Email authenticity fears led 43% of UK respondents to delete or abandon a message during the past year, research released ahead of Black Friday found.
The survey, commissioned by digital trust company DigiCert, also found that 18% had delayed a purchase and 12% had bought from another retailer because they were unsure whether an email was genuine.
Delivery Companies Featured in 63% of UK Recipients' Reports
Home of Direct Commerce's UK breakdown reported that 38% had acted on an email before realising it was, or might have been, fraudulent. That included 25% who clicked a link and 8% who made a payment or purchase.
These are reported experiences, not independently confirmed losses. Among UK respondents receiving suspicious emails, 63% recalled messages impersonating parcel or delivery companies; the figure measures recipients, not email volume.
Vitreous World surveyed 6,000 adults in October 2026, including 2,000 in the UK. DigiCert released the findings on 9 November 2026, reporting that 90% of UK respondents had received a suspicious email during the previous year.
The findings add email-specific evidence to concerns about online purchase scams ahead of Black Friday. They do not establish how much money consumers or retailers lost.
DigiCert Tests Inbox Logos and Website Trust Marks Separately
DigiCert promotes verified inbox logos alongside authentication services supplied by the company and its subsidiary Valimail. Its UK findings showed 56% would choose a brand displaying its official inbox logo over a competitor offering a similar promotion.
Google's documentation explains that Brand Indicators for Message Identification, or BIMI, enables supported inboxes to display authenticated brand logos. Requirements include third-party certification and an enforced DMARC policy, which tells receiving services how to handle messages failing email-authentication checks.
Those signals have limits. A BIMI implementation working draft states: 'The successful validation of BIMI does NOT indicate that a message is not spam, malware, or phishing.'
In a separate international email-image comparison, 20% shown a verified logo expressed purchase intent, against 17% shown the version without one.
The international checkout comparison tested a website trust mark instead. Purchase intent stood at 32% without the mark and 31% with it.
Both comparisons measured stated intentions, not completed purchases. Neither establishes an effect on actual sales, and the checkout finding should not be applied to inbox logos.
NCSC Advises Checking Delivery Requests Independently
A related UK account illustrates why timing can matter. Reddit user u/stationarygoose wrote on 28 March 2026: 'I ordered a few things a week ago which have not arrived, so assumed it had to do with that.'
The unverified account concerns a purported DPD text, not email, and predates DigiCert's research. The poster said they clicked the link but entered no personal information.
[UK] stupidly clicked suspicious link embedded in a weird message about parcel from unknown number
by u/stationarygoose in Scams
The National Cyber Security Centre advises avoiding links in unexpected delivery messages and contacting organisations directly to verify requests. It also recommends two-step verification on important accounts.
MoneyHelper similarly advises visiting retailers independently rather than following message links. That precaution also applies when checking an attractive offer whose sender cannot be verified.
