Fraud & Cyber Crime
Action Fraud and NFIB referral routes, common fraud typologies, cyber crime basics, cryptocurrency evidence handling, the Computer Misuse Act 1990 offences, device seizure powers, and digital evidence preservation — an officer quick-reference.
Unofficial independent resource — always verify with official sources (College of Policing, your force, PFEW).
Reviewed by BlueLineHub Editorial
How should an officer refer a fraud or cyber crime report, and what are the key Computer Misuse Act 1990 and Fraud Act 2006 offences?
Fraud and cyber crime is reported to Action Fraud (actionfraud.police.uk or 0300 123 2040), the UK's national reporting centre operated by the City of London Police, which feeds intelligence to the National Fraud Intelligence Bureau (NFIB) for analysis and force dissemination. Victims should be advised to preserve evidence — emails, texts, bank statements, receipts — before reporting.
The core offences are Fraud Act 2006 s.1 (fraud, committed by false representation under s.2, failing to disclose information under s.3, or abuse of position under s.4; maximum 10 years on indictment), and the Computer Misuse Act 1990 offences: s.1 unauthorised access (either-way, maximum 2 years on indictment), s.2 unauthorised access with intent to commit a further offence (either-way, maximum 5 years), s.3 unauthorised acts impairing a computer such as malware, ransomware, or DDoS (either-way, maximum 10 years), and s.3ZA unauthorised acts causing or risking serious damage (maximum 14 years, or life where the damage is to human welfare or national security).
A reference to Action Fraud and NFIB referral, the common fraud typologies frontline officers encounter, cyber crime basics, cryptocurrency evidence handling, the Computer Misuse Act 1990 offences, device seizure powers, and preservation of digital evidence. It is educational reference, not investigative authority — always follow your force's cyber crime referral pathway and consult your RCCU before making significant investigative decisions.
Action Fraud: When to Refer and How
Action Fraud is the UK's national reporting centre for fraud and cyber crime, operated by the City of London Police. It feeds intelligence to the National Fraud Intelligence Bureau (NFIB), which analyses reports and disseminates packages to forces for investigation.
How to report: online at actionfraud.police.uk or by calling 0300 123 2040. Victims receive a police crime reference number. Officers should advise victims to keep all evidence (emails, texts, bank statements, receipts) before reporting.
NFIB intelligence: the NFIB identifies patterns across thousands of reports. A report that appears minor in isolation may link to an organised crime group targeting multiple victims across force boundaries. Always encourage reporting even when local investigation is unlikely.
When to Refer to Action Fraud
- Victim has suffered a financial loss through fraud or deception
- Attempted fraud where no loss occurred but a crime has been committed
- Cyber crime offences (hacking, malware, ransomware, online fraud)
- Business email compromise or mandate fraud
- Investment, romance, or advance fee fraud
Common Fraud Types
| Type | Pattern |
|---|---|
| Romance fraud | Online relationship develops quickly; suspect avoids video calls; claims to be overseas (military, oil rig, working abroad); requests money for emergency, travel, or investment. Victims are often isolated and deeply emotionally invested. Approach sensitively — victims frequently feel shame and may minimise the relationship. Refer to specialist support (Victim Support, local DA service if coercive control suspected). |
| Courier fraud | Suspect poses as a police officer or bank official, tells the victim their account is compromised, and instructs them to withdraw cash and hand it to a 'courier'. Victims are typically elderly. Officers should never ask members of the public to hand over cash or bank cards. If in doubt, call 999 on a different line to verify. |
| Mandate fraud | Fraudster impersonates a known supplier, contractor, or employer and requests a change to payment bank details. Businesses and charities are typical targets. Verify all payment detail changes by calling the organisation on a known, independently verified number. |
| Investment fraud | Promises of high returns on cryptocurrency, stocks, or property. Victims are directed to professional-looking websites or trading platforms that are fraudulent. Initial 'returns' are shown to encourage further investment before the platform disappears. Check the FCA register — if not listed, it is likely a scam. |
