One in five of the biggest retailers in the UK, US and Canada can be impersonated by email. We checked the public email records of 233 retailer domains, plus 23 parcel carrier and 15 marketplace and payment domains, on 1 November 2026. 20.2% of the retailers have no DMARC enforcement. That means a fake "your order" or "your Black Friday deal" email can go out from their real address and still reach the inbox.
Canada's retailers are the most exposed: 29.2% can be impersonated, against 19.3% in the UK and 16.0% in the US. The online marketplaces and payment services do best. Every one of the 15 marketplace and payment domains we checked blocks fake email or sends it to spam.
This is original Pipefire research. You are free to use any figure or chart on this page. Please link to this page as the source.
Key statistics
- 20.2% of big retailer domains can be impersonated by email (47 of 233).
- 29.2% of Canada's big retailers can be impersonated, against 19.3% in the UK and 16.0% in the US.
- 17.4% of parcel carrier domains can be impersonated (4 of 23), the kind of brand a "missed delivery" scam copies.
- 0.0% of marketplace and payment domains can be impersonated. All 15 enforce DMARC.
- 19.0% of all 269 brand domains can be impersonated. Almost all of these have a DMARC record but leave it on "monitor only".
- 61.0% of all the brand domains block fake email outright (p=reject).
- Big brands are far better protected than small firms. In our small business email security study, 83.3% of 9,338 local businesses could be impersonated.
Why it matters before Black Friday
Shopping scams peak in the run-up to Black Friday and Christmas, and many of them start with an email that copies a brand the shopper already uses. On 30 October 2026, Report Fraud, the UK's national fraud reporting service, warned that criminals had stolen £86,837 in nine days by posing as Amazon. It received 110 reports between 5 and 14 October, and people aged 50 to 79 made up 60% of them (City of London Police).
DMARC cannot stop every scam. A criminal can still phone, text, or register a lookalike domain. But it does stop the most convincing version: an email that shows the brand's own real address in the From line. A brand without DMARC enforcement leaves that door open.
How well do big retailers block fake email?
DMARC is a short public record that tells receiving mail servers what to do with an email that claims to come from a brand's domain but fails its checks. It can reject the email, send it to spam, or let it through and report it.
| DMARC setting | What happens to a fake email | UK retailers | US retailers | Canada retailers |
|---|---|---|---|---|
| p=reject | Blocked | 55.7% | 68.0% | 43.8% |
| p=quarantine | Sent to the spam folder | 23.9% | 14.0% | 25.0% |
| Enforced on part of mail only | Blocked or spam for some fakes | 1.1% | 2.0% | 2.1% |
| p=none (monitor only) | Delivered as normal, reported to the owner | 18.2% | 14.0% | 29.2% |
| No DMARC record | Delivered as normal | 1.1% | 2.0% | 0.0% |
| Can be impersonated | 19.3% | 16.0% | 29.2% | |
| Domains checked | 88 | 100 | 48 |
Almost every big retailer has started: only 3 of the 233 retailer domains have no DMARC record at all. The gap is in finishing the job. A record on p=none shows the owner who is sending email in their name, but it stops nothing. In Canada, more than one big retailer in four has stayed at that step.
How do parcel carriers and marketplaces compare?
| Group | Domains checked | Can be impersonated | Blocks fakes (p=reject) |
|---|---|---|---|
| Big retailers | 233 | 20.2% | 58.8% |
| Parcel carriers | 23 | 17.4% | 65.2% |
| Marketplaces and payments | 15 | 0.0% | 80.0% |
| All brand domains | 269 | 19.0% | 61.0% |
The national postal services and the largest carriers are protected in all three countries. The 4 exposed parcel domains belong to smaller carriers and parcel services. Every Canadian parcel carrier we checked blocks fake email outright.
Marketplaces and payment services are the most copied brands in shopping scams, and they look like they know it. Every one of the 15 we checked enforces DMARC, and 80.0% block fake email outright.
The parcel and marketplace groups are small, so one domain moves the figure by four to seven points. Read them as a direction, not a precise rate.
How do big brands compare with small businesses?
The gap is wide. In our October 2026 study of 9,338 small businesses across 10 UK and 10 US cities, 83.3% could be impersonated. Among the biggest listed companies, 23.2% of the FTSE 350 and 9.6% of the S&P 500 could be impersonated, according to our big company email security statistics.
