Fake invoices sent as your domain: what actually stops them
The number
“Analysis by Report Fraud found that invoice fraud remains the most common type of Payment Diversion Fraud, accounting for 813 reports, or 22% of all cases received.”
Report Fraud (City of London Police), “Criminals steal £101 million through Payment Diversion Fraud…”, published 28 September 2026, covering the 2025/26 financial year: 3,657 Payment Diversion Fraud reports and more than £101 million lost. Read 30 Oct 2026.
Three ways a fake invoice reaches your customer
- Sent “from” your exact domain by someone else. DMARC at
p=reject(with SPF and DKIM working) tells receivers to turn this away. - Sent from a look-alike domain (one letter off). DMARC on your domain can’t stop this; your customers checking payment changes by phone can.
- Sent from a real mailbox that was taken over. The City of London Police warns criminals often use compromised email accounts (same source). DMARC passes these; strong passwords, multi-factor sign-in and a call-back rule for bank-detail changes are the controls.
How exposed UK domains are to number 1
Of 99,651 .uk domains with a gradable DNS answer, 58.7% publish no DMARC and 22.9% publish DMARC at p=none, which takes no action on fakes. Of 84,631 charity domains from the Charity Commission register, 51.6% publish no DMARC.
Source: FaultyPacket overnight UK scan of public DNS, 29 Oct 2026 22:48 – 30 Oct 2026 00:50 GMT (Tranco list ZJ8PG created 28 Oct 2026, .uk names plus the Charity Commission register (OGL v3) website field). Measured: DMARC and SPF. Percentages are of domains that gave a gradable DNS answer; failed lookups are excluded, never counted as missing. Aggregates only: no domain is named.
Fix number 1 safely
- Now:
v=DMARC1; p=none; rua=mailto:[email protected]. Same delivery as today, but you start getting reports of who sends as you. - After 2–4 weeks of clean reports (your shop, invoicing, newsletter and contact forms all passing):
p=quarantine. - After 2–4 more clean weeks:
p=reject. Only now do receivers turn away mail that pretends to be you.
Keep exactly one _dmarc TXT record. If one exists, edit it rather than adding a second; two records make receivers ignore DMARC.
Report Fraud’s own advice
Verify any request to move money to a new bank account using contact details you already hold, consider a small test payment first for large sums, and let only designated staff change payment details. If you have paid, contact your bank straight away and report it to Report Fraud.
Check your domain free before you buy
Run the free checker on your domain: no signup, no install, public DNS only.
Scan my domain free → £5 Launch Special — ends 30 Nov 2026 · Quick-Fix Pack →One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself. For order issues, reply to your PayPal receipt.
Frequently Asked Questions
Will DMARC stop all invoice fraud?
No. It stops mail forged with your exact domain. It does not stop look-alike domains or a hacked mailbox.
Is p=reject risky?
Only if you skip the ramp. Start at p=none with reports, check every real sender passes, then step up.
Related FaultyPacket guides & tools
Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.