I read the public email settings of 667 UK estate agents and conveyancing solicitors on 25 September 2026. Most of them give mail servers no instruction to refuse email forged in their name. No firm is named.
83%
of all 667 firms
85%
of estate and letting agents
75%
of conveyancing solicitors
Payment diversion fraud in property sales usually starts with an email that looks like it came from the solicitor or the estate agent. The setting that tells the world's mail servers to refuse email forged in a firm's name is a public DNS record called DMARC, so anyone can check it.
| Setting | Agents | Solicitors | All |
|---|---|---|---|
| No DMARC record | 338 (66.4%) | 71 (44.9%) | 409 (61.3%) |
p=none (monitor only) | 97 (19.1%) | 48 (30.4%) | 145 (21.7%) |
| Not refusing forgeries | 435 (85.5%) | 119 (75.3%) | 554 (83.1%) |
p=quarantine (sent to junk) | 44 (8.6%) | 25 (15.8%) | 69 (10.3%) |
p=reject (refused) | 30 (5.9%) | 14 (8.9%) | 44 (6.6%) |
| Firms checked | 509 | 158 | 667 |
Only about one firm in fifteen has the setting that tells a mail server to refuse a forged message outright.
On 30 September 2025 the National Crime Agency and the Law Society launched a campaign on payment diversion fraud in property sales. The NCA said that "from April 2024 to March 2025, there were 143 reports of this type of payment diversion fraud, with victims losing an average of £82,000". It describes the method as criminals "impersonating solicitors, estate agents or buyers".
DMARC does not stop every kind of impersonation. A fraudster can register a lookalike domain or break into a real mailbox. What it does stop is the simplest version, a message sent with the firm's own address in the From line. At the moment most firms leave that option open.
It takes about two seconds and runs in your browser. Nothing is recorded.