By Jamie Akhtar, CEO and Co-founder, CyberSmart
Investors were told they could buy fine wine, leave it securely stored and sell it later at a profit. If they preferred, the bottles could be delivered to their home.
Some had responded to social media adverts. Others had been contacted directly. A broker explained the arrangement, and money changed hands.
Then the problems began. Brokers became unreachable. Investors were told their wine was missing or inaccessible, or that the company had ceased trading. Some later heard from law enforcement that the operation was under investigation.
The first Report Fraud Annual Assessment identifies 401 reports linked to this unnamed wine investment company, with £23 million in reported losses. The average loss was £62,093.
The case captures the central message running through the assessment. Modern fraud often succeeds by resembling ordinary life and business: an investment held in storage, an invoice from a supplier, a message from a colleague or an endorsement from a familiar public figure. Technology helps criminals create that appearance at greater speed and scale.
The First Assessment From a New National Service
Published on 3 September 2026, the first Report Fraud Annual Assessment examines reports from 2025/26. Report Fraud replaced Action Fraud across England, Wales and Northern Ireland, bringing fraud and cyber-crime reporting into one national service.
Changes to reporting methods and data sources mean comparisons with 2024/25 need caution.
The headline figures show why that qualification matters. Report Fraud recorded 503,288 fraud reports, a 50% annual increase. Most of that rise came from the inclusion of Cifas data. Excluding Cifas, reports increased by 6%, from 336,207 to 356,073.
Reported fraud losses still rose by 26% to £3.2 billion. Cifas reports contained no loss figures, so the additional data source does not explain that increase. These remain self-reported losses, however, and the assessment excludes cryptocurrency losses from its financial totals.
Fraud Increasingly Creates a Reason to Trust
Investment fraud accounted for 36,464 reports and £911 million in reported losses. Report volumes rose by 37% and losses by 20%, while the average loss fell by 13% to £28,188. More people appear to be losing money, even though the average amount lost by each victim has declined.
The wine case shows why investment fraud can remain hidden: storage and delayed returns were part of the proposition, so waiting did not initially look unusual.
Artificial intelligence can make the supporting evidence more convincing. The assessment found 956 reports in which the victim identified suspected AI use, a four-fold increase up from 193 the previous year. Reported losses associated with these cases rose from £1.2 million to £9.6 million.
Investment fraud made up 37% of these AI-related reports. Methods included generated videos of celebrities and public figures apparently endorsing investments, manipulated images, cloned voices and real-time video impersonation. The report is careful about what these figures prove: victims may fail to recognise AI, while greater public awareness may itself increase reporting. The true prevalence remains unknown.
A Trusted Account Can Be More Useful Than a Fake One
The same pattern appears in fraud against businesses. Taking control of a real account gives a criminal an identity that colleagues, customers and suppliers already trust.
Report Fraud received 2,271 cyber-crime reports from organisations. Hacking of email, social media and other online accounts made up 55% of them. Phishing and social engineering were the most commonly reported routes into organisations.
Access to a supplier’s email account can give a criminal genuine correspondence, names, writing styles and the timing of an expected payment. A request to change bank details then arrives inside a real conversation rather than as an obvious approach from a stranger.
The assessment recorded 3,657 reports of payment diversion fraud, with losses of £101 million. Invoice fraud was its largest subcategory. It also found attempts to change the destination accounts used by hotel, restaurant and ordering platforms, allowing criminals to divert payments at source.
Payment diversion losses fell by 24%, despite a 3% rise in reports.
Controls that check where money is going appear to be helping. They are less effective when the recipient is correctly identified but the underlying product, investment or relationship is false.
Account Protection Needs Payment Controls
SMEs accounted for 62% of organisational cyber-crime reports where size was recorded. But as SMEs make up 99% of UK organisations, this does not show they were disproportionately targeted.
It does show that the threat reaches ordinary businesses. Smaller firms often depend on a limited number of people to manage email, suppliers, payments and IT. A compromised account or convincing request can cross several of those functions at once.
The assessment recommends Cyber Essentials for SMEs to reduce common routes into business systems. It also recommends phishing-resistant passkeys or, where unavailable, strong unique passwords and two-step verification for important accounts.
Those technical measures need matching business controls. Changes to supplier or customer payment details should be checked through contact information already held, independently of the request. Unusual transactions should receive a meaningful second approval. Staff should be able to pause a payment without being blamed for slowing the business down.
The wine investors were given an asset, a broker and a plausible reason to wait. Businesses encounter similar chains of trust every day.
The practical response is to protect the accounts through which trust is communicated, then verify the evidence before money or access changes hands. As fraud becomes better at looking ordinary, that independent check becomes one of the few signals a criminal cannot manufacture alone.
Latest News
