Introduction
Reported sums stolen through hacked email and social media accounts in the UK rose from £1.2 million to £6.3 million in a single financial year, an increase of 417 per cent. Most of those cases look nothing like the picture people carry around of investment scams. There is no cold call and no badly written email. The message arrives from an account that genuinely belongs to someone you know.
That matters for anyone holding a Stocks and Shares ISA, a SIPP or a general investment account, because the most effective defence has very little to do with spotting a fake. It is a short check against the Financial Conduct Authority’s own records, done before any money moves. This guide covers what that check proves, what it does not prove, and the three gaps where investment scams still get through.
This article is for information and education. It is not financial advice or a personal recommendation. Investing puts your capital at risk, and the value of investments can fall as well as rise. If you are unsure what is right for you, consider speaking to an FCA authorised adviser.
Quick Answer: How To Avoid Investment Scams
The Short Version
Check the firm on the FCA Firm Checker before you send money, and use only the phone number and email address shown there. Confirm it holds permission for the service you want. If the firm is not authorised, the Financial Ombudsman and the Financial Services Compensation Scheme will usually not be able to help you.
What The Police Figures Actually Show
The figures come from Report Fraud, the national fraud and cybercrime reporting service run by the City of London Police, published on 6 October 2026. Reported sums stolen through email and social media account hacking rose 417 per cent year on year, from £1.2 million in the 2024/25 financial year to £6.3 million in 2025/26. The number of reports rose 34 per cent over the same period, and this is now the most reported form of cybercrime in the UK.
Two details matter more than the headline. The money lost grew far faster than the number of reports, so the average loss per victim climbed steeply. And the attack does not go near your broker: it targets the account you use to talk to people, then borrows your credibility.
Reported sums stolen through hacked email and social media accounts, UK
Source: Report Fraud, City of London Police, 6 October 2026. Verified 8 October 2026.
417 per cent
The rise in reported sums stolen through hacked email and social media accounts between the 2024/25 and 2025/26 financial years, according to Report Fraud.
How Investment Scams Reach You Now
A hacked account is the delivery route, not the fraud itself. Once someone controls an inbox or a social profile they can use it in several ways, and the ones that turn into investment scams are the most expensive.
The Trusted Recommendation
A message from a friend's real account mentions a platform or a fund that has done well for them. Nothing about the sender looks wrong, because nothing about the sender is wrong.
The Intercepted Transfer
A hacked inbox gives access to genuine correspondence with a solicitor, an accountant or a platform. Payment details are then altered at the moment a large transfer is due.
The Reset Chain
Email is the recovery route for most financial accounts, so control of the inbox can mean control of password resets elsewhere. The inbox often deserves stronger protection than the accounts it guards.
Whatever the route, the pitch at the end of most investment scams is a clone of a real, authorised firm. The FCA describes clone firms as fake firms set up by scammers that use a genuine firm’s name, address and Firm Reference Number, then point you at the real company’s website so that everything you check appears to match. Where the pitch involves mirroring somebody else’s trades, our guide to how copy trading actually works sets out the mechanics and the risks.
What FCA Authorisation Actually Means
Authorisation is not a quality rating and it is not a view on whether an investment will do well. It means a firm has been through the FCA’s approval process and holds permission to carry out specific regulated activities. The practical value lies in what comes attached: access to the Financial Ombudsman Service when something goes wrong, and access to the Financial Services Compensation Scheme if the firm itself fails.
The FCA states the point plainly on its Warning List page: make sure you only deal with authorised firms, because otherwise you may not be covered by the Financial Ombudsman Service or the Financial Services Compensation Scheme. That single sentence is the whole argument for spending two minutes on a check.
It is worth being precise about what the compensation scheme covers, because there are two headline figures and they are routinely blurred together.
| What you hold | Protection limit | Applies when |
|---|---|---|
| Cash deposits with a UK authorised bank, building society or credit union | £120,000 per person, per institution | Raised from £85,000 on 1 December 2025 |
| Investments held through an FCA authorised firm | £85,000 per eligible person, per firm | Where the firm failed after 1 April 2019 |
| Anything held with a firm that is not authorised | No protection | Authorisation by the FCA or PRA is a condition of cover |
Sources: Financial Services Compensation Scheme and the Prudential Regulation Authority. Verified 8 October 2026.
