Wire fraud gets the headlines, but contractors also lose money through altered checks, counterfeit checks and unauthorized ACH debits. Paper checks still move a lot of payments in construction, particularly to subcontractors and suppliers, and they are mailed, left in job trailers and handled by many people. Pairing bank tools with a few internal habits closes most of the exposure.
How check and ACH fraud happen
- Altered checks: a legitimate check is stolen from the mail or a trailer, and the payee or amount is changed.
- Counterfeit checks: criminals use your account and routing numbers, printed on every check you issue, to create convincing fakes.
- Unauthorized ACH debits: someone with your account details initiates a debit without permission.
- Compromised payment portals: stolen credentials are used to initiate payments or change payee information.
- Insider misuse: an employee with too much access issues or alters payments.
Your account number is not a secret once you issue checks, so controls must assume it is known.
Bank services to ask about
Talk to your bank about the services it offers, since names and features vary.
Positive pay
With positive pay, you send the bank a file of issued checks, including check numbers, amounts and payees. The bank compares presented checks against the file and flags exceptions for your review. This catches counterfeit and altered checks. Payee positive pay adds the payee name to the comparison, which helps with altered payees.
ACH debit controls
ACH debit blocks or filters allow only debits from approved originators. Many banks can block all debits on an account used only for outgoing payments, or allow only specific companies. Review which accounts truly need to accept debits.
Dual authorization
Require two people to initiate and approve payments in the bank portal. Ensure the two people are different individuals with separate credentials.
Alerts and limits
Set transaction alerts, daily limits and notifications for new payees and for changes to user permissions. Review who has portal access at least quarterly.
Separate accounts
Use separate accounts for different purposes, such as one for disbursements and one for deposits, so that tighter controls can be applied without disrupting the business.
Internal habits that matter
- Reconcile daily. Reviewing activity every business day lets you spot problems quickly. Banks often have short windows for reporting unauthorized items, so ask yours and note the deadlines.
- Secure check stock. Keep blank checks locked, track check numbers and limit who can print or sign.
- Separate duties. The person who prepares payments should not approve them, and the person who reconciles should be different from both when staffing allows.
- Protect outgoing mail. Where possible, deliver checks in person or use secure electronic payment instead of leaving them in an unlocked trailer or an outgoing mailbox.
- Prefer electronic payments with verified details. Done with proper verification of bank details, electronic payments eliminate physical theft, though they raise payee-diversion risk, so keep verification procedures in place.
- Review portal users. Remove former employees and shared logins immediately.
- Use multi-factor authentication for every bank and payment portal account.
Protect the logins
Banking portal credentials are valuable. Use dedicated, hardened computers for banking where practical, avoid using them for general browsing and email, and keep them updated. Limit remote access. Criminals frequently use phishing to capture banking credentials, so train finance staff accordingly.
Plan for fast response
When a fraudulent item appears, speed matters.
- Contact the bank immediately using a known fraud line.
- Document the item, date and how it was discovered.
- Report the problem to your insurance carrier and ask about coverage for crime and funds transfer fraud.
- Preserve evidence, including check images and portal logs.
- Review whether other accounts or items are affected.
- Consider a new account number if the account is compromised, and update vendors and payroll accordingly.
Keep the bank's fraud contacts in an easily reached location, not only in an email system that may be down.
Review insurance
Crime and cyber insurance policies treat check fraud, social engineering and funds transfer fraud differently, and some require specific controls. Ask your agent which controls the policy assumes, and whether coverage depends on call-back verification or dual approval.
Quick start
- Call your bank and ask which of these services you use today.
- Enable positive pay or the closest equivalent.
- Block ACH debits on accounts that do not need them.
- Turn on dual approval and alerts.
- Set a daily reconciliation routine.
Closing note
Ironfield Cyber helps finance teams combine bank tools, email protection and written procedures so one stolen check or one phone call does not become a loss. If you would like to review your payment workflow, we can do that with you and your bank contacts.