1 in 6 top-ranked fintechs leave their email domain open to spoofing, study finds

Fewer than half of 478 fintechs on four industry rankings tell receiving servers to reject forged email in their name

LONDON, Oct. 30, 2026 — One in six of the world's top-ranked fintech companies do not enforce DMARC, the email standard that stops criminals sending messages under a company's own domain, according to a study published today by ROI Maximizer, a B2B lead generation agency.

ROI Maximizer checked the public email records of 478 companies drawn from CNBC/Statista's World's and UK's Top Fintech Companies 2025, the Forbes Fintech 50 2026 and Forbes Middle East's Fintech 50 2026.

Almost all of them, 97.5%, publish a DMARC record. But only 46.7% set it to p=reject, the policy that tells inboxes to refuse forged mail. Another 36.8% use p=quarantine, which sends it to spam. The remaining 16.5% either publish p=none, a monitoring-only setting, or have no DMARC record at all.

Insurtech (25.6%) and lending (25.4%) companies were the most likely not to enforce, against 6.3% of crypto and digital-asset firms. By region, 36.5% of Middle East and North Africa fintechs did not enforce, compared with 13.3% in the United States and 12.9% in the United Kingdom. Newer protections are rarer: 27.6% publish BIMI and 8.4% publish MTA-STS.

"DMARC enforcement is what stops someone else sending email in your name. For a fintech, that email might be a payment instruction or a login link, so customers need to be able to trust the domain it comes from," said Moe Alhosni, founder of ROI Maximizer, who previously spent four and a half years in sales at Moody's. [DRAFT quote, for Moe to approve]

"Banks reviewing a new supplier increasingly look at how its email is set up, and the same settings decide whether outbound mail is trusted. Moving from p=none to enforcement is usually a matter of finding every service that sends on your behalf, not a big project," Alhosni said. [DRAFT quote, for Moe to approve]

Method

Each company's main web domain was checked on Oct. 30, 2026, using public DNS records only, with the same checks as ROI Maximizer's free email setup checker. Groups of fewer than 20 companies are not reported, and no individual company's result is published.

Caveats

The data is a one-day snapshot. Subdomains and separate sending domains were not checked. Award lists skew toward larger, better-funded firms, so the figures are likely a best case for fintech as a whole.

Full results by segment and region: roimaxi.com/blog/fintech-email-security-benchmark-2026

About ROI Maximizer

ROI Maximizer is a B2B lead generation agency that runs cold email outbound for companies selling to other businesses. It charges a one-off setup of $1,000–$3,000, then $200–$500 per qualified meeting that took place, or a flat $5,000 a month, with no minimum term. The team works from Warsaw, Poland; the company, M Ventures LTD, is registered in the U.K.

Media contact

Moe Alhosni, founder, ROI Maximizer moe@roimaxi.com