Project managers sit at the center of a construction company's information flow. They receive drawings, approve change orders, review pay applications, talk to owners, subcontractors and suppliers, and often have authority to commit money. For attackers, that combination is attractive. A single compromised project manager account can expose bids, contracts and payment details, and can be used to send convincing messages to everyone the PM works with.
The good news is that a handful of habits covers most of the practical risk. None require technical skill.
1. Treat unexpected requests for money or information as suspicious
Payment instructions, urgent invoices, "updated" banking details and requests for lien waivers or W-9s are common fraud themes. If a request changes how or where money moves, verify it by calling a known number, not replying to the email.
2. Check the sender, not just the name
Display names are easy to fake. Look at the actual email address, and be alert to look-alike domains with a swapped or added letter. When a message arrives from an unfamiliar address claiming to be a known contact, pause.
3. Use multi-factor authentication everywhere it is offered
Email, project platforms, file sharing, accounting portals and banking. A stolen password alone should not be enough. Prefer app-based or hardware-based authentication over text messages where you have the choice.
4. Use a password manager and stop reusing passwords
Reused passwords turn one leaked account into many. A company-provided password manager lets you use long, unique passwords without remembering them. Never keep passwords in a notes app, a spreadsheet, or on a sticky note in the job trailer.
5. Be careful with links and attachments
File-sharing notifications that mimic services you use are a favorite lure, especially for bids and plans. If a message asks you to log in to view a document, go to the service directly rather than clicking the link, or confirm with the sender by another channel.
6. Keep project data in approved systems
Sending drawings to a personal email address or saving contracts to a personal cloud account feels convenient, but it removes the company's ability to protect or recover that data. Use the project platform and company file storage.
7. Lock devices and keep them updated
Use a screen lock on laptops, tablets and phones. Accept software updates promptly, ideally by restarting at the end of the day. Devices left in trucks overnight should not be easy to open or carry away with data intact, so confirm encryption is enabled.
8. Limit who you give access to
When adding subcontractors or consultants to a project, give them only the folders and tools they need, and remove them when their work ends. Ask your IT team or provider for a periodic review of who has access to what.
9. Slow down on wire and ACH approvals
Even if you are not the one sending money, your approval may trigger it. Follow your company's dual-approval and callback procedures every time, regardless of pressure from a vendor or an executive. A legitimate vendor will understand a short delay.
10. Report quickly and without embarrassment
If you click a link, open a strange attachment, or realize you replied to a fake message, tell IT or your provider right away. Speed limits damage. The people who report within minutes are far more valuable to the company than the people who stay quiet hoping nothing happened. Companies should make it clear that early reports will never be punished.
Making the habits stick
Habits form when they are easy. Owners and operations leaders can help by:
- Providing a password manager and MFA setup at hiring.
- Writing a one-page payment verification policy and enforcing it uniformly.
- Making it easy to report suspicious messages, with one button or one phone number.
- Running short, practical training sessions with examples drawn from construction, such as a fake lien waiver request or a counterfeit plan-room link.
- Reviewing close calls in team meetings as lessons rather than blame.
A quick self check
Ask yourself:
- Do I know the process to verify a change in payment instructions?
- Do I use MFA on my email and project platform?
- Do I know who to call if something looks wrong?
- Do any of my projects have outside users who no longer need access?
If any answer is no, that is your starting point.
How Ironfield Cyber helps
Ironfield Cyber provides security awareness training tailored to construction and energy teams, and builds the email protections and procedures that make good habits easier. If you would like a short session for your project managers, we can arrange one.