Reporting Cyber Crimes in the UK
A clear guide to reporting cyber crime, data breaches and suspicious activity in the UK.
How to report cyber crime in the UK
Cyber crime is not something to sit on and hope goes away. Knowing who to contact, when to report, and what needs escalating can make a bad situation less costly and less chaotic.
This page gives you a practical overview of the main UK organisations involved in reporting cyber incidents, fraud, data breaches and urgent threats, with guidance that aligns with UK data protection law and UK GDPR obligations.
Most businesses don’t get this wrong because they’re careless. They get it wrong because nobody has shown them what “right” looks like.
Report Fraud
Report Fraud is the UK’s reporting service for fraud and cyber crime. If you are a business, charity or individual dealing with fraud, account compromise, phishing-related loss or another cyber-enabled crime, this is usually your first reporting route unless there is an immediate emergency.
- Website: reportfraud.police.uk
- Phone: 0300 123 2040
- Online reporting: Available through the website
- Live cyber attack in progress: Businesses, charities and organisations should call immediately
National Cyber Security Centre
The NCSC helps organisations respond to significant cyber incidents and improve their resilience. It also provides guidance, technical advice and reporting routes for serious incidents affecting organisations and services.
- Website: ncsc.gov.uk
- Report an incident: report.ncsc.gov.uk
- Best for: Significant incidents, serious compromise, operational disruption and national-interest concerns
Information Commissioner’s Office
If a cyber incident leads to a personal data breach, you may need to report it to the ICO. If the breach is notifiable, this must be done without undue delay and, where feasible, within 72 hours of becoming aware of it.
- Website: ico.org.uk
- Phone: 0303 123 1113
- Report a breach: Online through the ICO website
- Important: Keep a record even if you later decide the breach is not reportable
Police and emergency services
If there is an immediate threat to life, a crime in progress, serious safety concerns or urgent operational risk, contact the police straight away. Do not rely on online forms if the situation is actively unfolding.
- Emergency: 999
- Non-emergency: 101
- Use this route for: Immediate danger, urgent disruption, extortion threats or other fast-moving incidents
Your bank or financial provider
If payments, banking details, card details or account access may be involved, contact your bank or provider immediately. Speed matters here. They may be able to freeze accounts, stop payments or flag suspicious activity before more damage is done.
- Banking fraud helpline: 159
- Also do this: Contact your bank using its official number or app if you already have it
- Best for: Authorised push payment fraud, suspicious transfers, fake bank calls, compromised banking access
Your cyber insurance provider
If you have cyber insurance, notify your insurer as soon as possible. Most policies include specific incident response conditions, emergency contacts and approved response partners. Delays can make recovery harder and may affect cover.
- Check: Policy wording, breach hotlines and incident response terms
- Have ready: Policy number, timeline of events, affected systems and who has already been notified
- Tip: Do not wait until you have every answer before making first contact
Why prompt reporting matters
Fast reporting gives you a better chance of limiting damage. That might mean freezing fraudulent payments, isolating affected accounts, starting breach response sooner, or making sure legal and regulatory deadlines are not missed.
It also helps investigators build a clearer picture of what is happening across the UK, which improves intelligence, disruption and wider protection for other organisations.
Before you report
Keep notes on what happened, when you noticed it, which systems or accounts are affected, what data may be involved, and what actions have already been taken. This will make reporting faster and more accurate.
Do not start deleting evidence, wiping devices or guessing your way through recovery. Preserve logs, emails, screenshots and timelines where possible.
Contain the issue
Disable compromised accounts, disconnect affected devices if needed, and stop further access or loss where you safely can.
Notify the right people
Contact Report Fraud, the ICO, your bank, insurer or the police depending on what has happened.
Document everything
Keep timestamps, screenshots, copies of messages, affected usernames, IP addresses and actions taken.
Get proper support
Bring in cyber security help early if you need containment, triage, evidence preservation or advice on next steps.
Need help making sense of what to do next?
If you are dealing with a suspicious login, phishing incident, Microsoft 365 compromise, ransomware concern or possible data breach, we can help you get clearer on the immediate priorities and where the real risk sits.
Contact usFAQs: Reporting Cyber Crimes in the UK
What is cyber crime?
Cyber crime refers to illegal activities carried out using computers, networks, or the internet. Common examples include phishing, ransomware attacks, identity theft and online fraud.
Who should I contact first if my business experiences cybercrime?
Start by reporting the incident to Report Fraud, the UK’s national reporting centre for cyber crime and fraud. If personal data is involved, you must also notify the Information Commissioner’s Office (ICO) within 72 hours to comply with GDPR.
When should I contact the police directly?
Contact the police directly in the following scenarios:
- There is an immediate threat to life or property.
- The incident involves significant financial loss or a critical disruption to operations.
- Dial 999 for emergencies or 101 for non-urgent cases.
What happens after I report a cyber crime to Report Fraud?
Action Fraud reviews your report and passes it to the National Fraud Intelligence Bureau (NFIB) if it meets specific criteria for investigation. They may contact you for additional information.
Do I need to report data breaches caused by cyber crime to the ICO?
Yes. If personal data is compromised during a cyber attack, UK organisations must report the breach to the ICO within 72 hours of becoming aware of it. Failure to report can result in penalties under GDPR.
How can the NCSC help my business after a cyber incident?
The National Cyber Security Centre (NCSC) provides guidance, tools, and resources to manage incidents and prevent future attacks. While they do not accept direct reports of cybercrime, they can support organisations dealing with major incidents.
My business has cyber insurance - should I report the incident to my provider?
Yes, contact your cyber insurance provider as soon as possible. They will help assess the impact, guide you through the claims process and may cover certain recovery costs depending on your policy.
How can I protect my business from future cyber crime?
Implement robust cyber security measures, including:
- Regularly updating software and systems.
- Using multi-factor authentication (MFA).
- Training staff to recognise phishing and other threats.
- Backing up data securely.
Explore our Cyber Security Solutions for tailored advice and services.
Is it mandatory to report all cyber crime incidents?
Not all incidents are legally required to be reported. However, reporting helps authorities understand cyber crime trends and may assist in catching offenders. Incidents involving personal data breaches must be reported to the ICO under GDPR.
Can I report cyber crime anonymously?
Yes, Report Fraud allows anonymous reporting. However, providing your contact details can help authorities if further investigation is needed.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!