6 Questions About Reporting Cybercrime Across the UK

Use Report Fraud for cybercrime in England, Wales and Northern Ireland, and Police Scotland for incidents in Scotland. Contact your bank immediately if money or payment details are at risk. Reporting cybercrime is separate from forwarding a suspicious message or notifying a regulator. I would establish immediate safety and stop further loss first, then make the appropriate reports without assuming one form reaches every organisation.

1. Is this an emergency or an active attack?

Call 999 if someone is in immediate danger. For a business, charity or organisation under a live cyberattack in England, Wales or Northern Ireland, Report Fraud directs callers to 0300 123 2040 immediately. In Scotland, use Police Scotland’s reporting routes and obtain technical incident-response support as needed. An urgent cyber problem does not automatically make every incident a 999 emergency.

2. Which route handles reporting cybercrime?

Report Fraud accepts police reports for England, Wales and Northern Ireland online or by telephone on 0300 123 2040. Its guidance directs people in Scotland, or reporting a crime that happened there, to Police Scotland on 101. Police Scotland also provides online and in-person reporting options. Explain any cross-border circumstances rather than deciding that an overseas offender makes reporting pointless.

Find these routes independently. A search result beside Local News Point remains a route to reading, not proof that a reporting form is operated by police. Check the responsible organisation before entering identifying information or payment records, and avoid paying an intermediary merely to submit a report.

3. Is forwarding a suspicious message enough?

No. Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. These channels help organisations analyse and disrupt phishing, but forwarding does not replace a police report when an account has been hacked or money stolen. The NCSC also accepts reports of suspicious websites through its dedicated reporting process.

Do not open an attachment to make the report more complete. Preserve the original message securely and follow the reporting service’s instructions. If you entered credentials, start the affected service’s genuine recovery process as well. Reporting an email does not change a stolen password or cancel a payment.

You do not need to identify the offender or prove the full technical mechanism before asking police for help. Describe the unauthorised access, attempted deception or other conduct as accurately as possible, including attempts that did not cause a financial loss. If several people in a business hold different parts of the evidence, agree who will coordinate the report. Keep each person’s original account rather than rewriting uncertain details into a single confident explanation.

4. What evidence should I collect?

Prepare a short timeline with dates, amounts, transaction references, account names, website addresses and contact details used by the suspect. Preserve original emails and messages where possible. Distinguish what you know from what you infer. For cryptocurrency, include the asset, network, wallet addresses and transaction hashes if available, without giving anyone private keys.

Save the exact page involved, not an unrelated homepage. A note saying “I visited presshubs.co.uk afterwards” does not identify where a disputed transaction happened. Useful evidence connects the incident, communication and payment. Do not delete accounts or wipe devices before discussing evidence preservation with the relevant support team.

5. Do businesses have additional reporting duties?

They may. An NCSC incident report can support technical understanding and response, but its reporting service expressly says this does not fulfil separate legal or regulatory duties. A personal data breach may require ICO notification without undue delay and, where feasible, within seventy-two hours of awareness. High-risk breaches can also require notifying affected people.

Assess the actual reporting thresholds and record the decision. Tell your insurer or relevant sector regulator where required. An update published on Weekly Journal would not replace a required notification to a regulator or an individual. Public communications and formal reporting serve different purposes.

6. What happens after I report?

Keep reference numbers and add significant new evidence through the official process. A report does not guarantee investigation, arrest or reimbursement. Continue account recovery and banking follow-up separately. Treat unexpected offers to recover losses for a release fee as a fresh risk, not evidence that your report has succeeded.