Fake bank change, real money gone: stopping payment fraud in construction

The email looks exactly right. That is the problem.

It is the second week of the month. Pay apps are due, a couple of subs are waiting on retainage, and the office is buried. An email comes in from your concrete sub's project manager. Same name, same signature block, same tone as the last forty emails. Their bank changed, here is the new routing and account number, please update before this cycle goes out.

Someone in AP updates the vendor record. The payment goes out on schedule. Two weeks later the real sub calls asking where their money is.

That is business email compromise, and construction is a near-perfect target for it. Not because contractors are careless, but because the work itself creates the conditions attackers look for.

Why construction gets hit

Look at how money moves on a typical job:

• Lots of parties. Owners, GCs, subs, suppliers, architects, and lenders, all emailing each other about money
• Large, predictable payments. Pay apps, draws, and retainage follow a schedule that is easy to learn
• Public project information. Permits, bid results, and jobsite signs tell an outsider who is working with whom
• Busy offices. A small AP team processing a lot of invoices under deadline pressure
• Email as the system of record. Change orders, lien waivers, and banking details often travel as attachments in normal email threads

An attacker does not need to break anything clever. They need one mailbox, yours or a sub's, and a little patience.

How these attacks usually play out

There are a few common versions:

1. The compromised sub or supplier. Someone at a vendor gets phished. The attacker reads their mail, waits for a real payment conversation, then replies inside the real thread with "updated" banking details. Because it comes from the real account, it passes every gut check.
2. The lookalike domain. The attacker registers a domain that is one letter off from your sub's, copies their signature, and starts a new thread. On a phone screen it is very hard to spot.
3. Your own mailbox. Someone in your office gets phished. The attacker sets an inbox rule that quietly forwards or hides messages with words like "payment," "wire," or "invoice," then impersonates you to your customers or your subs.
4. The owner or lender angle. A fake email to a project owner or a title company says your draw should go to a new account.

The common thread: a change in payment instructions arrives by email, and nobody verifies it outside of email.

The controls that actually stop it

None of this requires a big budget. Most of it is process, and the rest is settings you probably already pay for.

1. Never accept a bank change by email alone

Make it a written rule: any new vendor bank account or change to an existing one gets verified by phone, using a number you already had on file. Not the number in the email. Not the number in the new signature block.

Add a short hold on first payments to a changed account, and require a second person to approve the change in your accounting system. Put the rule in your sub and supplier onboarding packet so everyone knows it up front. Good subs will appreciate it.

2. Lock down the mailboxes you own

• MFA on every account, including the shared AP and estimating mailboxes. Prefer phishing-resistant methods like an authenticator app with number matching or security keys over text messages
• Alerts on new inbox rules and external forwarding. These are classic signs a mailbox has been taken over
• External sender tags so mail from outside your company is clearly labeled
• Sign-in controls that block or challenge logins from unusual locations or unmanaged devices

If you are on Microsoft 365, most of this is configuration, not new spend.

3. Protect your domain so nobody can pretend to be you

Set up SPF, DKIM, and DMARC on your email domain, and move DMARC toward an enforcing policy over time. It will not stop a lookalike domain, but it makes it much harder for someone to send mail that appears to come from your exact address. It also helps your owners and subs trust that your real emails are real.

4. Train the people who move money

Your AP clerk, controller, and project managers are the front line here. A short, specific session beats a generic annual video:

• What a bank change scam looks like, using a realistic construction example
• Why urgency and secrecy are red flags ("the owner needs this today, do not call me, I am on a jobsite")
• Exactly who to call and what to do when something feels off

Make it safe to slow down. The person who delays a payment to verify it should get thanked, not blamed.

5. Check your insurance before you need it

Many cyber policies treat social engineering or funds transfer fraud differently from a hack, sometimes with lower limits or specific verification requirements. Ask your broker plainly: if we wire money to a fraudster after a fake bank change email, what is covered, and what do you require us to have done first?

If a payment already went out

Speed matters more than anything else.

1. Call your bank immediately and ask them to recall the transfer and contact the receiving bank. Ask for their fraud team by name
2. File a report with the FBI at ic3.gov. The sooner it is reported, the better the chance of a freeze
3. Secure the mailbox that was involved. Reset passwords, revoke sessions, remove suspicious inbox rules, and check for forwarding
4. Notify the real vendor by phone so they can check whether their side was compromised
5. Call your insurance carrier and document everything

Then figure out how it happened before the next pay cycle, because whoever did it may still have access.

Where this fits with the rest of your security

Payment fraud is usually the visible end of a bigger problem: weak email security, no MFA on a shared mailbox, or nobody watching for risky sign-ins. Fixing it tends to clean up a lot of other gaps at the same time.

If you also do federal or DoD work, the same controls show up in NIST 800-171 for access control, awareness training, and incident response, so this work counts twice.

For more on how we support contractors, see our construction IT and security page and a construction case study from a recent project. The free compliance readiness checklist is a quick way to see where your email and identity controls stand today.

Bottom line

The money does not get stolen because someone hacked your bank. It gets stolen because one email changed one account number and nobody picked up the phone.

Write the rule down, lock down the mailboxes that handle money, and make verifying a payment the normal thing to do. If you want a senior engineer to look at your email security and payment process before the next draw goes out, book a free 45-minute Compliance Gap Audit. You keep the written snapshot either way.