5 controls stop the overwhelming majority of construction payment fraud, and a firm with 10 to 50 employees can have all 5 running in about 2 weeks. If a fraudulent wire has already left your account, you have a very small window in which a recall has a realistic chance of working. And the first call should go to your bank, then your IT provider second.

Below: the 6 steps if it's already gone and the 5 controls that prevent the next one.

If It Already Happened:

Read this first if a payment has already gone out to an account you now think was fraudulent.

  1. Call your bank's fraud department and request a wire recall. Minutes matter.
  2. File a compliant at ic3.gov, the FBI's Internet Crime Complaint Center.
  3. Reset the compromised account's password and revoke all active sessions. A password change alone doesn't kick an attacker out; the session token stays valid.
  4. Check the mailbox for forwarding rules and inbox rules. This is where the attacker hides replies from the real vendor, so the fraud goes unnoticed for weeks.
  5. Preserve everything. Don't delete the emails, don't clean the mailbox, don't wipe the workstation, don't tidy the mail logs. Headers and sign-in logs are the evidence behind the claim, so have your IT provider export the audit log before retention expires.
  6. Warn the affected vendor and your whole AP team. The same attacker often has your entire vendor list, because they've been reading your inbox.

Why Construction Firms Are Targeted More Than Most Industries

Construction payment operations have five traits that attract a patient attacker.

  1. Large, predictable payments on a monthly draw cycle. An attacker sitting in a mailbox three weeks learns when pay apps go out, when the draw funds, and what each sub is owed, then times the banking change.
  2. Long sub and vendor lists where a banking change looks routine. A firm paying 60 subs, suppliers, and rental companies really does get banking updates. New factoring arrangement, new lender, new entity after a sale. The fraudulent one doesn't stand out.
  3. Approvals that happen over email. Pay applications, change orders, and lien waivers move as attachments with the approval typed into the reply. Control one mailbox in that chain and you're inside a workflow built on trust.
  4. Distributed teams and after-hours approvals. A PM approves an invoice from the job trailer at 6pm, on a phone, without calling to verify. That's the job, not negligence, but it removes the step that catches this fraud.
  5. Lean back offices. A 30-person contractor usually has one bookkeeper running AP end to end, no second set of eyes, no dual approval. When a convincing email arrives from a PM they talk to daily, nothing stands between it and the money.

Four of the five are processes, not technology, which is why antivirus never stopped this attack.

The 5 Controls That Help Stop Payment Fraud

  1. Multi-factor authentication on all email - This helps minimize account takeovers that start nearly every one of these attacks.
  2. Verbal callback verification on banking changes - This helps prevent the fraudulent account number from ever getting entered. Call a number already in your vendor master, never one in the email.
  3. Dual approval on wires and ACH above a threshold - This helps catch if there is one compromised mailbox or one pressured employee moving money alone.
  4. SPF, DKIM, and DMARC on your domain - Helps prevent outsiders from spoofing your firm to your own subs and to the GC. Also helps keeps legitimate pay app emails out of spam folders.
  5. AP-targeted security training - This helps stop the user from clicking the fraudulent email. Generic training doesn't move the needle & scenarios must be construction-specific: a spoofed pay app, a supplier invoice with new remit-to details, a change order approval.

Controls 1, 4, and 5 are what a managed network security program delivers and maintains. Controls 2 and 3 are yours - policy and bank configuration, costing nothing but discipline, and the two that most reliably stop the money.

A Houston Company's $20,000 Near-Miss

A 50+ person company got an email from a scammer pretending to be their boss, requesting payment on an invoice. Payment was made, but when they went back to their email to provide their boss confirmation of the payment, they noticed the signature in the email said, 'sent from iPhone'. Their boss did not have an iPhone, so they immediately contacted the bank to stop the payment. No money was moved.

Why Construction Firms Work With Alexaur

We've supported construction and engineering firms across Katy, TX and Greater West Houston since 2001, and we're still family-owned. The person answering knows what a draw cycle is.

Not Sure Whether Your AP Process Would Catch This?

If the first section made you want to check a mailbox, go check it. If a payment has already gone out, call your bank first, then call us. Book a 15-minute discovery call and we'll walk your AP process and name the gaps.

Call 281-646-1200 or email results@alexaur.com.