Wire Fraud in Construction: How Cybercriminals Target Builders and How to Fight Back
Construction is one of the most targeted industries for wire fraud in the United States. The FBI’s Internet Crime Complaint Center reports that Business Email Compromise (BEC) attacks cost victims billions annually, and construction companies account for a disproportionate share of those losses. The reason is straightforward: construction involves large, frequent wire transfers between multiple parties operating under constant time pressure — exactly the conditions cybercriminals exploit.
If you run a construction company and haven’t been targeted yet, the odds say it’s a matter of when, not if. Here’s what you need to know about how these attacks work and what you can do to stop them.
Why Construction Is a Prime Wire Fraud Target
Several characteristics of the construction industry make it uniquely vulnerable to financial cyberattacks.
Large, routine wire transfers. A single commercial construction project can involve millions of dollars flowing between general contractors, subcontractors, suppliers, and owners. Progress payments, retainage releases, material purchases, and change orders all move significant sums — and because wire transfers are routine, a fraudulent request doesn’t automatically raise suspicion the way it might in industries where large payments are rare.
Complex payment chains with many parties. On a typical commercial project, the owner pays the GC, who pays dozens of subcontractors, who pay their own suppliers and sub-subcontractors. Every link in this chain is a potential attack point. When a criminal compromises one email account anywhere in the chain, they gain visibility into payment amounts, timing, and banking details for everyone involved.
Fast-paced, deadline-driven operations. Construction runs on urgency. When a superintendent sends an email saying a payment needs to go out today or the project will be delayed, people act quickly. Attackers exploit this pressure by timing their fraudulent requests to coincide with real payment deadlines, making verification feel like a bottleneck rather than a safeguard.
Lower cybersecurity maturity. Construction companies have historically invested less in IT security than industries like finance or healthcare. Many firms still lack basic protections — multi-factor authentication on email, security awareness training, or formal procedures for verifying banking changes. This makes initial compromise easier and detection harder.
How Construction BEC Attacks Work
Understanding the anatomy of a typical attack helps you recognize and prevent them.
Reconnaissance. The attacker researches your company using publicly available information — project announcements, building permits, LinkedIn profiles, bid postings, and even job site signage. They identify key personnel (the CFO, controller, project managers), active projects, and the subcontractors and suppliers you work with.
Email compromise or impersonation. The attacker either gains access to a real email account through phishing or credential theft, or registers a lookalike domain. For example, they might register “j0hnson-electric.com” (with a zero) instead of “johnson-electric.com” and send emails that look nearly identical to legitimate messages. The compromised account approach is more dangerous because the attacker can monitor real conversations and time their fraud perfectly.
Monitoring and timing. With access to email traffic, the attacker learns your payment patterns — when draws are submitted, when payments are approved, and how banking details are communicated. They wait for a high-value payment to approach, then strike at exactly the right moment.
The fraudulent request. The attacker sends an email — appearing to come from a trusted subcontractor, supplier, or even an internal executive — requesting that an upcoming payment be sent to a new bank account. The email references real project details, uses the correct formatting and tone, and provides a plausible explanation: “We switched banks,” “Use this account for this project,” or “Our regular account is under audit.” Some attacks modify legitimate invoices, changing only the banking details while keeping everything else identical.
The money vanishes. Once a wire transfer is sent to a fraudulent account, the funds are typically moved through multiple accounts within hours and are effectively unrecoverable. Unlike credit card fraud, wire transfers offer very limited reversal options.
Real-World Attack Scenarios
These are composites based on common patterns reported across the industry.
The subcontractor impersonation. A GC’s accounting team receives an email from what appears to be their electrical subcontractor’s controller, requesting updated banking information for the next progress payment. The email comes from a domain that differs by one character. The GC updates the banking details and sends a $340,000 draw payment to the attacker’s account.
The compromised vendor. An attacker compromises the email account of a material supplier. They monitor invoices for several weeks, then intercept a legitimate $180,000 invoice and re-send it with modified banking details from the supplier’s actual email address. The GC has no reason to question the invoice — it came from the real email, references a real order, and matches the expected amount.
The CEO fraud. The attacker spoofs the construction company owner’s email and sends an urgent message to the controller: “I need you to wire $95,000 to this account for a deposit on equipment for the new project. Handle this today — I’m on site and can’t talk right now.” The urgency and authority make the request hard to question.
