Cybercrime is criminal activity involving computers, mobile devices, networks or online services. It can include accessing an account without permission, spreading malicious software, stealing personal information or using a fake website to deceive someone into sending money.
Not every cybercrime looks like a technical attack. Some incidents involve malware or attempts to break into computer systems. Others begin with an ordinary-looking email, a fake delivery message, a fraudulent payment request or a phone call from someone pretending to be a trusted organisation.
Cybercrime can affect individuals, families, businesses, charities and public services. The consequences range from losing access to an account to financial loss, exposure of personal information and disruption to essential services.
Understanding how these crimes work can help people recognise suspicious activity, protect their accounts and respond appropriately when something goes wrong.
This guide explains what cybercrime means, its main categories, common and less obvious examples, how attacks happen, how to reduce the risks and where to report incidents in the UK.
What does cybercrime mean?
What is Cybercrime?
One broad term. Different offences, methods and consequences.
Criminal activity involving digital technology
Cybercrime can involve computers, mobile devices, networks or online services. It includes unauthorised access, malicious software, information theft and online deception used to obtain money.
What is involved?
Computers, mobile devices, networks and online services.
How does it happen?
Through technical attacks, deceptive messages, fake websites, fraudulent requests or unauthorised account access.
Who can be affected?
Individuals, families, businesses, charities and public services.
What can be the impact?
Lost money, account lockout, exposed personal information or disruption to essential services.
What can help?
Understand common attack methods, recognise suspicious activity, protect accounts and know how to respond when something goes wrong.
The Crown Prosecution Service describes cybercrime using these two broad categories.
Cyber-dependent
Crimes that require information and communications technology to be committed.
Cyber-enabled
Traditional offences whose scale or reach can be increased through technology.
Cybercrime is a broad term for criminal activity involving computers, digital devices, networks or online services. It describes a range of offences rather than one single crime.
For example, someone might access another person’s email account without permission, use ransomware to disrupt a company’s systems, steal payment details through a fake website or use social media to carry out fraud.
The UK Crown Prosecution Service (CPS) explains cybercrime through two broad categories: cyber-dependent crime and cyber-enabled crime. This distinction helps show whether digital technology is essential to the crime or is being used to carry out another kind of offence more easily or at greater scale.
According to the CPS, cyber-dependent crimes can only be committed through information and communications technology, while cyber-enabled crimes are traditional offences whose scale or reach can be increased through technology.
Read the Crown Prosecution Service’s cybercrime guidance for the legal and prosecutorial context.
What are the two main types of cybercrime?
The two categories below provide a useful starting point. They are broad classifications, not a complete list of every possible offence.
Two broad categories of cybercrime
Start with one question: could this offence exist in broadly the same form without digital technology?
What role does technology play in the offence?
Cyber-dependent crime
The offence requires information technology and targets a computer, network, data or its operation.
Examples
- Unauthorised access to systems
- Malware and ransomware attacks
- Denial-of-service attacks
The computer system is central to the offence.
Cyber-enabled crime
Digital technology enables or expands an offence that could also be committed without the internet.
Examples
- Online fraud and scams
- Impersonation to obtain money
- Some forms of online harassment
Technology helps carry out or scale the offence.
These are broad explanatory categories, not a substitute for legal analysis. The exact offence depends on the conduct, evidence and applicable law.
1. Cyber-dependent crime
Cyber-dependent crimes require computers, networks or other information and communications technology to be committed. The technology is both a means of carrying out the offence and a central target.
Examples include:
- Unauthorised access: accessing computer material or a system without permission.
- Malware attacks: using malicious software to steal information, damage files or carry out other harmful actions.
- Ransomware: encrypting or locking data and demanding payment, sometimes alongside threats to publish stolen information.
- Denial-of-service attacks: overwhelming a website or service so legitimate users cannot access it normally.
- Some attacks against network infrastructure: interfering with computer systems, services or data without authorisation.
These incidents can affect more than the computers directly targeted. For example, an attack on a service provider may disrupt the organisations and customers that depend on its systems.
2. Cyber-enabled crime
Cyber-enabled crimes are offences that can also happen without digital technology but may become easier to carry out, reach more victims or operate at greater scale through computers and online services.
Examples include:
- Online fraud: deceiving someone through a website, email, messaging service or social media account to obtain money or another benefit.
