6 Ways Business Email Compromise Targets Construction Payment Workflows

Construction payments create a useful target for criminals because the money often already has a legitimate reason to move. A subcontractor has finished work. A supplier has delivered materials. A progress payment has been approved. An owner draw is due. The attacker doesn’t need to invent the entire transaction. They need to change who receives the money, when it moves, or who appears to authorize it.

That is why business email compromise in construction deserves different treatment from ordinary phishing awareness. The email may contain no malicious attachment or obvious spelling error. It may use a real invoice number inside a legitimate thread. The fraud succeeds when the payment workflow treats email as enough proof that a financial instruction is genuine.

The problem is large. The FBI’s 2025 IC3 Annual Report recorded 24,768 business email compromise complaints and more than $3.04 billion in reported losses during 2025, which keeps BEC among the costliest cyber-enabled fraud categories. Those figures cover many industries, not construction alone, but they show why a contractor’s payment controls need to assume that convincing payment-change requests will occur.

This article explains 6 ways attackers enter construction payment workflows, why ordinary invoice approval doesn’t always stop them, and where finance and project teams can place controls without turning every payment into a manual investigation.

TL;DR

Business email compromise in construction usually targets a real payment rather than creating a fake project from scratch. Attackers impersonate subcontractors, hijack live pay-application threads, use lookalike domains, pose as executives, redirect owner or lender disbursements, or inject false bank details during vendor setup. Current payment-fraud research supports that focus. The 2026 AFP Payments Fraud and Control Survey found that 76% of responding U.S. organizations experienced attempted or actual payments fraud in 2025, while 74% were affected by BEC.

The control that matters most is simple in concept: a bank-account change received by email shouldn’t be approved through email alone. Call a known contact using a phone number already held in a trusted record. Separate the person who enters bank details from the person who verifies them. Keep email accounts protected with strong MFA. Treat the first payment after a bank change as a higher-risk event. If money is sent to the wrong account, contact the bank and report the incident immediately because delay reduces the chance of recovery.

Why construction payment workflows fit BEC so well

Construction payment workflows combine legitimate urgency with many outside parties. A general contractor may exchange payment information with owners, subcontractors, lower-tier firms, material suppliers, consultants, lenders, and title or escrow contacts. New people appear as projects start and finish. Large amounts can move on short timelines. A request from an unfamiliar accounting contact can therefore look normal even when the sender is fraudulent.

Federal analysis has also shown a long-standing link between BEC and the sector. FinCEN’s 2019 financial trend analysis found manufacturing and construction were the most frequently targeted sectors in its sample of 2017 and 2018 BEC reports. That finding is historical and shouldn’t be presented as a 2026 industry ranking. It does show that attackers have been exploiting construction and manufacturing payment relationships for years.

Progress billing gives an attacker more context to copy. AIA’s G702 payment form description shows how a normal construction payment can include work completed, stored materials, retainage, prior payments, change orders, and the current amount requested. A criminal with mailbox access may see those details before attempting construction payment fraud, so the request can match a real project and payment date.

The payment chain also creates a verification problem. Project teams know whether work was performed. Accounting knows whether the invoice is approved. Treasury knows whether cash can be released. The person who knows the subcontractor’s real banking details may be somewhere else. Business email compromise in construction exploits the gap between those responsibilities.

6 Ways attackers target construction payments

The 6 patterns below focus on email identity and payment instructions. They don’t cover every form of construction payment fraud. Overbilling, duplicate invoices, material theft, fake change orders, and check theft can occur without BEC. Keeping those categories separate helps teams place the right control at the right step.

1. A subcontractor’s bank details change before a real payment

The most direct form of business email compromise in construction is a bank-change request attached to a payment that is already expected. The subcontractor performed the work. The pay application is valid. The project manager approved it. AP is ready to pay. Then an email says the subcontractor has moved banks and provides a new routing number and account number.

