Four in ten of the professional firms we assess have a look-alike of their own web address already registered and live: the same name with one letter dropped, doubled, swapped or replaced.

We cannot see who holds these domains, and we do not suggest that whoever holds them means harm. On a short name the nearest variant is often another legitimate business. What the figure does mean is that a domain a client could mistake for the firm's already exists, and the firm does not control it.

What we measured

For each firm we worked out the common misspellings of its domain: a letter left out, a letter doubled, two letters swapped, a hyphen added, a letter replaced by one that looks like it (a zero for an o, a one for an l), and a short word added at the front or the end. We then asked public DNS which of those names answer. A name that answers has been registered and pointed somewhere.

Two kinds of result are set aside. A name that points at the firm's own server is the firm's own, and is not counted. The same name on a different ending, such as .com for a firm on .ca, is not counted either, because most of those are registered by the firm itself. Measured on 30 September 2026:

  • 41.3% of firms have at least one look-alike registered and live.
  • 40.0% have one that differs from their own domain by a single character, on the same ending.
  • 64.9% would be the figure if the same name on another ending were counted too. We do not lead on it, for the reason above.

By sector

  • 46.4% of accounting firms.
  • 45.0% of law firms.
  • 40.4% of insurance brokerages.
  • 32.1% of physiotherapy clinics.
  • 24.7% of dental practices.
  • 21.2% of real estate brokerages.

Law and accounting firms, whose names are often short and built from the partners' surnames or initials, lead the list.

Why it matters

A forged invoice or a changed payment instruction does not need access to the firm. It needs a sender address that a busy client reads past, and a look-alike domain supplies one.

A look-alike is a different domain. Nothing the firm sets on its own domain governs it.

Whoever holds the look-alike publishes its own email records and passes its own checks. The firm's DMARC record, however strict, is never consulted. That is why the defence here is partly technical and partly a rule with clients.

What to do

  1. Register the closest variants of your own domain yourself: the same name on .com and .ca, and the single-letter misspellings of it. A registration costs little and takes the name off the table.
  2. Agree a standing rule with clients, in writing, that payment details never change by email. Any change is confirmed by phone, on a number you already hold.
  3. Ask whoever manages your domain to alert you when a new domain close to your name is registered.
  4. Keep your own DMARC record at quarantine or reject. It does not stop a look-alike, but it stops an exact copy of your address, which is the easier attack. See Eight in ten professional firms cannot stop an email sent in their name.

How to check your own

Take a likely misspelling of your domain and ask DNS whether it answers. From any terminal:

dig A yourfrim.example +short

Replace the name with a misspelling of your own. If it returns an address, the name is registered and pointed somewhere. Try the common slips: a letter dropped, doubled or swapped, and rn in place of m.

Method

Read from public DNS only. No systems were accessed, no logins were used, and no firm is named here or anywhere else. The population is owner-run professional firms in Canada and the United States that we have assessed: law, accounting, insurance, dental, real estate, physiotherapy and other regulated practices. We used the most recent assessment of each firm, made between May and September 2026, and removed test, demonstration and internal records and duplicate domains. Firms whose look-alike check did not run are left out of both sides of the figure rather than counted as clear. Measured on 30 September 2026 across 1,444 firms: 41.3%. Sector figures are shown only where at least 30 firms were assessed. A name that is registered but not pointed anywhere reads as clear here, so the figure is a floor. Percentages describe the firms in our visibility, not a national census.