- Phishing: impersonating a trusted person or organisation to persuade someone to disclose information or take an unsafe action.
- Identity-related fraud: misusing another person’s identifying information to impersonate them or attempt to access services in their name.
- Online shopping scams: advertising goods or services that are fake, misrepresented or never supplied.
- Cyberstalking and online harassment: using digital services to pursue, threaten or repeatedly target someone.
- Certain forms of intellectual-property crime: using digital channels to distribute or sell material unlawfully.
The precise legal offence depends on what happened, the evidence and the applicable law. Not every harmful online interaction falls under the same offence.
What are the common examples of cybercrime?
Cybercrime takes different forms depending on the target, the criminal’s objective and the method used. Some incidents aim to steal money, while others focus on obtaining information, taking over accounts or disrupting services.
Common Examples of Cybercrime
Cybercrime can involve deception, stolen account access, harmful software, financial fraud or attacks on online services. Learn what each method means — and what to do about it.
Different methods • Different targets • Different consequences
Common forms
Recognise the behaviour, not just the technology.
Phishing and impersonation
Fake emails, texts, websites or callers pretend to be trusted organisations to obtain information, payments or unsafe actions.
Account takeover
A criminal gains control of an account using stolen passwords, deceptive login pages or compromised recovery methods. Email access can put other linked accounts at risk.
Malware and ransomware
Harmful software may steal information, monitor activity or damage files. Ransomware can encrypt data or combine encryption with threats to publish stolen information.
Shopping and payment fraud
Fake sellers, copied shops or impersonated suppliers may trick people into paying for goods that do not exist or sending money to the wrong account.
Identity theft and data misuse
Personal information may be used deceptively. A data breach means information was exposed, lost, altered or accessed improperly; it does not automatically prove identity theft.
Website and service disruption
A denial-of-service attack can overwhelm a website or service with traffic or requests, interrupting access and normal operations.
Less obvious methods
Some attacks exploit phone numbers, signed-in sessions, trusted suppliers or ordinary software features.
SIM swapping
A criminal attempts to transfer your mobile number to a SIM or eSIM they control. If successful, they may receive calls or texts intended for you.
Business email compromise
A genuine or impersonated business account is abused to request a payment, disclose sensitive information or change supplier bank details.
Session-token theft
A stolen browser cookie or session token may let someone misuse an existing signed-in session. Changing a password alone may not end every session immediately.
QR-code phishing
A QR code in a message, document or poster may lead to a fake website or unsafe action. The risk is the destination, not the QR format itself.
Malvertising and fake downloads
Deceptive adverts or fake download buttons can direct people to malicious or unwanted software, even while they search for a legitimate tool.
Supply-chain attacks
A compromised supplier, software package or trusted service can create risks for customers, even when their systems were not the original target.
MFA fatigue
Repeated unexpected sign-in prompts try to persuade someone to approve access or become confused. Do not approve a prompt you did not initiate.
Cryptojacking
A device or other resource is used without permission to mine cryptocurrency. Unusual resource use or poor performance can have many other causes.
Remote-access abuse
A criminal tricks someone into opening remote-access software and granting control of a device. The tool itself can also be used legitimately.
Crimes that directly harm people
Online grooming, coercion, threats, harassment and non-consensual sharing of intimate images can cause serious harm. These are not merely technical problems.
If affected: preserve relevant evidence when safe, use platform reporting tools, seek appropriate support and contact the police when a crime or immediate danger is involved. If a child may be at risk, use the relevant child-protection and police reporting routes.
For further guidance, consult the UK National Cyber Security Centre and the Information Commissioner’s Office guidance on personal data breaches.
How does cybercrime happen?
How does cybercrime happen?
Cybercrime does not have one universal method. Criminals may deceive people, steal login details, exploit software weaknesses, distribute malicious files or misuse access to existing systems.
THE ATTACK SURFACE
Seven routes an attack may take
Each route works differently. Some target a person’s decisions; others target accounts, devices, software or trusted organisations.
Deception and phishing
A criminal impersonates a trusted person or organisation to influence someone’s actions.
A fake delivery notification directs a recipient to a fraudulent page that asks for payment-card details.
Check the request independently. Visit the official website or use a trusted contact number instead of the message link.
Stolen credentials and account takeover
Login details are obtained and then potentially used to access an account without permission.
