Quick answer: in our Yorkshire email security benchmark, 73% of the 289 care home websites and 83% of the 404 home care agency websites we checked had no email protection that would stop a criminal sending messages in their name. Families who pay fees, staff who receive rota and payroll emails, and local authority contacts all trust email from you. An enforced DMARC record closes that gap, usually in under an hour.
Care providers handle some of the most sensitive relationships there are. Families are often paying significant fees, sometimes from a distance, sometimes under pressure. That makes them a target for anyone who can send an email that looks like it came from the home or agency.
What we found for care providers
| Care homes | Home care agencies | |
|---|---|---|
| Websites checked | 289 | 404 |
| No DMARC record | 46% | 53% |
| DMARC monitor only | 27% | 30% |
| DMARC enforced | 27% | 17% |
| Could be impersonated | 73% | 83% |
Care homes did better than any other sector we checked, but nearly three in four could still be impersonated. Around three in ten providers had started on DMARC and left it on monitor only, which reports fakes but still lets them through. That is often a job started by an IT provider and never finished.
How a fake email reaches a family
The pattern is simple. A criminal finds the name of a care home and a family contact, which is often easy from public reviews, social media or a compromised mailbox elsewhere. They send an email from the home’s real address saying fees have gone up, a top-up payment is overdue, or the bank account has changed. Because the sender address is genuine, the family has little reason to doubt it.
The same approach works against staff (a fake email from the manager asking someone to sign in to a new rota system), against suppliers (a fake change of bank details) and against commissioners who expect to hear from you by email.
Why it matters beyond the money
- Trust with families. A family who loses money to an email in your name will hold you responsible, whatever the technical cause.
- Data protection. If a fake email leads to a staff login being stolen, resident records may be exposed. You may need to report that to the ICO within 72 hours and record it in your DSPT.
- Inspection. The CQC can ask what happened after an incident and what you have changed. A known gap left open is hard to explain.
- Your genuine emails. Mail that fails authentication is more likely to be filtered as spam, so updates to families can go missing.
Our guide to the DSPT and Cyber Essentials for care providers explains where email security fits in your wider obligations.
The fix, in three steps
- Switch on DKIM in Microsoft 365 or Google Workspace, so your genuine emails are signed.
- Publish a DMARC record set to monitor, with a reporting address, so you can see everyone sending as you, including your care planning or rota software.
- After two to four weeks, once genuine senders are covered, move DMARC to quarantine and then reject.
Alongside the technical fix, tell families in writing that you will never change bank details by email alone, and that they should phone a known number to confirm any change. It costs nothing and stops most of these frauds even when an email gets through.
FAQs
We are part of a group. Who should fix this?
Whoever manages the domain used in your email addresses, usually the group’s IT team or provider. One fix protects every home that uses that domain.
Our website is run by a different company from our email. Does that matter?
Only in that both should be involved. The DMARC record sits in your domain’s DNS, which may be managed by your website company, but your email provider needs to set up DKIM.
Is our home named in the benchmark?
No. We publish totals only. You can check your own domain privately with our free email security check.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and regulated small organisations. We check your website, cookies, email security and governance paperwork, and tell you plainly what to fix and who should fix it. We do not certify or guarantee compliance, and nothing in this article is legal advice. Read the full Yorkshire email security benchmark, or head back to the blog.
Could someone email families in your name?
Run the free email check on your domain in seconds, or book a free external audit for the full picture.
Run the free email checkNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.