What The Compensation Scheme Does Not Cover
It does not compensate for investments that simply fall in value. The scheme states that it cannot accept claims for poor investment performance, so it protects you against a firm failing, not against a poor outcome.
How To Check A Firm In Four Steps
The whole check takes about two minutes, and the order matters.
- Search the FCA Firm Checker. Confirm the firm appears and that it is authorised. The checker also shows whether it holds permission for the particular service you want, which is not the same thing as being authorised for something else.
- Use only the contact details shown there. The FCA’s advice on clone firms is explicit: use the telephone number and email address on its own records, not the ones in the message that reached you.
- Search the Warning List. This is the FCA’s list of firms it is concerned are working without permission, and it currently holds more than 19,000 entries.
- Stop if anything fails to reconcile. A mismatched web address, a payment account in a different name, or pressure to move quickly are all reasons to pause rather than to check harder.
A Firm Reference Number Proves Nothing On Its Own
Scammers copy the real firm's reference number, so a matching number is exactly what a clone is built to produce. Treat it as the starting point for a search, not as evidence.
Where Investment Scams Catch People Out
The checks above are necessary, but they do not catch everything, and the FCA says so itself. Three gaps let investment scams through, and they matter before you rely on a clean result.
The Checker Does Not Confirm Your Protection
The FCA notes that the Firm Checker does not show whether Financial Ombudsman or compensation scheme protection will apply to what you are buying. Those have to be checked separately with each scheme.
A Clean Result Is Not A Clean Bill Of Health
If a firm is absent from the Warning List, the FCA states it may still be unauthorised or be a scam. Unauthorised firms change names often, and the regulator may not know about one yet.
The Records Can Lag
The FCA says its information may take around 24 hours on average to update, and that it cannot guarantee accuracy or completeness. A very recently listed firm is a reason for more caution, not less.
Compare FCA authorised platforms side by side, with fees and features in one place.
Capital at risk.
How This Looks On A UK Platform
On a mainstream UK platform the defences against investment scams are mostly about the account around the investment rather than the investment itself. Turn on two factor authentication, and use passkeys where your platform and your email provider support them. Report Fraud’s head of operations, Chief Superintendent Amanda Wolf, described switching to passkeys and enabling two step verification as adding a strong extra layer of security.
It also helps to know how a real platform behaves. Money moves to an account in the platform’s own name, never a third party’s. Moves between providers go through the provider to provider transfer process, not by sending cash to an individual. And a genuine firm will never need you to hurry a payment to secure a price. If you are weighing up where to hold an account, our reviews cover firms on the FCA register, including our Hargreaves Lansdown review, and our UK broker fees calculator shows what a platform costs to run over time.
If You Think You Have Been Targeted
Deal with the account before you deal with the money. Change the password on the compromised email or social account, turn on two factor authentication, and check whether password resets have been requested for any financial accounts. The National Cyber Security Centre publishes step by step guidance on recovering a hacked account.
Then report it. Reports go to Report Fraud online at reportfraud.police.uk or by phone on 0300 123 2040. In Scotland, cybercrime is reported to Police Scotland on 101. Tell your bank and your investment platform as well, so they can watch for attempted withdrawals and transfers.
Not sure which platform fits you? Answer a few questions and see the options.
Capital at risk.
Frequently Asked Questions
Key Takeaways
The Attack Has Moved To Accounts You Trust
Reported losses through hacked email and social media accounts rose 417 per cent in a year, to £6.3 million in 2025/26. Investment scams now often arrive from a real account belonging to somebody you know.
Check Before You Pay, Not After
Confirm the firm on the FCA Firm Checker and use only the contact details shown there. Dealing with an unauthorised firm usually means no Financial Ombudsman and no compensation scheme.
Know Which Limit Applies To You
Investments are protected up to £85,000 per eligible person, per firm. Cash deposits are protected up to £120,000 per person, per institution. Neither covers an investment that simply falls in value.
Protect The Inbox First
Email is the recovery route for most financial accounts, so passkeys and two factor authentication on your email matter as much as the security on your trading account.
Sources: Report Fraud, City of London Police, 6 October 2026; FCA Firm Checker and Warning List; FCA clone firm warning; Financial Services Compensation Scheme; Prudential Regulation Authority, Bank of England. All verified 8 October 2026.
This article is for information and education. It is not financial advice or a personal recommendation. Investing puts your capital at risk, and the value of investments can fall as well as rise. If you are unsure what is right for you, consider speaking to an FCA authorised adviser.