A victim enters their password on a fake sign-in page. A criminal uses the captured details to attempt access to their account.
Use unique passwords and multi-factor authentication. If compromised, change the password, revoke unfamiliar sessions and secure recovery options.
Password reuse
A password exposed in one breach is tried against other services where the same password may have been used.
A password leaked from a shopping website is also used on the customer’s email account.
Use a different password for every service, ideally stored in a reputable password manager.
Unpatched software
An attacker exploits a vulnerability in an affected application, server or device.
A server running vulnerable software is attacked through a known weakness that has not been fixed.
Install security updates promptly, remove unsupported software and restrict access to exposed services.
Malicious downloads
A file or installer performs harmful actions after a person opens it or installs the associated software.
A fake invoice attachment contains malware that attempts to steal information or damage files.
Download software from trusted sources and treat unexpected attachments or installers with caution.
Compromised suppliers or services
An attacker abuses a trusted provider, software component or connection to affect another organisation.
A compromised supplier account or service creates a route to information or systems used by a customer organisation.
Limit supplier permissions, review third-party access and prepare a response plan for supplier incidents.
Abuse of legitimate access
An account, device or remote-access tool is used without proper authority.
A former worker’s account remains active and is misused to access sensitive company information.
Remove access promptly when roles change, review permissions and monitor unusual account activity.
How a phishing attack can lead to account takeover
This is an illustrative example of how several events may connect. A phishing message does not automatically lead to account compromise.
A message claims that an account needs urgent verification.
A message creates urgency
It may imitate a delivery company, bank, employer or online service and urge the recipient to act quickly.
The recipient follows the request
They may open a link, enter information, call a fraudulent number or approve a request. This step is not inevitable.
Credentials or payment details are exposed
A fraudulent page may capture login details, or the recipient may be manipulated into authorising a payment.
The criminal may try to use the information
Success depends on factors such as whether the credentials work, multi-factor authentication and other account protections.
Account takeover or further fraud
If access succeeds, a criminal may misuse account data, attempt password resets elsewhere or impersonate the account owner.
There is no single method used in every cybercrime. Criminals may exploit a software weakness, obtain existing login information, deceive a person or abuse access that has already been granted.
Common routes include:
- Deception: someone is persuaded to reveal information, approve a request or send money.
- Stolen credentials: a criminal obtains login details through phishing, malware, a data leak or another route.
- Password reuse: a password exposed in one incident is tried against other accounts.
- Unpatched software: an attacker exploits a weakness in an affected application or system.
- Malicious downloads: a person installs or opens a file that performs harmful actions.
- Compromised suppliers or services: an attacker abuses a trusted provider or connection to reach another organisation.
- Abuse of legitimate access: an account, device or remote-access tool is used without proper authority.
Not every suspicious message, unusual login or software fault proves that a crime has occurred. A security incident may also happen accidentally, so the evidence and circumstances matter.
Who can be affected by cybercrime?
Cybercrime is not limited to large companies or people with valuable technology.
Individuals
Account takeover, fraud, identity misuse and online harassment.
Families
Impersonation, payment scams and misuse of children’s personal information.
Small businesses
Fraudulent invoices, compromised email, ransomware and operational disruption.
Large organisations
Attacks targeting valuable data, money, systems or essential services.
Charities and public services
Phishing, data theft and disruption that can affect people who rely on their services.
Phishing was the most prevalent reported attack type
The UK Cyber Security Breaches Survey reported the following proportions among surveyed organisations:
These percentages refer to businesses and charities in the survey. They are not the percentage of UK residents affected by cybercrime. The survey measures cyber security breaches and attacks; these should not automatically be treated as confirmed criminal offences.
What are the warning signs of cybercrime?
Warning signs depend on the incident, but there are reasons to investigate further:
What are the warning signs of cybercrime?
Unexpected account activity, suspicious requests and unfamiliar device access can be reasons to investigate.
Look for unusual activity. Warning signs depend on the incident. A single sign does not automatically mean you have been hacked.
Account access and security
Check whether you or someone else initiated the activity.
Unrecognised login alerts
Security notifications about sign-ins you cannot explain.
Unexpected password resets
Password-reset messages you did not request.
Messages you did not send
People receive emails or messages from your account that you never wrote.
Changed recovery details
Your recovery email, phone number or other account details change unexpectedly.
