How UK Cybercrime Investigations Work: From Reporting a Crime to Catching Criminals

When someone loses money to an online scam, discovers that their email account has been taken over or finds that a business has suffered a cyberattack, one question often follows: Can the police find out who did it?

Sometimes they can. But identifying a cybercriminal is rarely as simple as tracing an IP address or finding the name behind an online account. Investigators may need to connect internet records, account activity, messages, device evidence and financial transactions before they can establish who was responsible.

The process can involve local police forces, specialist regional teams, the National Crime Agency (NCA), the National Cyber Security Centre (NCSC) and law enforcement agencies in other countries. Each has a different role, and not every organisation will be involved in every case.

So what actually happens after someone reports a cybercrime? How do investigators follow the evidence, identify a suspect and build a case that can stand up in court?

1. The first step: reporting the cybercrime

For people in England, Wales and Northern Ireland, fraud and cybercrime can be reported through Report Fraud. The service replaced Action Fraud on 4 December 2025.

People in Scotland should report fraud and cybercrime to Police Scotland by calling 101. If a crime is happening now or someone is in immediate danger, call 999.

When making a report, the details matter. Investigators may need to know what happened, when it happened, how the victim was contacted, which accounts or devices were affected and whether money or personal information was taken.

For example, imagine someone receives a text message pretending to come from their bank. They follow a link, enter their login details and later discover that money has disappeared from their account.

Useful information could include the original message, the website address, the time it arrived, the account involved, payment references and any communication with the bank. These details can help investigators understand how the fraud happened and whether the same method has been used against other people.

However, making a report does not automatically mean that a full police investigation will begin.

2. What happens after a report is submitted?

When someone reports fraud or cybercrime through Report Fraud, the information is passed to the National Fraud Intelligence Bureau (NFIB).

The NFIB assesses whether the report contains enough information to pass it to the relevant police force or department. According to Report Fraud’s official guidance, decisions about whether to investigate can take up to 28 days.

There are different possible outcomes. A report may be passed to a police force for further action, or the victim may be told that no further investigation will take place.

That does not mean the information is necessarily useless. Reports can help authorities identify patterns, connect incidents and understand how criminals are targeting people across the UK.

Consider the bank-message example again. One report might not reveal who created the fraudulent website. But if other people report the same website, phone number, payment destination or approach, investigators may begin to see a wider pattern.

This is why reporting matters even when someone has lost only a small amount of money or believes the police will not be able to recover it.

Report Fraud also distinguishes between reporting a crime and reporting something suspicious. For example, someone who receives a suspicious message or website link but does not respond to it can still report it through the service’s reporting guidance.

3. Which UK agencies investigate cybercrime?

There is no single police team responsible for investigating every cybercrime in the UK. The organisation involved depends on the nature of the offence, its scale, the number of victims and the resources needed to investigate it.

Local police forces can investigate crimes affecting individuals and organisations in their areas. They may gather evidence, speak to victims and witnesses, and involve specialist officers when technical investigation is required.

Regional Organised Crime Units (ROCUs) provide specialist capabilities across police force boundaries. Their teams can support investigations involving organised criminals, multiple victims or more complex technical evidence.

The National Crime Agency (NCA) tackles serious and organised crime. Its National Cyber Crime Unit focuses on major cyber threats, investigates serious cases and works with local police, regional units and international partners. The NCA may lead an investigation when a case is particularly complex or nationally significant.

The National Cyber Security Centre (NCSC) has a different role. It is the UK’s technical authority for cyber security. It helps organisations understand and respond to serious cyber incidents, provides technical guidance and works with law enforcement where appropriate. It is not a replacement for reporting a crime to the police.

These organisations can work together. A local police force might receive information about an incident, a regional unit might provide specialist support, and the NCA might become involved if investigators discover a wider organised criminal network.

The government’s National Cyber Security Strategy describes the national, regional and local structure of the UK’s law enforcement response.

4. How investigators decide how serious a cyberattack is

Not every cyber incident has the same impact. Someone losing access to a personal email account is very different from an attack that disrupts a major public service or threatens essential infrastructure.

The NCSC and UK law enforcement use a framework with six categories to assess the severity and potential impact of cyber incidents. They range from a national-level crisis to a localised incident.

The category helps authorities assess the seriousness of an incident and decide which organisations should lead or support the response. For example, a localised incident affecting an individual may be handled by local police, while a major incident affecting essential services may require a much wider response involving the NCSC and law enforcement.

This is not an automatic guarantee of a criminal investigation. The framework helps determine the response to the incident; police must still assess the evidence and decide what investigative action is appropriate.