Prevention Strategies That Work
Wire fraud prevention in construction requires both procedural controls and technical safeguards. Neither alone is sufficient.
Verification Procedures
Verbal confirmation for all banking changes. Establish an absolute rule: any request to change payment details must be confirmed by phone using a number already on file — never the number provided in the email requesting the change. This single procedure stops the majority of BEC attacks.
Dual authorization for wire transfers. Require two authorized individuals to approve any wire transfer above a defined threshold (many firms use $10,000-$25,000). This prevents a single compromised or deceived employee from authorizing a fraudulent payment.
Mandatory waiting period. Implement a 24-48 hour delay for any change to payment instructions. Attackers rely on urgency — a waiting period gives your team time to verify without pressure.
Standardized vendor onboarding. Collect and verify all banking information during the subcontractor or vendor onboarding process, before the project starts. Store this information securely and treat any subsequent change request as a high-risk event requiring enhanced verification.
Email Security Technology
Multi-factor authentication (MFA). Enable MFA on every email account in your organization. This is the single most effective technical control against account compromise. Prioritize accounts with access to financial information — accounting, project managers, and executives.
Advanced threat protection. Deploy email security that scans attachments and links in a sandbox, detects domain impersonation (lookalike domains), and flags emails from newly registered domains. Solutions like Proofpoint, Mimecast, and Microsoft Defender for Office 365 provide these capabilities.
DMARC, DKIM, and SPF. Configure these email authentication protocols on your domain. They prevent attackers from sending emails that appear to come from your domain, protecting both your company and your subcontractors and clients from spoofed messages.
Email encryption. Use encrypted email for all communications containing sensitive financial information — banking details, payment amounts, and contract terms.
Training and Culture
Construction-specific security awareness training. Generic cybersecurity training doesn’t resonate with construction professionals. Use real-world examples from the construction industry — BEC attacks targeting draw payments, invoice fraud on material orders, and CEO impersonation during project crunch times. Train your entire team, including project managers, superintendents, and accounting staff.
Regular phishing simulations. Test your team with simulated phishing emails that mimic real construction scenarios. Track results over time and provide additional training for employees who consistently fall for simulations.
Create a reporting culture. Make it easy and safe for employees to report suspicious emails without fear of being wrong. A $0 cost of a false alarm is infinitely better than the six- or seven-figure cost of a successful attack.
Cyber Insurance
Cyber insurance for construction companies should specifically include social engineering and funds transfer fraud coverage — this is often a separate endorsement, not included in the base policy. Review your policy carefully with your broker and ensure you can meet the security control requirements insurers mandate. Failing to maintain required controls (MFA, training, backups) can void your coverage when you need it most.
What to Do If You’re Targeted
If you suspect a fraudulent wire transfer has been sent:
- Contact your bank immediately. Time is critical. Request a wire recall and ask them to contact the receiving bank. The sooner you act, the better your chances — though recovery rates for wire fraud remain low.
- Report to the FBI’s IC3. File a complaint at ic3.gov. For wire fraud over $50,000 involving a domestic-to-domestic transfer within the last 72 hours, ask your bank to initiate the Financial Fraud Kill Chain through the FBI.
- Preserve evidence. Do not delete or modify any emails related to the fraud. Screenshot everything and save email headers. This evidence is critical for law enforcement and insurance claims.
- Notify your cyber insurance carrier. Report the incident immediately. Many policies have strict reporting timelines.
- Investigate the compromise. Determine how the attacker gained access — was it your email account, a subcontractor’s, or a spoofed domain? This determines what remediation steps are needed to prevent a repeat attack.
Building a Stronger Defense
Wire fraud prevention is not a one-time project. It requires embedding security into your daily operations — the same way you embed safety protocols on the job site. The cost of prevention is a rounding error compared to the cost of a successful attack.
If your construction company needs help evaluating your cybersecurity posture, implementing email security controls, or building wire fraud prevention procedures into your payment workflows, schedule a free assessment with our team. We provide vendor-neutral recommendations — no product sales, just practical guidance that fits construction operations.
Learn more about our technology advisory for construction companies or explore our full cybersecurity consulting services.