Repeated authentication prompts
Approval requests or sign-in prompts appear when you are not trying to log in.
Suspicious messages and payments
Pause when a request pressures you to act or share information.
Last-minute payment changes
A supplier or colleague asks you to use new bank details or bypass normal checks.
Urgent requests for sensitive information
A message pressures you to disclose passwords, verification codes or financial details.
Phone and device activity
Unexpected changes may warrant further checks, especially when combined.
Unexpected loss of mobile service
Your phone suddenly loses service alongside other signs of possible account compromise.
Unfamiliar remote access
You discover a remote-access session or application you did not authorise.
Software security warnings
Your device or security software warns that software is outdated or a vulnerability needs attention.
Check first. Don’t rush.
-
1
Open the service’s official app or type its known website address yourself.
-
2
Do not follow unexpected links or share passwords and verification codes.
-
3
Review account sessions and recovery details, then follow the provider’s official security guidance.
These are warning signs, not proof of a cyberattack. Verify unusual activity through a trusted channel before deciding what has happened.
How can you protect yourself from cybercrime?
No single setting prevents every attack. A combination of sensible security measures can reduce risk and make recovery easier.
Six ways to reduce cyber risk
Build layers of protection. No single measure prevents every attack, but these habits help reduce common risks.
Protect accounts, devices and data
Protect important accounts
- Use a different, strong password for each important account.
- Consider a reputable password manager.
- Enable multi-factor authentication or passkeys where supported.
- Keep recovery details updated and review active sessions.
Update devices and software
- Install OS, browser and app updates from official sources.
- Remove applications you no longer need.
- Check whether important devices still receive security updates.
Updates fix known weaknesses, but cannot guarantee complete protection.
Verify unexpected requests
- Be cautious about urgent requests for money, passwords or security codes.
- Contact organisations through their official app, website or trusted number.
- Do not trust a familiar logo, display name or caller ID on its own.
Secure devices and home networks
- Use a screen lock on phones and computers.
- Review app permissions and remove unnecessary access.
- Change default router administrator credentials where appropriate.
- Use supported modern Wi-Fi security and install router firmware updates.
Back up important data
- Back up important files regularly.
- Know how to restore your files.
- Consider a backup not continuously accessible from the main device.
Backups can support recovery, but do not prevent data theft or every kind of damage.
Be careful with downloads and remote access
- Install software from trusted sources.
- Avoid unexpected attachments and unfamiliar installers.
- Never grant remote access to an unexpected caller.
- Verify legitimate support requests independently.
What should you do if you become a victim of cybercrime?
The right response depends on the incident. If money, an account or a work system is involved, act promptly to limit further harm.
Think you’ve been targeted? Take these steps.
The right response depends on what happened. Act promptly to limit further harm.
Do not continue interacting with a suspicious caller, message, website or remote-access session.
Contact your bank or payment provider
If you made a suspicious payment or believe a financial account has been accessed, contact your bank promptly using a trusted method.
Secure the affected accounts
Use a device you trust to change compromised passwords, review recovery methods and sign out unfamiliar sessions where possible.
Preserve relevant evidence
Keep messages, emails, transaction details, dates and screenshots when safe to do so. Do not put yourself at risk to collect evidence.
Check your other accounts
Change the same password anywhere else you used it. Prioritise email and other accounts that can be used to reset passwords.
Use the appropriate UK reporting route
The correct service depends on where you live and what happened. Check current official guidance rather than relying on an unverified number or link.
Seek specialist help
Notify your IT or security team and follow its incident-response process if a work device, business account or network is affected.
Cyber safety: prevent, respond, recover
Good security reduces risk. If something goes wrong, take the steps that match the incident.
Start with the basics
Protect your accounts, devices, personal information and important files.
Before an incident
Reduce the chance of common attacks succeeding.
-
1
Secure accounts
Use unique passwords and multi-factor authentication. Review unfamiliar sign-ins.
-
2
Update devices
Install security updates and use software that still receives support.
-
3
Check unusual requests
Verify payment changes, urgent messages and unexpected requests independently.
-
4
Prepare backups
Keep important files backed up and test that you can restore them.
After a suspected incident
Prioritise immediate harm reduction and recovery.
-
1
Stop and assess
Do not continue interacting with a suspicious message, website or caller.
