Pipefire Study Finds 83% of Small Businesses in the UK and US Can Be Impersonated by Email

New research from Pipefire checked the email security records of 9,338 small businesses across 12 trades in 20 UK and US cities. 83.3% can be impersonated by email, half have no protection at all, and hair salons, plumbers and roofers are the most exposed. Cardiff is the most exposed UK city.
PARIS, FRANCE - October 20, 2026 - New research from Pipefire has found that 83% of small businesses in the UK and US can be impersonated by email. Anyone can send a message that appears to come from their real address.

Pipefire checked the public email security records of 9,338 local businesses across 12 trades in 20 cities. Only 16.7% had set up their domain to stop fake emails sent in their name. Half (50.9%) had no protection in place at all.

Key findings

- 83.3% of small businesses can be impersonated by email (UK 83.9%, US 82.6%).- 50.9% have no working DMARC record, the setting that tells email providers what to do with fake messages.- 32.4% have a record set to "monitor only", which reports fake emails but still delivers them.- 7.2% block fake emails outright. A further 9.5% send them to spam.- 76.9% of the 14,201 US marketing and web agencies checked, the firms that often set up email for small businesses, can also be impersonated.

Most exposed trades

Hair salons are the most exposed trade, at 92.1%, followed by plumbers (89.1%), roofing contractors (87.8%), dentists (86.6%) and electricians (86.5%). In the UK, roofing contractors (90.5%), plumbers (90.4%) and builders (89.3%) are close to nine in ten.

Law firms are the best protected, at 68.8%. Even so, more than two in three law firms could still have their email address used by fraudsters.

UK cities

- Cardiff: 89.9%, the most exposed UK city

- London: 86.5%

- Glasgow: 85.7%

- Belfast: 84.2%

- Manchester: 84.0%

- Leeds: 83.8%

- Bristol: 83.6%

- Liverpool: 82.2%

- Birmingham: 81.8%

- Edinburgh: 77.6%, the least exposed

In the US, Los Angeles (86.4%) and New York (85.6%) are the most exposed cities, and Denver (78.8%) the least.

Why it matters

Fake emails are the most common attack small firms face. The UK government's Cyber Security Breaches Survey 2025/2026 found that 38% of businesses identified a phishing attack in the past year. In the US, the FBI's 2025 Internet Crime Report recorded $3.05 billion in losses to business email compromise.

Without the right setting, a fraudster can send a fake invoice or a "new bank details" request that appears to come from a business's own address. Customers have no easy way to tell it is fake.

Mike Lovatt, founder of Pipefire, said:

"Most small business owners have no idea this is possible. A plumber or a hair salon can send a customer an invoice, and a fraudster can send the same customer a fake one from the exact same address. The fix is free. Only one business in six has done it."

What businesses can do

The protection is called DMARC: a short public record added to a business's domain settings. It costs nothing. Pipefire recommends three steps:

1. Check the domain with a free tool, such as Pipefire's DMARC checker [https://pipefire.ai/tools/dmarc-checker].

2. Publish a DMARC record set to monitor, with reports turned on.

3. Once the reports show only the business's own services sending email, change the setting to "quarantine" or "reject" so fake emails are stopped.

Notes to editors

Full results, charts and methodology: https://pipefire.ai/cold-email/small-business-email-security-statistics

Using the figures: charts and figures are free to use with credit to Pipefire. A link to the page is appreciated.

Method: in October 2026, Pipefire checked the public DNS records (MX, SPF and DMARC) of 9,338 small businesses with working email. The sample covered 12 trades in 10 UK cities and 10 US cities. Chains, government and education sites, and businesses without a website were excluded. The agency figures come from a separate sample of 14,201 US agency domains drawn from Pipefire's own prospect research, so they are not a random sample of agencies.

Definition: "Can be impersonated" means the domain has no DMARC record, a broken record, or a policy of "none".

More data: a breakdown by trade, city and email provider (Google Workspace, Microsoft 365 or other) is available on request.

About Pipefire

Pipefire is a done-for-you cold email service for small businesses and agencies. It sets up and protects sending domains, finds and verifies prospects, writes the emails and sends them, and the customer approves every message. Pipefire is run by M&B Marketing SARL. https://pipefire.ai

Media Contact
Company Name: M & B Marketing
Contact Person: Mike Lovatt
Email:Send Email [https://www.abnewswire.com/email_contact_us.php?pr=pipefire-study-finds-83-of-small-businesses-in-the-uk-and-us-can-be-impersonated-by-email]
Phone: 0787463175
Address:34 avenue des Champs Elysees
City: Paris
Country: France
Website: https://www.mandbmarketing.com

Legal Disclaimer: Information contained on this page is provided by an independent third-party content provider. ABNewswire makes no warranties or responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you are affiliated with this article or have any complaints or copyright issues related to this article and would like it to be removed, please contact retract@swscontact.com



This release was published on openPR.