Construction is a payment-heavy industry. A single project can involve owners, lenders, a general contractor, dozens of subcontractors, and many suppliers, all exchanging pay applications, lien waivers, and remittance details by email. That long chain is exactly what payment diversion fraud exploits.
The FBI's Internet Crime Complaint Center has long warned about business email compromise, in which criminals impersonate a trusted party to redirect a legitimate payment. Contractors are attractive targets because payments are large, schedules are predictable, and the people approving them are often moving fast.
How the scam typically works
Step 1: Gain visibility
The attacker gets into an email account at your company, a subcontractor, or a supplier, often through a stolen password or a fake login page. They then quietly read messages and learn who gets paid, how much, and when.
Step 2: Insert themselves at the right moment
Shortly before a payment is due, a message arrives that looks like part of a real thread. It says the vendor has changed banks, or that a new account should receive the next payment. The email may come from the real account, or from a lookalike address that differs by a single character.
Step 3: Collect and disappear
If the change is accepted, funds go to an account the criminal controls and are quickly moved. Recovery becomes harder with each passing hour.
Warning signs
- A request to change bank details, especially close to a payment date.
- Pressure to act quickly or to keep the change confidential.
- A reply-to address that differs slightly from the sender, or a new domain.
- Instructions that differ from the contract or previous invoices.
- A new contact claiming to be taking over accounts payable.
- A request to switch from check or ACH to a wire.
Controls that actually work
Call-back verification
The single most effective control is also the simplest. Any request to add or change banking information must be confirmed by phone, using a number already in your vendor file or on the signed contract, never a number from the email. Make this a written rule with no exceptions for rank or urgency.
Separation of duties
The person who receives a change request should not be the person who approves it, and the person who approves it should not release the payment. Two sets of eyes make a quiet fraud far harder.
A hold period for changes
Consider a short waiting period before a changed account receives its first payment, with a verification step during that time. A small delay is cheap compared with an unrecoverable wire.
Secure the mailboxes
Fraud often starts with a compromised inbox. Require multi-factor authentication on email, watch for unexpected forwarding rules, and review sign-in alerts. A forwarding rule that silently copies messages to an outside address is a classic sign of attacker access.
Tighten the vendor master file
Limit who can edit vendor banking details in your accounting system and log every change. Review the log periodically for changes that were not requested through your process.
What to do if a payment goes to the wrong account
Speed matters more than anything else.
- Contact your bank immediately and ask them to initiate a recall or hold on the transfer.
- File a complaint with the FBI's IC3 as soon as possible.
- Notify your insurance carrier and legal counsel.
- Preserve emails and logs, and secure the compromised accounts.
- Notify the affected vendor, since their systems may also be compromised.
Do not wait for internal certainty about what happened before calling the bank. Hours can decide whether funds are recoverable.
Make it part of the culture
Fraud controls fail when staff feel awkward questioning a request that appears to come from an executive or a long-time vendor. Tell your team plainly that verification is expected, that no one will be criticized for calling to confirm, and that this applies to the owner's own requests as well.
Ironfield Cyber helps contractors and energy companies set up email protection, mailbox monitoring, and payment verification procedures. If you would like to review your approval workflow, we can help you map where the gaps are.