A chamber of commerce is one of the few senders whose email almost every local business opens. Member alerts, event invitations, dues reminders, advocacy updates — chamber mail arrives with built-in trust earned over decades.
That trust is exactly what makes chambers attractive to attackers. If a chamber’s domain can be spoofed, every member business is one convincing “dues invoice” or “event payment update” away from wire fraud. According to the Travelers Q1 2026 Cyber Threat Report, business email compromise and social engineering fraud account for roughly 40–50% of cyber claims, with combined severity up more than 30% since 2023.
What we found auditing chambers
In our review of all 50 state chambers and 20 major metro chamber markets (180+ organizations total), scores ranged from 70% down to 30% — 34 of 50 state chambers (68%) scored below 60% on email and domain security basics. Only three state chambers reached a Good (70%+) posture. Metro chambers showed similar gaps: most major markets had at least half of audited chambers below 60%.
Three controls determine whether a chamber’s domain can be impersonated:
- SPF — which servers may send mail as your domain
- DKIM — cryptographic proof a message wasn’t altered
- DMARC — the policy telling the world’s mailbox providers to reject impostors
A chamber missing an enforcing DMARC policy can be spoofed with widely available tools — no “hack” required. The attacker never touches the chamber’s systems; they simply send mail that claims to be the chamber.
Why this matters more for chambers than most organizations
A spoofed law firm endangers its clients. A spoofed chamber endangers an entire local business community at once — the membership list is the blast radius. And because chambers regularly send payment-adjacent mail (dues, sponsorships, event fees), fraudulent payment requests blend in.
The free check (30 seconds, no signup)
Any chamber — and any member business — can check its domain instantly at audit.emailmenow.com: SPF, DKIM, DMARC, TLS, and related controls, scored with industry benchmarks.
State-by-state chamber results: see our Chambers of Commerce industry report.
For Texas chambers: an SB 2610 talking point your members need
Texas SB 2610 gives businesses under 250 employees an affirmative defense against punitive damages — if they maintain a documented cybersecurity program. Most small businesses still don’t know this. A chamber newsletter explaining safe harbor, paired with a free self-check, is a genuine member benefit: SB 2610 basics.
For chamber staff: we’re happy to provide your chamber’s own audit report privately, aggregate benchmarks for your state, or a short piece adapted for your member newsletter — contact us.