-
2
Secure affected accounts
Use a trusted device to change compromised passwords, revoke unfamiliar sessions and follow the provider’s recovery process.
-
3
Contact the right organisation
Contact your bank immediately if money or payment details are involved. Alert your IT or security team if a work system is affected.
-
4
Keep evidence and report
Preserve relevant messages and transaction details when safe. Use the official reporting route for your location and incident.
No checklist can prevent every incident. If a device or account may be compromised, the correct recovery steps depend on what happened. For a suspected ransomware or business network attack, seek appropriate incident-response assistance rather than relying on this checklist alone.
How do you report cybercrime in the UK?
The correct reporting route depends on the type of incident and where it occurred. Check the current official instructions before submitting a report.
How to report cybercrime in the UK
Choose the reporting route that matches your location and the type of incident.
If a crime is happening now, contact the police rather than relying on an online reporting form. Call 999 for an emergency or 101 for a non-emergency, as appropriate.
England, Wales and Northern Ireland
Report fraud and cybercrime through Report Fraud. Its website also provides routes for suspicious messages and online accounts when you have not lost money or responded.
Visit Report FraudContact Police Scotland
For incidents in Scotland, Report Fraud directs people to Police Scotland on 101. Follow the police service’s current instructions for your circumstances.
Visit Police ScotlandReport suspicious messages
Forward suspicious emails to the NCSC’s reporting service. You can also forward suspicious text messages to 7726, a free service supported by mobile networks.
Get help during an active incident
Contact the police if a crime is happening now. Organisations experiencing an active cyberattack should check Report Fraud’s latest urgent instructions.
Report Fraud guidance lists 0300 123 2040 for organisations under cyberattack. Verify the current instructions before relying on this number.
Check current instructionsIs all online crime cybercrime?
Online crime, hacking and the law
Digital activity can be harmful without every incident falling under the same offence. Context and authorisation matter.
Is all online crime cybercrime?
Not necessarily. The classification depends on the conduct and circumstances.
Cyber-dependent offences
Offences that require computers, networks or other digital technology to be carried out.
Traditional offences online
Crimes that can also happen offline but use digital services to reach or deceive victims.
Is hacking always illegal?
No. The term “hacking” can describe different activities, and authorisation is an important distinction.
Computer Misuse Act 1990 — Section 1
Section 1 addresses unauthorised access to computer material. Whether a particular act is an offence depends on the legal requirements and the facts of the case.
The term is broad, and the classification depends on the conduct and circumstances. Some offences require digital technology; others are traditional crimes that technology makes easier to carry out or extend to more people.
It is more accurate to explain what happened than to assume every harmful online interaction falls under the same legal offence.
Can cybercrime be prevented completely?
No. Security measures can reduce risk and make recovery easier, but no person, device or organisation can be guaranteed complete protection. Criminal methods change, software may contain unknown weaknesses, and people can be deceived even when they take reasonable precautions.
A more realistic goal is to reduce avoidable exposure, detect suspicious activity early, protect important accounts and data, and know how to respond when something goes wrong.
Final thoughts
Cybercrime includes a wide range of criminal activity, from unauthorised access to computer systems to fraud carried out through messages and websites. Understanding the difference between cyber-dependent and cyber-enabled crime makes the subject easier to follow.
Some risks are familiar, such as phishing and account takeover. Others, including SIM swapping, session-token theft, supply-chain attacks and MFA fatigue, show why account security involves more than choosing a strong password.
For everyday protection, use unique passwords, enable appropriate multi-factor authentication, keep software updated, verify unusual requests and maintain reliable backups. If an incident occurs, secure affected accounts, contact your bank when relevant, preserve evidence and use the correct reporting route.
Cybersecurity is not about assuming every message is dangerous. It is about recognising risk, checking before acting and knowing how to respond.
Sources and further reading
- Crown Prosecution Service — Cybercrime prosecution guidance
- Crown Prosecution Service — Cyber/online crime
- UK Government — National Cyber Security Strategy
- National Crime Agency — Cyber Choices
- Legislation.gov.uk — Computer Misuse Act 1990, Section 1
- Report Fraud — Reporting cybercrime and fraud
- National Cyber Security Centre — Data breaches
- Information Commissioner’s Office — Personal data breaches
- UK Government — Cyber Security Breaches Survey 2025–2026
Community discussion
Join the conversation
1 comment
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.