The email looks routine. A trusted supplier writes that their bank has changed and asks you to send the next payment to a new account. The signature is right, the tone is right, and the invoice amount matches what you owe. Two weeks later the real supplier calls asking where their money is.
This is payment diversion, a form of business email compromise, and it hits contractors and energy firms hard because the payments are large, the vendor lists are long and the pace is fast. The FBI's Internet Crime Complaint Center (IC3) has long warned businesses about this exact pattern. The defense is not exotic technology. It is a boring, consistent verification procedure.
Why contractors are attractive targets
Construction accounts payable has features that criminals love:
- Many subcontractors and suppliers with frequent invoices
- Pay applications, retainage and progress billings that are easy to imitate
- Project managers and field staff approving payments from a phone
- Email as the main channel for everything
- Pressure to pay quickly to keep crews and material coming
What the fraud looks like
Typical variations include:
- A spoofed or lookalike email domain with one character changed
- A real vendor mailbox that has been taken over by an attacker
- A request to change ACH or wire details "before the next draw"
- A new W-9 and bank letter attached to look official
- A follow-up that urges speed because of a supposed deadline
The core rule: verify out of band
Never verify a change using the contact information in the message that asked for it. Use a phone number you already had on file, from a prior contract or a vendor setup form, and speak to a person you know. If you have no trusted number, look up the company independently and treat the change as higher risk.
A written procedure you can adopt
Here is an outline you can put on a single page.
Step 1: Require a formal change request
Bank changes must come in writing on a standard form that includes the vendor's legal name, tax ID, old and new account details, and the name of the person requesting.
Step 2: Call back
An accounts payable team member calls the vendor at a known number and confirms the request with someone other than the requester when possible. Record who you spoke with, the date and the number you called.
Step 3: Second-person approval
A different employee reviews the change and the callback record before the vendor master file is updated. The person who enters bank data should never be the only person who approves it.
Step 4: Hold the first payment
Where practical, send a small test payment or delay the first payment to the new account until the vendor confirms receipt by phone.
Step 5: Notify and log
After a change, send a confirmation to the old contact details on file. Keep the evidence together in the vendor record.
Add technical safeguards
Process is the main defense, but technology helps:
- Multifactor authentication on every email account, especially accounting and project management
- Banner warnings on messages from outside the company
- Alerts for new forwarding rules and unusual logins in mailboxes
- Restricted access to the vendor master file in your accounting software
- Bank-side controls such as dual approval for wires and positive pay where offered
Train the people who actually pay bills
Brief your accounts payable staff, project managers and anyone who can approve a payment. Make it safe to slow down. A clerk should never face criticism for calling a vendor to double check, even when the request seems to come from the owner.
Keep it practical
Procedures fail when they are too heavy. Keep the form to one page and the callback to a few minutes. Review the process after any close call, and test it by sending a harmless internal mock request to see whether it gets caught.
How Ironfield Cyber helps
Ironfield Cyber helps contractors and energy companies harden email, set up alerts for account takeover and build payment verification procedures their staff will actually follow. If you would like a second set of eyes on your vendor change process, we are glad to review it with your controller.