Fraud Up 11% in England and Wales as Phishing Texts Climb
Fraud against adults in England and Wales rose 11% to an estimated 4.5 million incidents in the year to June 2026, driven by a 13% jump in bank and credit account fraud. Separate ONS tables show 49% of adults received a message they thought may have been phishing in the past month, with suspected phishing texts up from 24% to 30% in two years.
01Telemetry
Key findings at a glance
- 4.5 millionestimated fraud incidents against adults in England and Wales in the year to June 2026, up from 4.1 million
- 11%rise in Crime Survey fraud incidents compared with the year to June 2025
- 2.8 millionbank and credit account fraud incidents, up 13% and the main driver of the overall rise
- 817,000computer misuse incidents in the year to June 2026, a 23% increase on the previous year
- 29%rise in incidents of unauthorised access to personal information, to 689,000
- 2.1%of adults were victims of consumer and retail fraud in the year to March 2026: goods or services paid for that never arrived, were misrepresented or were faulty
- 49%of adults received a message they thought may have been phishing in the month before their interview
- 37%received a suspected phishing email to a personal email account in the past month
- 30%received a suspected phishing text or instant message, up from 24% two years earlier
- 75%of adults who used the internet in the past year delete suspicious emails without opening them
- 63%of internet users question the credibility of website links and do not click when unsure
- 46%of adults use Apple Pay or Google Pay to keep their card details safe, up from 35% two years earlier
02Scope
What the report covers
The Office for National Statistics published Crime in England and Wales: year ending June 2026 on 22 October 2026. It combines the Crime Survey for England and Wales (CSEW) with police recorded crime. Headline CSEW crime stood at 9.7 million incidents, no statistically significant change on the 9.3 million a year earlier. Fraud is the exception the ONS singles out: an estimated 4.5 million incidents, up 11% from 4.1 million, because bank and credit account fraud rose 13% to 2.8 million. Fraud is now 34% above the year ending March 2017, the earliest comparable year. Computer misuse rose 23% to 817,000 incidents, driven by a 29% rise in unauthorised access to personal information (689,000 incidents), although it remains 54% below its 2017 level.
The recorded figures point the same way. Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025, recorded 348,944 fraud offences reported to it directly, up 15%, and fraud offences referred by Cifas rose 8% to 405,990. The ONS cautions that some of that increase reflects improvements to the reporting system. The bulletin also cites the Cyber Security Breaches Survey 2025 to 2026, which found 19% of businesses and 14% of charities had been victims of at least one cybercrime in the past year, similar to the previous survey.
Alongside the bulletin, the ONS published the nature of fraud and computer misuse appendix tables for the year ending March 2026, which cover phishing and online security habits. 49% of adults received a message they thought may have been phishing in the past month, a statistically significant rise from 46% two years earlier. 37% received one by email, 30% by text or instant message (up from 24%, also significant) and 6% through social media. Of those who received one, 2.1% replied or clicked a link, and 32% reported it, up from 24%. Reports to an internet or phone provider rose from 13% to 21%.
03Briefing
What this means for UK marketers
The marketing problem in these numbers is not fraud itself, it is suspicion. Nearly half of adults saw a message they suspected was phishing in the past month, three in four internet users delete suspicious emails unopened, and 63% will not click a link they are unsure of. Your newsletter, abandoned basket email and delivery text land in the same inbox and get judged by the same rules. Anything that looks like a scam (a sender name that does not match the domain, a shortened link, a "verify your account" prompt, invented urgency) now costs opens and clicks as well as trust.
Start with authentication. The NCSC's email security and anti-spoofing guidance sets out SPF, DKIM and a DMARC policy so receiving servers can tell your mail from a spoof. Then make genuine messages easy to recognise: one consistent sending domain, links that point to your own domain, and a standing line that you will never ask for passwords or card details by email or text. Email is too valuable to let scammers dilute, as our report on UK email marketing returns shows.
Texts need the most care, because suspected phishing by text grew fastest, from 24% to 30% in two years. If you are adding SMS automations to your store, name the brand in every message, send only to people who opted in, and keep links on your own domain.
At checkout, 46% of adults use Apple Pay or Google Pay to protect their card details, and 2.1% were hit by consumer and retail fraud. Offering wallet payments and showing clear company details, delivery terms and returns are sensible responses for cautious buyers, and both belong in any ecommerce website build. Unauthorised access to personal information rose 29%. Not all of that starts on a retailer's website, but customer accounts are an obvious target, so patch plugins promptly and enforce two-factor logins for admins, the core of WordPress maintenance. If a breach does happen, Article 33 of the UK GDPR requires notification to the regulator without undue delay and, where feasible, within 72 hours, unless it is unlikely to put people's rights at risk.
04Method
How they got the data
Check the method before you quote the number.
The CSEW is an interviewer-administered, face-to-face survey of people aged 16 and over living in households in England and Wales, asking about crimes they experienced in the 12 months before interview. The latest headline figures are based on interviews between July 2025 and June 2026, covering crimes that occurred between July 2024 and May 2026. It excludes crimes against businesses and people living in communal establishments such as care homes and student halls. Fraud and computer misuse questions were added in October 2015, so the year ending March 2017 is the earliest comparable year, and the CSEW fraud and computer misuse estimates have been accredited official statistics since March 2018. Police recorded crime and Report Fraud figures are official statistics but not accredited, and the ONS says they are not reliable measures of overall levels or trends because many incidents go unreported. The full approach is in the ONS user guide to crime statistics for England and Wales.
The phishing, online security and payment security figures come from the appendix tables for the year ending March 2026, so they cover a different 12-month window from the headline bulletin. The phishing question had an unweighted base of 7,730 adults, with follow-up questions put to the 3,644 who said they had received a suspicious message. The online security and payment security questions are asked of one quarter of the CSEW sample, and the online security questions only of those who had used the internet in the past year. The ONS flags changes that are statistically significant at the 5% level, and every figure here is a sample estimate with some uncertainty.
