Business Email Compromise in Construction: How to Protect Draws, Invoices, and Vendor Payments
Business email compromise in construction usually looks like ordinary paperwork: a subcontractor’s invoice with new bank details, a supplier asking to reroute a payment, or an owner’s rep confirming where to send the next draw. The FBI calls business email compromise (BEC) “one of the most financially damaging online crimes,” and its 2025 Internet Crime Report counted 24,768 BEC complaints with more than $3 billion in reported losses last year. Construction firms move large sums between many parties on tight schedules, which makes them an easy fit for this scheme.
Why Construction Is an Easy Target
BEC works when a fake request blends into a busy day. A typical project has a general contractor, an owner, a lender, an architect, a dozen or more subcontractors, and suppliers, all trading invoices, pay applications, change orders, and lien waivers by email. Much of that information is easy to find. Bid results, permit filings, and project announcements tell an attacker who is building what, and roughly when money will move.
Three habits in the industry raise the risk:
- Payments are large and routine. A six-figure draw or progress payment doesn’t stand out, so nobody looks twice.
- Work happens in the field. Project managers and superintendents approve requests from phones on jobsite Wi-Fi, often between other tasks. Verizon’s 2026 Data Breach Investigations Report found that text and voice scams aimed at mobile users succeed at a rate 40% higher than traditional email phishing.
- Your risk includes your partners. The same Verizon report found third-party involvement in 48% of breaches. If a sub’s or supplier’s mailbox is compromised, the fake invoice arrives from a real address you already trust.
Metro Atlanta’s steady pipeline of commercial, residential, and infrastructure work means plenty of firms here fit that profile, from specialty subs to general contractors.
How a Construction BEC Scheme Plays Out
Most schemes follow the same pattern:
- Access. An attacker phishes a password from someone at your firm, a sub, or a supplier, or registers a lookalike domain one letter off from the real one.
- Observation. Inside the mailbox, they read quietly for days or weeks, learning project names, payment timing, and who approves what. Many set up hidden forwarding rules so they keep seeing replies.
- The ask. Right before a payment is due, they send a polished request to update banking details, often with a letter on company letterhead and an urgent deadline.
- The transfer. The payment goes out. The real vendor calls weeks later asking where their money is.
The FBI’s own examples match this closely, including “a vendor your company regularly deals with sends an invoice with an updated mailing address” and a homebuyer who receives wiring instructions from what looks like their title company.
Controls That Stop It
BEC depends on one unchecked step, and a few simple controls remove it.
Verify every banking change by phone. When a vendor asks to change payment details, call them at a number you already have on file, never the number in the email. The FBI’s guidance is to verify payment requests “in person if possible or by calling the person to make sure it is legitimate.” Make this a written policy with no exceptions for urgency.
Require two people for large payments. A second approver for new payees, changed bank details, and anything above a set dollar amount catches what one busy person misses.
Turn on multi-factor authentication for every email account. A stolen password alone shouldn’t open your inbox. Our guide to multi-factor authentication for small business covers where to start.
Lock down your email domain. Email authentication settings (SPF, DKIM, and DMARC) make it harder for anyone to send mail that pretends to come from your company. Add a visible “external sender” tag to outside messages and alerts for new forwarding rules.
Protect field devices and connections. Keep phones and tablets updated and managed, and keep jobsite Wi-Fi separate from systems that handle money. We cover the Wi-Fi side in what is the disadvantage of guest Wi-Fi for businesses.
Talk to your partners. Tell subs and suppliers in writing that you will never change payment instructions by email alone, and ask them to follow the same rule.
If a Payment Has Already Gone Out
Speed matters more than anything else. The FBI advises victims to contact their financial institution immediately and ask it to contact the receiving bank, then file a complaint at ic3.gov. In 2025, the FBI’s Recovery Asset Team froze about $679 million of the $1.16 billion it worked to stop, a 58% success rate. Every hour of delay makes recovery less likely.
The Practical Takeaway
Write a one-page payment verification policy this week: phone verification at a known number for any banking change, dual approval above a set amount, and a clear rule that urgency never skips a step. Share it with your accounting team, project managers, and top vendors.
Build Payment Security Into Your Operations
Firms working on defense-adjacent projects have even more reason to tighten email security, as we explain in why the CMMC Phase 2 suspension is no reason to stop preparing. Eclipse Networks helps construction companies secure email, field devices, and the systems behind every draw and invoice. Explore our security and data protection services, or schedule a Cybersecurity Risk Assessment to find the gaps before an attacker does.