The NCSC’s guidance on categorising UK cyber incidents explains how the categories work.

5. How police begin tracing a cybercriminal

Once investigators have information to examine, they start building a picture of what happened.

They may look at suspicious emails, website addresses, login notifications, account activity, payment records and technical logs. In a business attack, they may also examine server records, security alerts and information showing how an intruder entered the network.

One detail that can appear during this process is an IP address. It can help investigators identify the internet connection associated with an online activity at a particular time. But an IP address does not automatically reveal the person responsible.

Think of it as finding the address of a building from which a message was sent. It may help investigators locate the connection, but it does not tell them who was using the computer or phone inside.

An internet connection may be shared by several people. A public Wi-Fi network may have many users. Criminals may also use VPNs, proxy services or compromised devices to make their activity harder to trace.

Investigators therefore need to connect the IP address with other evidence. Depending on the case, they may seek records from internet service providers, account registration details, login histories, communications, device information and financial records.

Timing is important too. Investigators must match records to the correct date, time and time zone. They may also need additional technical information to establish whether a particular person was using a connection at the relevant moment.

The aim is to build a reliable connection between the online activity and the person suspected of carrying it out. An IP address can be one part of that picture, but it is not proof of identity or guilt.

The Crown Prosecution Service’s cybercrime guidance explains the different types of digital and communications evidence that may be relevant to a case.

6. How digital forensics helps identify suspects

Digital forensics involves identifying, collecting, examining and analysing electronic information while preserving its integrity.

When police lawfully obtain a computer, phone, storage device or other equipment, specialist investigators may examine it for evidence connected to the suspected offence.

Depending on the case, this could include messages, emails, documents, photographs, browser history, account records, files, software and other information stored on the device.

The purpose is not simply to find something suspicious. Investigators need to understand where the information came from, when it was created or accessed, whether it has been changed and how it relates to the alleged crime.

Evidence must also be handled carefully. Digital information can be altered, deleted or affected by normal use. Investigators need to preserve relevant material and record how it was obtained and examined so that it can be properly assessed later.

Finding suspicious material on a device does not automatically prove that its owner committed a crime. The device may be shared, compromised or used by someone else. Investigators must establish who was responsible for the relevant activity.

A real UK example: the Transport for London cyberattack

The investigation into the 2024 cyberattack on Transport for London (TfL) shows how digital evidence can help connect online activity to individuals.

The attack disrupted TfL systems and affected services used by the public. The NCA and City of London Police investigated two men, Owen Flowers and Thalha Jubair, with support from the West Midlands Regional Organised Crime Unit and British Transport Police.

During the investigation, officers found computers, hard drives and USB devices at Flowers’s home. One laptop contained a screenshot showing network connectivity to TfL infrastructure. It also held videos recorded by Flowers showing Jubair accessing TfL systems during the attack.

Investigators examined messages exchanged between the two men on Telegram and communications through an online collaboration tool. The investigation also involved evidence obtained through international cooperation.

These were not isolated technical clues. Investigators brought together device evidence, communications and information from other sources to establish the involvement of the two defendants.

Both men pleaded guilty. On 16 July 2026, they were each sentenced to five years and six months in prison.

The case demonstrates why digital investigations involve more than identifying an internet connection. Devices and communications can help investigators establish what happened, who was involved and how different people contributed to an attack.

Read the NCA’s account of the investigation and its sentencing announcement.

7. How investigators follow stolen money and cryptocurrency

Financial evidence can be just as important as technical evidence, particularly when a cybercrime involves stolen money, extortion or money laundering.

Investigators may examine bank transfers, payment accounts, card transactions and records held by financial institutions. These can help establish where money went, which accounts received it and whether separate transactions are connected.

Cryptocurrency can make this process more complicated, but it does not automatically make criminal money impossible to trace.

Many public blockchains record transactions in a way that allows investigators to follow the movement of funds between wallet addresses. However, a wallet address is not the same as a person’s identity. Investigators need additional evidence to establish who controlled the wallet.

That evidence may come from cryptocurrency exchanges, account records, devices, communications or financial information. If an exchange or service provider is based overseas, investigators may need help from authorities in that country to obtain relevant records.

The UK investigation involving 61,000 Bitcoin

A major Metropolitan Police investigation demonstrates how financial evidence and cryptocurrency tracing can be used to pursue suspected criminal assets.

The case concerned Zhimin Qian, who was involved in a large investment fraud in China between 2014 and 2017. More than 128,000 people were defrauded, with losses reported at around £600 million.