| Advance fee fraud | Victim is asked to pay a fee upfront to receive a larger sum (lottery wins, inheritances, business deals). The payment is taken and the promised sum never arrives. Also known as '419 fraud' from the Nigerian criminal code section. |
Courier Fraud — Officer Conduct
Do
- Reassure the victim that police never ask members of the public to withdraw cash or hand over bank cards
- If in doubt about a caller's identity, verify by calling 999 on a different line
Don't
- Never ask a member of the public to hand over cash or bank cards as part of a genuine police inquiry
Cyber Crime Basics
| Type | Detail |
|---|---|
| Phishing / Smishing / Vishing | Phishing: fraudulent emails impersonating banks, HMRC, delivery companies, or government bodies to steal credentials or install malware. Smishing: same technique via SMS text message. Vishing: voice calls — fraudster poses as a bank fraud team, HMRC, or police officer. Police will never ask for your PIN or bank card. |
| Ransomware | Malicious software that encrypts the victim's files and demands payment (usually cryptocurrency) for the decryption key. Businesses and public sector organisations are common targets. Do not advise victims to pay — payment does not guarantee recovery and funds further criminality. Refer to NCSC (National Cyber Security Centre) guidance. |
| Sextortion | Victim is induced to share intimate images or engage in sexual activity on camera. Suspect then demands money under threat of sharing images with contacts. If the victim is under 18, treat as child sexual exploitation — escalate immediately to PPIU/CAIT. For adults, assess vulnerability and safeguarding need. Do not advise paying — it invariably does not stop the demands. |
| Online harassment | Protection from Harassment Act 1997 covers a course of conduct. Communications Act 2003 s.127(1) (grossly offensive, indecent, obscene or menacing message) remains in force — only s.127(2) was repealed on 31 January 2024. Malicious Communications Act 1988 s.1 remains in force, narrowed. Online Safety Act 2023 s.179 (false communications) and s.181 (threatening communications, either-way, maximum 5 years) are new offences that came into force 31 January 2024, alongside these — not a wholesale replacement of them. Preserve evidence (screenshots with metadata, full URLs, account identifiers). Report to the platform and advise the victim to report to police — do not rely solely on platform action. |
Ransomware and Sextortion — Officer Conduct
Do
- Refer ransomware victims to NCSC (National Cyber Security Centre) guidance
- For sextortion involving a victim under 18, escalate immediately to PPIU/CAIT as child sexual exploitation
- For adult sextortion victims, assess vulnerability and safeguarding need
Don't
- Do not advise a ransomware victim to pay — payment does not guarantee recovery and funds further criminality
- Do not advise a sextortion victim to pay — it invariably does not stop the demands
Cryptocurrency: What Officers Need to Know
Cryptocurrency is increasingly involved in fraud, ransomware, and drug supply. Officers don't need to understand how to trade it — they need to know how to seize and preserve evidence.
Cryptocurrency — Key Terms
| Term | Meaning |
|---|---|
| Wallet | Software or hardware that stores cryptocurrency private keys (not the currency itself). |
| Private key / seed phrase | A string of words or characters that provides access to the wallet — this is the evidence. |
| Blockchain | A public ledger of all transactions — traceable by specialists even if the wallet is anonymous. |
| Exchange | Platforms like Coinbase, Binance — subject to financial regulations and can be compelled to disclose account holders. |
Cryptocurrency — On Seizure
- Do NOT attempt to access or transfer cryptocurrency without specialist authority — doing so may destroy the chain of evidence and create liability
- Hardware wallets (USB-style devices): seize as a digital device, photograph, bag, and submit to the Digital Forensics Unit
- Software wallets on a phone or computer: preserve the device and escalate to the DFU — do not open the app
- Exchange accounts: note the platform name, associated email address, and seek a production order for account records
- Seizure of cryptocurrency as proceeds of crime is possible under the Proceeds of Crime Act 2002 (cryptoasset seizure and forfeiture powers were added by the Economic Crime and Corporate Transparency Act 2023) — requires specialist legal advice and often NCA involvement
Computer Misuse Act 1990
The four CMA 1990 offences most relevant to frontline cyber crime referral.