For vendor and payment-change requests, current FBI business email compromise guidance specifically warns that criminals spoof accounts and websites or compromise trusted communications so a request appears to come from a known source. The agency advises businesses to verify changes in vendor payment information before sending money. That guidance fits construction wire fraud because a valid invoice can still be diverted after approval.

The weak point is the beneficiary record. If an AP employee changes the vendor master based only on an email, every later approval can be correct and the payment can still fail. The purchase order is real. The subcontract is real. The payment amount is correct. Only the destination is false.

This is why construction payment fraud controls can’t end at invoice approval. A bank change needs its own verification path. The verification should use a contact already held in a trusted record, such as the original subcontract file or approved vendor record, rather than a phone number supplied in the same message that requested the change.

2. Attackers hijack a live pay-application thread

Thread hijacking is more convincing than a cold spoof because the attacker may be reading a real mailbox. They can watch the subcontractor and contractor discuss an invoice, correction, retainage amount, or approval date. Once the payment is close, the attacker inserts a new instruction without having to guess the details.

The FBI has described how criminals use malware or stolen access to view legitimate billing and invoice conversations before acting. Its earlier BEC case guidance also recommends confirming changes in vendor payment locations and warns against unusual pressure around transfers. In a construction setting, the message may arrive after the project team has already resolved every other question about the pay application.

That creates a dangerous false signal: the email feels safe because it is part of the same conversation. Replying to ask, “Can you confirm these new instructions?” doesn’t solve the problem if the mailbox itself is compromised. The attacker can simply confirm the fraudulent request.

For construction cybersecurity teams, the lesson is broader than teaching staff to inspect sender names. A verified payment change needs an independent channel. The email thread can explain the request, but it shouldn’t authenticate it.

3. A lookalike domain imitates a vendor or project partner

An attacker doesn’t need control of a real mailbox if a fake domain looks close enough. A criminal can imitate a subcontractor, supplier, architect, or project consultant with a domain that differs by one character, an added word, or a different top-level domain. On a phone screen, the difference can be easy to miss.

Current AFP findings show why this matters. Its 2026 survey found that 74% of organizations were affected by BEC in 2025, and AFP’s current payments-fraud guidance lists spoofed email accounts, lookalike domains, and legitimate-account takeover among common BEC tactics. For a contractor that deals with hundreds of project contacts, a new sender at a familiar company may not look unusual.

This form of vendor payment fraud often succeeds before the ERP or accounting platform can help. An authorized AP employee receives a plausible request and enters the new account. From the system’s point of view, an authorized person made the change. The problem occurred at identity verification, not during posting.

Domain filtering and email authentication can reduce obvious spoofing, but they don’t replace an out-of-band bank verification rule. A new or unfamiliar sender asking for a payment destination change should increase scrutiny even when the invoice itself is normal.

4. An executive or project leader appears to override normal controls

Construction teams sometimes need to move fast. A material release may depend on payment. A subcontractor may threaten to stop work. A project executive may need an urgent correction processed before a draw closes. Those conditions make pressure believable.

For fraudulent transfer requests, FinCEN’s BEC advisory describes schemes in which criminals impersonate executives or outside suppliers to initiate fraudulent transfers. The fraud works because authority can feel like a reason to bypass routine checks. An employee may believe they are helping the project by acting quickly.

A message might say that paperwork will follow later or that the payment must be released before a cutoff. The amount may even match an approved obligation. Construction wire fraud can therefore hide behind real operational pressure.

The right control is a policy that email authority can’t waive payment verification. A project executive can approve an urgent payment, but a bank-account change still needs independent confirmation. That keeps operational urgency from becoming a bypass route.

5. Owner, lender, escrow, or closing instructions are redirected

Some construction payment workflows extend beyond the general contractor and subcontractor. Development projects may involve lenders, owners, title companies, escrow agents, or closing professionals. Large project draws and real-estate transactions create another place where emailed wire instructions can be manipulated.

For project-related property transactions, FinCEN’s real-estate BEC analysis found that criminals target entities involved in title and closing processes and exploit the high value of transactions plus the volume of communication between parties. That risk can overlap construction when project financing, property acquisition, draw funding, or escrow-controlled payments sit in the same financial chain.

