Most UK small businesses leave email forgery unblocked, SaneChoice study finds

Only 11% of 400 UK small businesses tell email providers to block or quarantine forged messages sent in their name, according to new research from SaneChoice. The gap leaves customers more exposed to fake invoices and bank-detail scams at a time when invoice fraud losses are rising.

Why it matters: - Forged emails are a common way fake invoices and “new bank details” scams reach customers. - UK Finance says losses to invoice and mandate fraud hit £41.3 million in 2025, with about two-thirds coming from business accounts. - The government’s Cyber Security Breaches Survey 2026 found phishing was the most common attack, reported by 38% of UK businesses.

What happened: - SaneChoice reviewed the public email records of 400 UK small businesses on 26 October 2026. - The sample included 50 businesses from each of eight trades, including dentists, solicitors, cafés, garages and photographers. - The businesses were chosen at random from OpenStreetMap, and chains were removed. - No business was named in the study. - The full study, with charts and method, is available on the SaneChoice website as free-to-use research under CC BY 4.0 with credit to SaneChoice.

The details: - Only 44 of the 400 businesses, or 11%, have DMARC set to block or quarantine forged mail. - More than half, or 56%, have no DMARC record at all. - Another 33% have a DMARC record that only monitors activity. - More than one in five, or 22%, have neither DMARC nor a working SPF record. - Forty-six businesses do not use their website domain for email at all. - None of those 46 domains is locked against forgery. - SPF lists the servers allowed to send mail for a domain. - DKIM signs each message. - DMARC tells receiving servers whether to refuse, quarantine or ignore a message that fails SPF or DKIM checks. - Professional firms performed best in the study, but only 10 of 50, or 20%, had DMARC set to act. - Food and drink businesses performed worst, with just one of 50, or 2%, set to act. - Among the 121 businesses using Microsoft 365, 96% had a working SPF record. - Only 15% of those Microsoft 365 users had DMARC set to act.

Between the lines: - The pattern suggests many small businesses stop at the setup step their email provider prompts them to complete, but do not finish the stronger protection. - SaneChoice founder Bradley Porter said many small businesses have never been told DMARC exists, even though it is basic hygiene in larger firms. - Porter said the setting is “a few lines of text” that costs nothing and can tell the world to refuse forgeries instead of leaving the decision to each recipient’s spam filter.

What's next: - SaneChoice says small businesses can check their domain free with its email checker. - Businesses can ask their email provider or IT admin to add DMARC, begin with monitoring reports, then move to quarantine and reject. - Businesses that own domains they do not use for email can publish records that say so, which also helps lock those domains against forgery. - SaneChoice says its research and fact-checked articles are free to quote with credit.