| Section | Offence | Mode of trial / maximum |
|---|---|---|
| s.1 | Unauthorised access to computer material — causing a computer to perform any function with intent to secure access to any program or data without authorisation. Covers basic hacking, guessing passwords, using another person's login without permission. | Triable either-way — maximum 2 years on indictment (a fine or shorter term summarily). Made either-way by the Police and Justice Act 2006, in force 1 October 2008. |
| s.2 | Unauthorised access with intent to commit or facilitate commission of further offences — as s.1, but with intent to commit or facilitate a further offence (e.g. accessing a bank system to commit fraud, accessing a police database to commit perverting the course of justice). | Either-way — maximum 5 years on indictment. |
| s.3 | Unauthorised acts with intent to impair the operation of a computer — intentionally performing acts that impair a computer's operation, prevent or hinder access to programs or data, or impair the operation of such programs. Covers deploying malware, ransomware, DDoS attacks, and website defacement. | Either-way — maximum 10 years on indictment. |
| s.3ZA | Unauthorised acts causing, or creating risk of, serious damage — inserted by the Serious Crime Act 2015. | Indictable only — maximum 14 years, or life where the damage is to human welfare or national security. |
Fraud offences
| Section | Offence |
|---|---|
| s.1 Fraud Act 2006 | Fraud — committed by any of ss.2-4; maximum 10 years on indictment. |
| s.2 Fraud Act 2006 | Fraud by false representation. |
| s.3 Fraud Act 2006 | Fraud by failing to disclose information. |
| s.4 Fraud Act 2006 | Fraud by abuse of position. |
| s.6 Fraud Act 2006 | Possession etc. of articles for use in frauds. |
| s.7 Fraud Act 2006 | Making or supplying articles for use in frauds. |
Device Seizure Powers
Section 19 PACE 1984 — the primary power to seize articles on premises during a lawful search if there are reasonable grounds to believe they are evidence of an offence or were obtained through crime. Covers computers, phones, storage media, and related equipment.
Production orders (Schedule 1 PACE 1984, the 'Special Procedure') — used to compel third parties (banks, telecoms providers, tech companies) to produce specific material, on application by a constable to a circuit judge. Used for cloud data, phone records, financial records, and stored communications.
Consent — an alternative to a warrant where the device owner voluntarily agrees. Must be informed and genuinely voluntary. Get consent in writing where possible. Consent can be withdrawn — once material is examined, the position is more complex.
When to Escalate to the Digital Forensics Unit
- Any device that may contain significant evidence in a serious case
- Encrypted devices or those with unknown passwords
- Large volumes of devices (e.g. child abuse imagery investigations)
- Cryptocurrency hardware wallets
- Corporate network devices or servers
- Any device where you are unsure about the correct handling procedure
Continuity
- Label all devices with exhibit number, time and date of seizure, and the seizing officer's details
- Maintain continuity — every person who handles the device must be recorded
When to Escalate
| Route | Escalate for |
|---|---|
| Regional Cyber Crime Unit (RCCU) | Each region has an RCCU staffed by specialist cyber investigators. Escalate for: ransomware attacks on organisations, serious hacking, dark web investigations, complex network intrusions, cryptocurrency tracing, and cases requiring specialist forensic tools. |
| National Crime Agency (NCA) | Organised cyber crime groups, cases with international dimensions, high-value fraud exceeding force thresholds, attacks on critical national infrastructure, or cases with national security implications. |
| Action Fraud / NFIB | Fraud offences where the suspect is not immediately identifiable and the investigation will be intelligence-led. Also the referral route for all victims regardless of whether local investigation is ongoing. |
| Specialist labs | GCHQ/NCSC can assist with national security cyber incidents. Digital forensics companies contracted by forces handle specialist extraction requirements. Always seek authority before commissioning external forensic work. |
Related reading
Primary sources
BlueLineHub is independent and unofficial. Always verify with the authoritative source below.
- Verify on official source
Computer Misuse Act 1990, section 1 — unauthorised access to computer material
Triable either-way, maximum 2 years on indictment; made either-way by the Police and Justice Act 2006, in force 1 October 2008.
Last checked: August 2026 - Verify on official source
Computer Misuse Act 1990, section 2 — unauthorised access with intent to commit or facilitate commission of further offences
Either-way offence, maximum 5 years on indictment.