The fraud pattern remains familiar. A legitimate disbursement exists, but the attacker changes where it goes. A lender’s draw or owner’s payment can be redirected through a compromised or imitated account, and value-based approval may not catch it.

Construction BEC needs to be considered across the whole project money chain. Controls that protect only subcontractor ACH files leave gaps where owners or financing parties exchange instructions.

6. False banking data enters during vendor onboarding

The first payment can be exposed before the first invoice is approved. New subcontractors and suppliers often provide tax forms, ACH details, bank letters, remittance contacts, or voided checks during setup. If AP treats those documents as proof of identity rather than information that still needs validation, fraudulent data can enter the vendor master from day 1.

The FBI has documented BEC schemes using fake company identities and fraudulent tax documents. Its 2023 commodity-fraud alert described criminals using spoofed business domains, fake references, and fraudulent W-9 forms, including schemes involving construction materials. The alert dealt with fraudulent purchasing rather than only payment redirection, but it shows why onboarding documents should be verified rather than trusted because they look formal.

This form of construction payment fraud is especially hard to spot later. Once fraudulent banking information is approved in the vendor record, future invoices can travel through normal controls. Employees may trust the account because it was “already on file.”

A sound onboarding process verifies the legal entity and payment destination before activation. The same standard should apply when an existing subcontractor changes banks. Vendor payment fraud is much easier to prevent before a false account becomes the system’s trusted record.

Why approved invoices can still be diverted

Invoice approval answers one question: should the company pay this obligation? BEC asks a different question: where will the approved money go? Mixing those controls creates false confidence.

A project manager can confirm that the concrete work was completed. A quantity surveyor can confirm the pay application. An owner can approve the draw. None of those steps prove that a new bank account belongs to the subcontractor. Business email compromise in construction takes advantage of that separation.

This is why construction wire fraud often survives ordinary controls. The criminal isn’t changing the scope of work. They are changing the beneficiary after the business has decided to pay. Two authorized people can approve a fraudulent wire if both of them rely on the same bad vendor-master data.

The control model should therefore separate obligation approval from payment-destination approval. Invoice review confirms the debt. Bank verification confirms the recipient. Payment release confirms the amount and timing. Each control answers a different risk.

That distinction also keeps payment-fraud discussions precise. An inflated invoice needs quantity and contract controls. A BEC bank-change request needs identity and beneficiary controls. Treating both as “invoice fraud” can hide the actual weak point.

Bank changes are a high-risk workflow event

A bank-account change deserves more attention than a normal recurring payment because it alters the route of future funds. The request may affect one invoice or every payment that follows. That makes a small master-data edit financially significant.

For higher-risk bank changes, AFP’s guidance on callbacks and payment verification recommends contacting a verified and authorized person through a phone number taken from a trusted system of record rather than from the email requesting the change. That approach directly addresses vendor payment fraud because the second channel is independent of the potentially compromised message.

A construction company can apply the rule to ACH details, wire instructions, remittance accounts, payment portals, and changes to payment contacts. The same verification should apply whether the request appears routine or urgent.

Business email compromise in construction becomes easier when teams treat vendor-master changes as clerical work. They are financial control events. The employee entering the data should know that a new routing number has the same practical effect as changing where a future wire will land.

The first payment after a bank change also deserves added review. AP can confirm that the approved account matches the independently verified record, while treasury can verify that the released payment uses the same beneficiary. This is a targeted control, so it doesn’t add the same burden to every unchanged payment.

How to verify payment changes outside email

The strongest process rule is simple: don’t verify a financial change through the same channel that delivered it. If the email account is compromised, a reply only asks the attacker to confirm their own request.

Use a phone number that existed before the change request. It can come from the signed subcontract, prior approved vendor record, corporate website, or another controlled source. Ask for a known contact or independently confirm the person responsible for banking changes. Don’t use a new number printed on the attachment.

