Warning for UK email users as scam reports hit record high
The National Cyber Security Centre (NCSC) over 13.4 million reports of suspicious emails, the highest since the service started in April 2020.
The data is included in the NCSC’s annual review for 2026 and forms part of its Suspicious Email Reporting Service (SERS), which allows the public and businesses to report suspicious emails to the NCSC.
The NCSC works with internet service providers, hosting companies and cyber security partners to improve the underlying security of the internet, reducing opportunities for cyber criminals to operate and making the UK safer online.
The security group said that the reports had led to the blocking of hundreds of thousands of scams, with 460,000 malicious URLs removed by the NCSC since 2020.
Its takedown service, which works with hosting providers to remove malicious websites, has disrupted over 1.6 million cyber-enabled commodity campaigns. The NCSC also took down 30,000 confirmed phishing attacks impersonating GOV.UK, removing them within a median of 90 minutes of detection.
Ona more positive note, the UK’s share of global phishing fell to 1.06% in June 2026, according to data from the NCSC’s takedown provider Netcraft. This is the lowest level since the service started in 2016, when the UK’s share stood above 5%.
The NCSC said most cyber attacks against individuals begin with the theft, compromise or abuse of passwords.
It officially recommended passkeys as the preferred login method for individuals in 2025. Passkeys replace passwords with cryptographic credentials stored on the user’s device.
“The UK enters 2027 at a watershed moment. Over the past decade, we have built world-class cyber security capabilities, established the NCSC as a trusted authority at home and abroad, and strengthened partnerships with government, industry and academia,” said said Richard Horne (CEO at the NCSC).
“Across Scotland, Wales and Northern Ireland, the NCSC expanded its engagement with devolved governments, helping public services, democratic institutions and critical national functions better understand cyber risk and make greater use of NCSC advice, services and expertise. We can be proud of that progress, and we must also be honest.
“The UK’s cyber resilience is not yet where it should be. The cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could – and should – be prevented.”
