How to Stop Wire Fraud in Construction

Construction Wire Fraud: How It Happens and How South Florida Contractors Can Stop It

Construction wire fraud rarely looks like a hack. It looks like a normal week: a supplier emails new bank details, a subcontractor asks to speed up a draw, or an owner's rep sends a revised pay application. The vendor name is right, the amount looks familiar and the project timing fits, which is exactly why it works.

This guide explains how payment fraud targets contractors, the controls that stop it, and what to do in the first hours if a payment goes to the wrong account. It is written by the team at QuestingHound, which supports construction companies from our office in Deerfield Beach.

Why Contractors Are Such Attractive Targets

Few industries move as much money, to as many different parties, on as predictable a schedule as construction. A single project can involve dozens of subcontractors and suppliers, each with their own invoices, change orders and draw schedules.

Several things make that easy to exploit:

• Payments are large and frequent. Progress payments, material deposits and retainage releases are big enough to be worth stealing and routine enough that one more does not stand out.
• Approvals happen on the move. Project managers often approve invoices from a phone between jobsites, without time to look closely.
• The vendor list keeps changing. New subcontractors and suppliers come on with every project, so a "new" bank account is not unusual.
• Email is the payment channel. Pay applications, change orders and banking details all travel by email, which is exactly where business email compromise attacks aim.
• Project details are public. Permits, bid results and jobsite signage tell attackers who is working with whom, and roughly when payments are due.

The Four Schemes We See Most Often

1. The Bank Detail Change

A supplier or subcontractor "updates" their banking information by email or on a letterhead PDF. Sometimes the message comes from a lookalike domain one letter off from the real one. Sometimes it comes from the vendor's real account, because the attacker has already broken into it. The next payment goes to the criminal's account, and nobody notices until the real vendor calls asking where their money is.

2. The Spoofed Pay Application or Change Order

An attacker who has been reading a project's email thread sends a pay application or change order that matches the real one, with one difference: the remittance details. Because it arrives in the middle of a legitimate conversation, it rarely raises questions.

3. The Urgent Request From the Boss

A message that appears to come from the owner or a senior executive asks accounting to send a wire today for a deposit, a deal or a delayed supplier. It is usually marked urgent and confidential, and it often arrives when the executive is known to be traveling or on a jobsite.

4. The Compromised Mailbox Inside Your Company

If an attacker gets into an employee's Microsoft 365 account, they can quietly set up rules that hide or forward messages, watch payment conversations, and send fraudulent requests from a trusted address. That is how a single weak password can lead to a large loss.

What the Numbers Say

The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints with more than $3 billion in reported losses. Business email compromise remains one of the most expensive forms of cybercrime the FBI tracks.

Construction is not immune to the broader threat either. Wipfli's 2026 State of Technology in the Construction Industry report found that 69% of construction and real estate executives said their firm had a cybersecurity incident in the past year.

The Controls That Stop Payment Fraud

No single tool prevents wire fraud. What works is a combination of process controls that catch fraudulent requests and technical controls that make them harder to send in the first place.

Process Controls

• Verify every bank detail change by phone. Call the vendor at a number already on file, never one included in the email or the new paperwork. Do this every time, for every vendor, regardless of who is asking.
• Restrict who can change vendor records. Only a small number of people should be able to edit banking details in your accounting system, and every change should leave an approval trail.
• Use dual approval for large or unusual payments. First payments to a new vendor, payments to updated bank accounts and wires above a set threshold should require a second approver.
• Slow down anything urgent. Urgency is the attacker's main tool. Make it part of company culture that anyone can pause a payment to verify it, including requests that appear to come from the owner.
• Treat closeout as a high-risk period. Final payments and retainage releases are large and expected, which makes them a favorite target. Apply extra verification at project closeout.

Technical Controls

• Multi-factor authentication on every mailbox. It stops most account takeovers that lead to fraud from inside your own email.
• Advanced email security. Filtering that flags lookalike domains, external senders and impersonation attempts catches many fraudulent messages before anyone reads them. See our email security services.
• Mailbox rule monitoring. Alerts for new forwarding and inbox rules reveal a compromised account early, often before money moves.
• Microsoft 365 hardened properly. Conditional access, blocked legacy sign-in methods and audit logging close the gaps attackers rely on. Our Microsoft 365 security services cover the setup.
• Training that reflects real construction scenarios. Staff learn faster from a fake change order than a generic phishing example. Our security awareness training can be tailored to your workflows.

What to Do If a Payment Goes to the Wrong Account

Speed matters more than anything else. The faster the bank knows, the better the chance of stopping or recovering the funds.

1. Call your bank immediately. Ask them to recall the wire and contact the receiving bank. Do this before anything else.
2. File a complaint with the FBI at ic3.gov, with the transaction details, the emails involved and the receiving account information.
3. Preserve the evidence. Do not delete the fraudulent emails. Your IT team will need the full message headers to trace how the attack happened.
4. Secure the mailbox. Reset passwords, remove unknown inbox rules and forwarding, and confirm multi-factor authentication is on for every affected account.
5. Notify your cyber insurer early. Most policies have notice requirements, and the insurer may provide incident response help. If you are reviewing coverage, our cyber insurance readiness page explains what carriers look for.
6. Warn the affected vendors and partners. If a vendor's mailbox was the source, they need to know, and so do others on the project who may receive the same fake requests.

How This Fits Into Your Wider Technology

Payment fraud rarely happens in isolation. It usually exploits weak spots elsewhere: an email account without multi-factor authentication, a former employee who still has access, or an accounting system nobody has secured properly.

Our construction technology integration guide covers how email, accounting, project management and field devices fit together, and where the security gaps usually sit.

How QuestingHound Helps South Florida Contractors

QuestingHound supports construction companies across Boca Raton, Deerfield Beach and Broward and Palm Beach counties from our office at 3155 SW 10th Street in Deerfield Beach. We put the technical controls in place, help you build verification steps that your team will actually follow, and respond quickly when something looks wrong.

Our team speaks English, Spanish and Portuguese, which helps when your office, field crews and subcontractors do too. Learn more about our IT support for construction companies.

Frequently Asked Questions

What is construction wire fraud?

It is a form of business email compromise where criminals impersonate a supplier, subcontractor, owner or executive to redirect a payment to their own account. It usually arrives as a bank detail change, a fake pay application or change order, or an urgent request to send a wire.

How do we verify a vendor's new bank details?

Call the vendor using a phone number already on file, never one provided in the email or the new paperwork, and confirm the change with someone you know. Document the verification before updating the vendor record.

Can a wire be recovered after fraud?

Sometimes, if the bank is contacted quickly. Call your bank immediately to request a recall, then file a complaint at ic3.gov. The longer the delay, the less likely the funds can be stopped.

Does multi-factor authentication stop wire fraud?

It stops most email account takeovers, which removes one of the most common ways fraud starts. It does not stop a fake email from an outside lookalike domain, which is why verification by phone is still essential.

When are contractors most at risk?

Any time large payments are expected: progress payments, material deposits, and especially final payments and retainage releases at project closeout. Onboarding new vendors is another high-risk moment.

Protect Your Payments Before the Next Draw

If your team approves payments by email, changes vendor banking details without a phone call, or is not sure every mailbox has multi-factor authentication, those are the gaps to close first.

A conversation costs nothing and gives you a clear picture of where you stand.