Business email compromise in construction often depends on employees accepting context as authentication. The sender knows the project name. They know the invoice. They know the project executive. Those details can all come from a stolen mailbox. The independent callback tests something different: whether the real company confirms the financial instruction.

The FBI’s IC3 BEC guidance recommends using secondary channels to verify account changes and checking sender addresses carefully. That is especially relevant when construction cybersecurity teams design AP procedures. The policy needs to tell employees what to do when the request looks completely normal, since that is when a written verification step matters most.

A practical callback record should capture who was contacted, which known number was used, who performed the verification, and when the change was approved. The goal is enough evidence to show that the company independently confirmed the payment destination.

Build dual control into vendor master changes

Dual approval works only when the 2 people are checking different things. If one employee updates the bank record and a second employee simply approves the payment total, both can unknowingly rely on the same fraudulent account.

Separate the workflow into entry and verification. One person can enter the proposed change. Another person should verify the change outside email and approve activation. Where systems permit it, AP staff who process invoices shouldn’t have unrestricted ability to create and approve beneficiary changes alone.

Business email compromise in construction often enters before treasury sees the payment. By the time the wire is ready, the account may already look trusted. That is why vendor payment fraud needs controls at the vendor-master stage rather than only at payment release.

The same logic applies during onboarding. This form of vendor payment fraud is easier to block before activation, and a new subcontractor should not be approved because the paperwork looks complete. Tax forms and bank letters provide information. They don’t independently prove that the request came from the actual company.

For higher-risk payments, the company can add a final check that compares the bank account on the payment file with the approved vendor record. That check should focus on changes and unusual beneficiaries rather than forcing finance to repeat the entire onboarding process for every payment.

Email security controls that matter

Payment verification remains necessary even with strong email security because the compromised mailbox may belong to a subcontractor or supplier. Still, securing company accounts reduces the chance that attackers can read internal payment conversations or impersonate employees from a real account.

CISA recommends requiring MFA across business systems and specifically says organizations should aim for phishing-resistant MFA where possible. AP, treasury, executives, vendor-management staff, and privileged administrators deserve particular attention because their accounts can expose payment information or authorize changes.

For sensitive account protection, NIST’s updated MFA guidance explains that passwords alone are too easy for attackers to steal and that stronger MFA creates another barrier after credential theft. It also notes that some MFA methods resist phishing better than one-time codes or SMS.

Construction cybersecurity should also include domain protections and email filtering that can catch obvious lookalike addresses. Employees need a clear way to report suspicious messages without forwarding them through uncontrolled channels. Access should be removed quickly when roles change.

These controls reduce account takeover risk, but they don’t change the bank-verification rule. A BEC attack can begin in another company’s mailbox, so financial instructions still need independent confirmation.

Payment controls by workflow stage

The easiest way to manage construction payment fraud is to place a specific control where the risk enters. A large checklist applied to every invoice can slow the process without addressing the real weakness. The table below maps the main BEC targets to a practical control.

Workflow Stage	BEC Risk	Control	What the Control Proves
Vendor onboarding	False identity or false bank details	Verify entity and bank contact before activation	The vendor record belongs to the intended business
Bank-account change	Attacker redirects a real payment	Callback using a previously trusted number	The real vendor authorized the new account
Pay-application approval	Hijacked thread adds new remittance details	Keep invoice approval separate from bank approval	Approved work doesn’t automatically approve a new beneficiary
Payment release	Wrong account already sits in vendor master	Second-person review of changed beneficiaries	The payment matches an independently approved destination
Urgent executive request	Authority is used to bypass controls	No email-only exception to bank-change rules	Urgency doesn’t replace verification
Owner or lender disbursement	Wire instructions are substituted	Confirm instructions through a known channel	The financing or project party owns the destination

This table also shows why a single “dual approval” label can be misleading. Two approvals of the same information don’t necessarily stop BEC. The process needs independent evidence at the point where identity or beneficiary data changes.

For recurring payments with unchanged bank details, the control can remain lighter. The higher-risk events are onboarding, bank changes, new beneficiaries, unusual payment routes, and requests to bypass normal timing. This keeps controls focused enough for busy project accounting teams to follow consistently.

