Nine in Ten UK Small Businesses Don't Stop Forged Email, New Research Finds

Only 44 of 400 UK small businesses tell email providers to block messages forged in their name, as invoice fraud cost UK victims £41.3m in 2025.

CHELMSFORD, ESSEX, UNITED KINGDOM, November 2, 2026 /EINPresswire.com/ -- Only 11% of UK small businesses tell email providers to block or quarantine messages forged in their name, according to new research from SaneChoice. The rest leave the decision to each recipient's spam filter, which means a fake invoice sent "from" a local business may still reach its customers' inboxes.

SaneChoice read the public email records of 400 small businesses, 50 from each of eight trades, from dentists and solicitors to cafés, garages and photographers. They were chosen at random from OpenStreetMap, with chains removed, and checked on 26 October 2026. No business is named. The full study, with charts and method, is on the SaneChoice website, and its figures are free to use under CC BY 4.0 with a credit to SaneChoice.

The record most businesses have never set up

Three public records decide what happens to an email that claims to come from a business. SPF lists the servers allowed to send its mail, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails those checks: refuse it, put it in spam, or do nothing.

- Only 44 of the 400 (11%) have DMARC set to block or quarantine forged mail.
- More than half (56%) have no DMARC record at all, and a further 33% have one that only watches.
- More than one in five (22%) have neither DMARC nor an SPF record that works.
- 46 businesses don't use their website's domain for email at all, and not one of those domains is locked against forgery.

Every trade falls short

Professional firms do best, and even then only 10 in 50 (20%) have DMARC set to act. Food and drink does worst: one in 50 (2%).

The step the provider asks for gets done

The 121 businesses using Microsoft 365 show why. 96% have a working SPF record, the step Microsoft's setup asks for, but only 15% have DMARC set to act, a step it only offers.

Why it matters

A forged email is how a fake invoice or a "new bank details" message arrives. UK Finance puts losses to invoice and mandate fraud at £41.3 million in 2025, about two-thirds of it from business accounts. In the government's Cyber Security Breaches Survey 2026, phishing was by far the most common attack, reported by 38% of UK businesses.

Bradley Porter, founder of SaneChoice, who has spent more than 25 years in technology across investment banks, brokerages, hedge funds and consultancies, said:

"In the firms I've worked in, this record is basic hygiene, because everyone has seen what a forged invoice costs. Most small businesses have never been told it exists. It's a few lines of text in your domain's settings, it costs nothing, and it's the difference between telling the world to refuse a forgery in your name and leaving every customer's spam filter to guess."

What small businesses can do

- Check your domain free with SaneChoice's email checker, which shows in seconds whether your records tell receivers to block forgeries.
- Ask whoever runs your email to add a DMARC record, start by watching the reports it sends, then move to quarantine and reject.
- If you own a domain you don't send email from, publish records that say so, so it's locked against forgery too.

About SaneChoice: SaneChoice Limited gives UK small businesses the technology large companies run on, without the enterprise cost: websites designed and hosted, domain names, business email and security, through one company and one phone number. Founded in 2004 and based in Chelmsford, Essex, it publishes original research and fact-checked articles on small business technology, free to quote with a credit.

Bradley Porter
SaneChoice Limited
+44 1277 715 120
press@sanechoice.cloud