According to the Crown Prosecution Service, Qian converted part of the proceeds into Bitcoin and fled to the UK. Police became aware of her activities after she attempted to buy a multimillion-pound property in London.

A police investigation led to the seizure of electronic devices, which revealed cryptocurrency wallet information. Investigators also followed financial and asset-related leads across different locations. In one part of the investigation, a dormant cryptocurrency wallet made a sudden transaction worth approximately £1.5 million, which police traced to an address in York.

The Metropolitan Police seized approximately 61,000 Bitcoin during the investigation. Qian pleaded guilty to acquiring and possessing criminal property, while Seng Hok Ling pleaded guilty to transferring criminal property. Both were sentenced in November 2025.

This was a money-laundering case linked to an overseas investment fraud, not a computer-hacking case. Its relevance is the way investigators combined cryptocurrency records, devices, financial enquiries and international cooperation to pursue assets believed to have come from crime.

It also illustrates an important distinction: blockchain records can show where cryptocurrency moved, but investigators need other evidence to establish who controlled it and whether it represents criminal property.

Read the CPS account of the cryptocurrency investigation and the Metropolitan Police announcement.

8. What happens when evidence is held overseas?

Cybercrime often crosses national borders. A victim may be in the UK, the suspect may be in another country, and the records needed for an investigation may be held by a company somewhere else.

UK police cannot simply use all their domestic powers in another country. They may need assistance from that country’s police, prosecutors or courts.

Some information can be requested through police-to-police cooperation. In other situations, investigators may need to use Mutual Legal Assistance (MLA).

MLA is a formal process through which one country asks another to help obtain evidence for a criminal investigation or prosecution. It may be needed when the requested evidence requires legal powers that cannot be exercised through informal cooperation.

For example, imagine investigators are examining an online account believed to have been used to coordinate an attack against a UK business. The company that holds the account records is based overseas.

Police may first explore whether the information can be obtained through an appropriate cooperation channel. If the request requires formal legal authority, the UK may need to submit an MLA request. The authorities in the other country then consider the request under their own laws and procedures.

This can take time. The foreign authorities may need to check the request, obtain legal authorisation and secure the relevant records. The process depends on the type of evidence, the country involved and the legal route available.

It is important to understand that MLA is not required for every overseas enquiry. The CPS says police-to-police cooperation can often be used, while formal assistance is necessary in other circumstances. Investigators are encouraged to consider overseas evidence early because delays can affect the progress of a case.

The CPS international cooperation guidance and the Home Office’s MLA guidance explain how this works.

9. How international police operations disrupt cybercriminal networks

Some investigations become much larger than a single victim or suspect. When authorities identify a criminal network responsible for attacks in several countries, they may coordinate arrests, searches, infrastructure seizures and financial investigations.

One example is Operation KillSwitch, an international investigation into the alleged ransomware group KillSec.

On 30 September 2026, law enforcement took control of the group’s leak site, which had been used to threaten organisations with the publication of stolen information unless they paid a ransom.

Europol reported that the investigation concerned around 1,000 suspected attacks worldwide. Around 500 had been identified as successful at the time of its announcement. The operation involved authorities from several countries, including the UK, and was led by German investigators.

Three suspects were provisionally arrested and eight properties were searched across Greece, Romania, Spain and the UK. Five central servers were brought under law enforcement control, and authorities targeted suspected criminal proceeds, including cryptocurrency.

The Eastern Region Special Operations Unit (ERSOU) confirmed that its Cyber Crime Unit took part in the operation. It also reported that the investigation included 28 victim companies in the UK.

The operation shows how international investigations can target more than the people suspected of carrying out attacks. Authorities can also work to disrupt the servers, websites and other infrastructure used by criminal groups, while examining seized information for further evidence.

However, arrests do not establish guilt. The suspects remain subject to the criminal justice process, and investigators may continue examining evidence after an operation has taken place.

Read ERSOU’s announcement about the operation and Europol’s account of Operation KillSwitch.

10. Why some cybercriminals are never identified or caught

Even when investigators have technical information, identifying the person responsible can be difficult.

Criminals may use stolen identities, compromised devices, VPNs, proxy services or accounts registered using someone else’s details. A person whose internet connection appears in an investigation may be an innocent victim whose device was taken over.

Evidence may also be incomplete. A service provider may no longer hold the relevant records, a server may be outside the UK’s jurisdiction, or investigators may be unable to establish who controlled an account at the time of the offence.

There is also a difference between identifying a suspicious account and proving that a particular person committed a crime. Investigators must build evidence that connects the person to the relevant activity and supports the alleged offence.