What BEC is not in construction

Construction teams should avoid putting every payment problem under the BEC label. Clear categories help finance, IT, and project staff investigate the right cause and choose the right control.

Overbilling is construction payment fraud when a contractor bills for more work or materials than the contract supports. It isn’t automatically BEC. The same is true of duplicate invoices and retainage manipulation. Those problems usually require contract review, quantity checks, or accounting controls.

A fake change order is also not automatically business email compromise in construction. It becomes a BEC case when an attacker uses a compromised or impersonated email identity to create a false approval or redirect payment. If an insider fabricates the document without email impersonation, the problem belongs in a different fraud category.

Check theft and check alteration are significant payment risks, but they are separate from email compromise unless email is used as part of the scheme. AFP’s 2026 survey found checks remained the payment method most frequently affected by fraud, with 58% of organizations reporting check fraud in 2025, which is a reason to maintain check controls without confusing them with BEC.

Keeping these distinctions clear improves incident response. A construction wire fraud event caused by a false bank change requires immediate beneficiary and banking investigation. A duplicate invoice requires a different review. One label shouldn’t obscure the control failure that actually occurred.

What to do after a fraudulent payment

Speed matters once a company realizes money was sent to an attacker. Contact the financial institution immediately and explain that the transfer resulted from suspected BEC. Ask what recall, hold, or fraud-recovery steps are available. Preserve the payment confirmation and all related communications.

The FBI’s 2024 BEC notice says time is of the essence after a fraudulent transfer and advises victims to contact their financial institution immediately and request a recall. The same notice directs victims to file with IC3. Recovery isn’t guaranteed, but delay can make tracing or freezing funds harder.

Internally, freeze further payments to the affected beneficiary until banking information is reverified. Check whether the attacker changed vendor-master fields, mailbox rules, contact details, or other records. If an employee account was compromised, reset access and review sessions or forwarding rules with the IT team.

Business email compromise in construction can also affect project relationships. Notify the genuine subcontractor, supplier, or project party through a known channel so both sides can secure accounts and compare records. The goal is to stop the same compromised conversation from redirecting another payment.

A post-incident review should identify the exact control that failed, and construction cybersecurity owners should document the correction. If the company lost money because a bank change was accepted by email, adding more invoice approvers doesn’t fix the issue. The corrective action should address the failed verification step.

How to decide where to add controls first

Start with the payment events that can change who receives money. Those events usually create more BEC exposure than ordinary recurring payments. Map how a new vendor is created, how bank data changes, who can edit the vendor master, who verifies the change, and how treasury knows a beneficiary was recently updated.

Next, review where construction wire fraud could exploit urgency. Identify users who can request or approve expedited payments and make sure bank-change verification still applies. Seniority shouldn’t create an exception to the rule.

Then inspect email access. Require strong MFA for the accounts that see payment information or can change financial records. Make sure staff know that a real-looking email thread can still be hostile. This is where construction cybersecurity training should use payment examples rather than generic phishing screenshots.

Finally, test the workflow. Send a harmless internal simulation in which a known vendor appears to request a bank change and observe what employees do. The test should measure whether the team follows the verification process, not whether someone can spot a typo.

The objective is a process where business email compromise in construction has to defeat more than one independent check. Email can start a request. It shouldn’t be able to finish the financial change by itself.

Conclusion

Business email compromise in construction targets the point where trusted communication becomes a financial instruction. The most damaging request can be only one line long: “Please use our new bank account for the next payment.” If the underlying invoice is real, many standard project controls will still pass.

The strongest defense is to separate approval of the obligation from approval of the beneficiary, with construction cybersecurity and finance owners agreeing on the control boundary. Verify bank changes through a known contact outside email. Put dual control around vendor-master changes. Protect sensitive mailboxes with strong MFA. Apply added review to new or changed beneficiaries. These controls address the workflow the attacker is trying to manipulate.