So a shopper is better protected by the brands with the most to lose. The gaps that remain sit in the middle: well-known retailers that set up DMARC reporting and never switched it from watching to blocking.
What should shoppers and retailers do?
Shoppers: a correct From address is not proof an email is genuine. Do not click a link in a "deal", "delivery" or "account problem" email. Go to the shop's website or app yourself, and check your order there.
Retailers and other senders:
- Check your domain. Our free DMARC checker shows what your domain publishes today, in plain English.
- Read the reports. If you are on p=none, the reports already show which services send as you. Our guide on how to read DMARC reports explains what comes back.
- Move to p=quarantine, then p=reject. Once only your own services appear in the reports, tighten the policy. Our DMARC record generator builds the record.
- Set the subdomain policy too. 9 of the brand domains that enforce DMARC set their subdomains to sp=none, so a fake email from a made-up subdomain of the brand is not blocked.
Methodology
The brands. We fixed every list before running any check.
- US retailers: every company on the NRF Top 100 Retailers 2026 list, compiled by Kantar, ranked by US retail sales. 100 companies.
- UK retailers: there is no free public ranking of UK retailers by sales, so we used a fixed list of 88 large grocery, high street, department store, DIY, beauty and online retailers.
- Canada retailers: a fixed list of 48 large grocery, pharmacy, general merchandise, home and fashion retailers, including the national banners of the largest groups.
- Parcel carriers: 28 national postal services, carriers and parcel services across the three countries.
- Marketplaces and payments: 27 online marketplaces, buy-now-pay-later and payment services across the three countries.
That is 291 brand and country pairs on 269 unique domains, because a global brand can use the same domain in several countries. Country figures count a brand once per country. The overall and group figures count each domain once.
The domains. We checked the domain each brand's customers receive email from in that country, for example the UK site of a brand that runs one, not its corporate investor site. We kept a brand's customer-facing domain even where it has no mail server of its own (10 domains), because a fake email can still put that domain in the From line.
The checks. On 1 November 2026 we looked up each domain's public MX, SPF and DMARC records through public DNS resolvers. Every lookup succeeded.
The definitions. "Can be impersonated" means the domain has no DMARC record or a policy of p=none. "Protected" means p=quarantine or p=reject, including the few records that apply the policy to only part of the mail (pct below 100), shown as their own row. This matches the rule in our small business and big company studies. DMARC protects the exact address in the From line. It does not stop lookalike domains, texts or phone calls.
Limits. We checked one domain per brand per country. Large brands own many domains and send marketing email from subdomains, which can be set up differently. We do not name individual brands. The UK and Canada lists are our own selection, not a ranking, and Canada's list is smaller. We will rerun the study before Black Friday each year.
Data, downloads and citation
Every figure and chart on this page is free to use in articles, reports and presentations. Please credit Pipefire and link to this page.
Downloads (CSV)
- All results: counts and percentages for each group and country. Totals only, no brand names.
How to cite
Lovatt, M. (2026). Black Friday email security statistics 2026: 1 in 5 big retailers can be impersonated. Pipefire. https://pipefire.ai/cold-email/black-friday-email-security-statistics
Charts carry their own source line, so they can be used as they are.
Press and data questions: Mike Lovatt, founder, [email protected].
Black Friday email security FAQ
Can scammers send emails that look like they come from a real retailer?
Yes, if the retailer's domain has no DMARC enforcement. That was true for 20.2% of the 233 big retailer domains we checked in November 2026. Without p=quarantine or p=reject, the receiving mail server has no instruction to stop an email that falsely uses the retailer's address in the From line.
Which country's retailers are most exposed to email impersonation?
Canada's. 29.2% of the big Canadian retailer domains we checked can be impersonated, against 19.3% in the UK and 16.0% in the US. Most of the exposed Canadian retailers have a DMARC record left on "monitor only".
Are parcel delivery emails safe to trust?
Not on the sender address alone. 17.4% of the parcel carrier domains we checked can be impersonated, although the national postal services and the largest carriers are all protected. Track a parcel through the carrier's own website or app, not through a link in an email.
Can I use these statistics?
Yes. Every figure and chart on this page is free to use in articles, reports and presentations. Please credit Pipefire and link to this page.