated where appropriate.
• Get Safe Online: getsafeonline.org is a public-private partnership providing free, practical advice on online safety — covering everything from safe online shopping to protecting children from online harms.

7. Protecting Your Business from Cybercrime

Small and medium-sized enterprises are disproportionately targeted — around 38% of UK SMEs reported a cyber security breach in the last 12 months, with an average cost of £4,960 per incident:

• Cyber Essentials certification: A government-backed scheme certifying that your organisation has implemented five basic technical controls: boundary firewalls and internet gateways, secure configuration, access control, malware protection, and patch management. Certification costs around £300-£500 and is mandatory for central government contracts involving sensitive data.
• Free NCSC tools: Exercise in a Box (incident response practice), Check Your Cyber Security (vulnerability scanner for public-facing IPs), and Early Warning (threat notification service). All free for UK organisations.
• Staff training: Most breaches involve human error — clicking malicious links, downloading infected attachments, or falling for phishing. Regular, brief training (even 15 minutes quarterly) significantly reduces risk. Free training resources at ncsc.gov.uk/training.
• Incident response plan: Know who to call, what to disconnect, and how to preserve evidence before an attack happens. The NCSC’s Small Business Guide includes a simple incident response checklist.
• Cyber insurance: Consider cyber insurance as part of your business continuity planning. Policies typically cover incident response costs, forensic investigation, legal fees, business interruption, and ransom negotiation. The NCSC and the Association of British Insurers have published joint guidance on choosing appropriate cover.

8. Protecting Children and Vulnerable Adults Online

• CEOP (Child Exploitation and Online Protection): Part of the NCA. Report concerns about online child sexual abuse and exploitation at ceop.police.uk. If a child is in immediate danger, call 999.
• Internet Watch Foundation (IWF): The UK hotline for reporting child sexual abuse imagery online. Reports can be made anonymously at iwf.org.uk. The IWF works with internet service providers worldwide to remove illegal content.
• Parental controls: Internet service providers (BT, Sky, Virgin Media, TalkTalk, EE) offer free parental controls that filter inappropriate content at the network level. Gaming consoles, streaming services, and smartphones also have built-in parental controls. The UK Safer Internet Centre (saferinternet.org.uk) provides setup guides.
• Online Safety Act 2023: New legislation placing a duty of care on social media platforms and search engines to protect users — particularly children — from harmful content. Platforms must assess risks, implement proportionate safety measures, and enforce age limits. Ofcom is the regulator with enforcement powers including fines of up to £18 million or 10% of global annual revenue.
• Revenge porn and intimate image abuse: Sharing private sexual images without consent is a criminal offence carrying up to 2 years’ imprisonment. Report to local police. The Revenge Porn Helpline (0345 6000 459, revengepornhelpline.org.uk) provides specialist, confidential support including help with takedown requests.

---

GOTOSHARP Information Hub resource article. Last updated: June 2026.