Construction payment fraud will still include problems outside BEC, so companies should keep categories clear. Business email compromise in construction involves impersonation or account compromise used to manipulate a business process. When teams know exactly where that manipulation enters, they can add controls without turning routine project payments into unnecessary bureaucracy.

FAQs

What is business email compromise in construction?

Business email compromise in construction is a fraud in which criminals impersonate or take control of a trusted business email identity and use that trust to manipulate a payment or other business process. Common targets include subcontractor payments, supplier invoices, vendor bank changes, project draws, and urgent transfer requests from apparent executives or project leaders.

Why are construction payment workflows attractive to BEC attackers?

Construction involves many outside companies, large payments, changing project contacts, and regular exchanges of invoices and banking information. Those conditions make legitimate payment requests varied enough that a fraudulent change can appear normal. Attackers can also use stolen email history to match real project names, invoice amounts, and payment timing.

Can a valid invoice still lead to construction payment fraud?

Yes. The invoice can be legitimate while the bank details are fraudulent. An attacker may wait until a real pay application is approved and then change only the payment destination. This is why invoice approval and beneficiary verification should be treated as separate controls.

What is the safest way to verify a vendor bank change?

Contact the vendor through a phone number that existed before the change request and is stored in a trusted record. Don’t use the number in the new email or attachment. Ask an authorized contact to confirm the account change, then document who performed the verification and when it was completed.

Should AP reply to the same email to confirm new bank details?

No. If the sender’s mailbox is compromised, the attacker can answer the confirmation request. Verification should move to a different channel that the attacker doesn’t control, such as a call to a previously verified phone number.

How does construction wire fraud differ from ordinary invoice fraud?

Construction wire fraud often redirects an approved payment to an attacker-controlled account. Ordinary invoice fraud may involve a false invoice, inflated amount, duplicate charge, or fabricated work. The controls differ because wire redirection depends heavily on verifying the beneficiary rather than only validating the invoice.

Does MFA stop vendor payment fraud?

MFA can reduce the chance that attackers take over your company’s email accounts, but it can’t protect a subcontractor’s mailbox if that company has weaker security. Payment verification is still needed because a legitimate external mailbox may already be compromised.

Why should bank changes require 2 people?

A second person can independently verify the request before the new account becomes active. The value comes from separation of duties. If both employees simply rely on the same email, the second approval adds little protection.

Should the first payment to a new bank account receive extra review?

Yes. A new beneficiary or recently changed bank account is a higher-risk event. The payment reviewer can confirm that the payment file matches the independently approved banking record before funds are released.

Can a lookalike domain cause vendor payment fraud?

Yes. Attackers may use a domain that differs from the real vendor’s domain by one character or a small wording change. Employees can mistake the fake sender for a known contact, especially on mobile devices. A separate bank-verification process limits the damage even when the email looks convincing.

Are fake change orders always business email compromise?

No. A fake change order can be document fraud or internal fraud without any email compromise. It becomes a BEC issue when an attacker uses a spoofed or compromised email identity to create false authority, redirect payment, or convince staff to accept the fraudulent change.

What should a contractor do after sending money to a fraudulent account?

Contact the bank immediately and report suspected fraud. Request available recall or recovery action. Preserve emails, payment records, account details, and timestamps. Report the incident to IC3 and stop further payments to the affected beneficiary until the genuine vendor’s information is independently confirmed.

Is vendor onboarding part of construction cybersecurity?

Yes. Onboarding determines which identity and bank details become trusted inside the accounting system. If false information enters at setup, later invoices may pass normal approval while payments still go to the wrong account. Vendor verification is therefore both a finance control and a cybersecurity control.

Should construction companies ban bank changes by email?

They can allow email to start the request while refusing to let email complete the change. A vendor may send new details electronically, but the company should verify the request through an independent trusted channel before updating the payment record.

How often should construction companies test their BEC controls?

Testing should occur often enough to reflect staffing changes and payment-process changes. A useful test checks whether employees follow the callback and approval process when faced with a realistic bank-change request. The goal is to test the control behavior rather than only whether staff can identify a suspicious-looking email.