Last checked: August 2026 - Verify on official source
Computer Misuse Act 1990, section 3 — unauthorised acts with intent to impair, etc, operation of computer
Either-way offence, maximum 10 years on indictment; covers malware, ransomware, DDoS.
Last checked: August 2026 - Verify on official source
Computer Misuse Act 1990, section 3ZA — unauthorised acts causing, or creating risk of, serious damage
Indictable only; maximum 14 years, or life where damage is to human welfare or national security. Inserted by the Serious Crime Act 2015.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 1 — fraud
The offence of fraud, committed by any of ss.2-4; maximum 10 years on indictment.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 2 — fraud by false representation
One of the three ways of committing fraud under s.1.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 3 — fraud by failing to disclose information
One of the three ways of committing fraud under s.1.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 4 — fraud by abuse of position
One of the three ways of committing fraud under s.1.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 6 — possession etc. of articles for use in frauds
Possession offence used against fraud toolkits and equipment.
Last checked: August 2026 - Verify on official source
Fraud Act 2006, section 7 — making or supplying articles for use in frauds
Offence of making or supplying fraud tools.
Last checked: August 2026 - Verify on official source
Police and Criminal Evidence Act 1984, section 19 — general power of seizure
The primary power to seize devices on premises during a lawful search.
Last checked: August 2026 - Verify on official source
Police and Criminal Evidence Act 1984, Schedule 1 — special procedure
Production orders for special-procedure material, on application by a constable to a circuit judge — used to compel banks, telecoms providers, and tech companies to disclose material.
Last checked: August 2026 - Verify on official source
Proceeds of Crime Act 2002
Recovery framework for proceeds of crime; cryptoasset seizure and forfeiture powers were added by the Economic Crime and Corporate Transparency Act 2023.
Last checked: August 2026 - Verify on official source
Protection from Harassment Act 1997
Course-of-conduct harassment offences, applicable to sustained online harassment.
Last checked: August 2026 - Verify on official source
Communications Act 2003, section 127 — improper use of public electronic communications network
s.127(1) grossly offensive or menacing message offence — still in force; only s.127(2) was repealed on 31 January 2024.
Last checked: August 2026 - Verify on official source
Malicious Communications Act 1988, section 1 — offence of sending letters etc. with intent to cause distress or anxiety
Still in force, narrowed by later legislation.
Last checked: August 2026 - Verify on official source
Online Safety Act 2023, section 179 — false communications offence
New communications offence, in force 31 January 2024.
Last checked: August 2026 - Verify on official source
Online Safety Act 2023, section 181 — threatening communications offence
New communications offence, either-way, maximum 5 years, in force 31 January 2024.
Last checked: August 2026
Frequently asked
- How do I refer a fraud or cyber crime report to Action Fraud?
- Report online at actionfraud.police.uk or by calling 0300 123 2040. Action Fraud is the UK's national reporting centre, operated by the City of London Police, and feeds intelligence to the National Fraud Intelligence Bureau (NFIB) for analysis and force dissemination. Victims receive a police crime reference number and should be advised to keep all evidence (emails, texts, bank statements, receipts) before reporting.
- What are the Computer Misuse Act 1990 offences and their maximum sentences?
- s.1 unauthorised access to computer material is triable either-way, maximum 2 years on indictment. s.2 unauthorised access with intent to commit a further offence is either-way, maximum 5 years. s.3 unauthorised acts impairing a computer (malware, ransomware, DDoS) is either-way, maximum 10 years. s.3ZA unauthorised acts causing or risking serious damage, inserted by the Serious Crime Act 2015, carries a maximum of 14 years, or life where the damage is to human welfare or national security.
- How should a digital device be preserved at the point of seizure?
- Do not switch off a running computer, since volatile memory holds live evidence lost on power down. Do not guess passwords, since repeated failed attempts can trigger a lockout or data wipe. Photograph the screen before touching anything, note running processes, and use a Faraday bag for mobile phones to block remote wipe commands — or airplane mode if none is available, photographing the screen first. Label the device with exhibit number, seizure time and date, and seizing officer's details, and maintain continuity by recording every person who handles it.