|
It's 3:40pm on a Friday. Your project accountant gets an email from your concrete sub's AR contact, in the same thread you've used all year, asking to update their banking information before this month's pay app. A voicemail follows that sounds exactly like their controller. The $480,000 draw goes out Monday. By Wednesday, the real sub is asking where their money is.
Nobody's servers were encrypted, nothing was "hacked" in the Hollywood sense, and the money is gone.
The Numbers Contractors Should Be Watching
Ransomware gets the headlines, but business email compromise (BEC) takes the money. In 2025, BEC generated $3.046 billion in reported U.S. losses, compared to $32.3 million for ransomware. The average loss was roughly $123,000, a full project's margin for many contractors. AI is making it worse: flawless emails and cloned voices are erasing the red flags we trained employees to spot.
Why Construction Is Built for This Scam
Predictable payments. Pay apps, retainage and supplier invoices follow schedules a criminal can learn from one compromised inbox.
Public information. Bid results, awards and permits show who works with whom, and for how much.
Approvals from the field. PMs approve on phones between site walks, when people skim instead of scrutinize.
And paying a fraudster doesn't satisfy what you owe your sub. You may face the loss, the payment and lien exposure at once. Ask your construction counsel how your contracts allocate that risk.
The Payment Lockdown: Five Controls
-
Verify out of band. Confirm bank changes by calling a number already on file, never one in the email, require two-person approval and hold the first payment to a new account 48–72 hours.
-
Lock the vendor master file. Accept banking changes only by signed form or vendor portal, never email, set your ERP to alert on changes and flag payments to recently changed accounts.
-
Harden identity. Most BEC starts with one compromised Microsoft 365 account. Use phishing-resistant MFA instead of text codes, restrict sign-ins by location and device, and monitor 24/7 for suspicious inbox rules and sign-ins.
-
Train for construction scenarios. Generic phishing training isn't enough. Walk AP, admins and PMs through fake pay-app changes, "urgent" retainage requests and cloned-voice calls. Use a code phrase for phone payment requests.
-
Plan the first hour. Know your bank's fraud recall contact, report to ic3.gov immediately, and check your cyber policy's social engineering sublimit.
A Leadership Issue, Not an IT Ticket
BEC exploits process more than technology. Ask your team this week: "Could someone change a vendor's bank account in our system with one convincing email?" If the answer isn't a confident "no," a fractional CIO can help you find where your payment processes, Microsoft 365 environment and field workflows are exposed and build a roadmap to close the gaps before your next pay app cycle.
| 