A case may therefore produce useful intelligence without reaching the standard required for prosecution. That does not mean the report had no value. Information from one incident may help authorities connect other cases, identify a wider pattern or prevent further victims from being targeted.

11. What happens after police identify a suspect?

Identifying a possible suspect does not mean the investigation is finished.

Police may need to gather further evidence, interview witnesses, examine devices, obtain records from service providers and trace financial activity. They must establish whether the available evidence supports an arrest and whether there is enough evidence for a charge.

An arrest is not a conviction. A person remains entitled to due process, and the prosecution must prove the case in court.

In England and Wales, the Crown Prosecution Service (CPS) may review the evidence and decide whether a prosecution should proceed. Prosecutors consider whether there is a realistic prospect of conviction and whether prosecution is in the public interest.

The legal arrangements differ across the UK. Scotland has its own prosecution system, led by the Crown Office and Procurator Fiscal Service. Northern Ireland has a separate Public Prosecution Service.

If a case reaches court, digital evidence may need to be explained by specialists. The court must be able to understand what the evidence shows, how it was obtained and how it relates to the charges.

The CPS explains how it assesses cybercrime cases in its cybercrime prosecution guidance.

12. What victims should do to help an investigation

Victims do not need to understand digital forensics to provide useful information. But preserving the details of an incident can help investigators understand what happened and identify possible lines of enquiry.

Where to report a cybercrime in the UK

The correct reporting route depends on where you are and what has happened.

• England, Wales and Northern Ireland: Report fraud or cybercrime through Report Fraud. Its online reporting service is available at any time. If you prefer to report by phone, the official reporting guide lists the core telephone reporting hours as Monday to Friday, 8am–8pm. The contact page notes that telephone agents may also be available outside those hours, although availability is reduced between 8pm and 8am.
• Scotland: Contact Police Scotland on 101. If a crime is happening now or someone is in immediate danger, call 999.
• Businesses, charities and other organisations experiencing a live cyberattack: Call Report Fraud on 0300 123 2040 immediately. Its specialist live-attack reporting service is available 24 hours a day, seven days a week. This route is for organisations currently experiencing an attack, not routine individual reports.
• Organisations reporting a cyber incident to the NCSC: Use the NCSC Cyber Incident Signposting Service. Reports are monitored around the clock and may be shared with law enforcement partners, including the NCA, to help identify investigation and mitigation opportunities. Do not complete the form using a network you believe has been compromised.

An NCSC report does not fulfil separate legal or regulatory reporting duties. If personal data has been affected, an organisation should separately assess whether it must notify the Information Commissioner’s Office (ICO) or another regulator.

If you have lost money, contact your bank or payment provider immediately as well. Reporting a crime does not automatically stop a payment or secure a compromised account.

The official Report Fraud contact page, reporting guide and NCSC reporting service explain these routes and their limitations.

Preserve information that could help investigators

If you have been affected by cybercrime:

• Keep the original evidence. Save suspicious emails, messages, website addresses, phone numbers, transaction references and screenshots. Record dates and times, including the time zone if known.
• Contact your bank or payment provider quickly if money or payment details may have been compromised. Ask them to secure affected accounts and check whether a payment can be stopped or recalled.
• Avoid deleting or resetting a potentially affected device before considering the evidence. If you think it has been compromised, seek trusted technical advice about securing it while preserving information that may be relevant.
• Use a separate trusted device to change passwords and secure important accounts if you believe your usual device may be compromised. Enable multi-factor authentication where available.
• Do not contact the suspected criminal or try to investigate them yourself. This could expose you to further harm or interfere with evidence.

So, can UK police actually catch cybercriminals?

Yes, but it depends on the evidence available and whether investigators can connect the online activity to the people responsible.

A report can provide the starting point. Account records and IP information may help identify where activity came from. Digital forensics can reveal communications and activity on devices. Financial investigations can follow suspected criminal proceeds. International cooperation can help obtain evidence held overseas and disrupt networks operating across borders.

The Transport for London investigation shows how device evidence, messages and information obtained through cooperation helped investigators identify two people who were later convicted and imprisoned. The KillSec operation shows how authorities can coordinate across countries to target suspected offenders and the infrastructure they use.

Neither example means every cybercrime will be solved. Some investigations do not identify a suspect, and others may not produce enough admissible evidence for a prosecution.

But reporting still matters. Information from one victim can help authorities recognise a pattern, connect separate incidents and build a clearer picture of criminal activity.

The key to catching a cybercriminal is not one IP address, one suspicious account or one technical clue. It is the ability to connect reliable evidence, establish who was responsible and prove that connection through the criminal justice system.