Construction companies can reduce wire transfer and invoice fraud by combining secure email with strict payment procedures. The most important rule is simple: verify every new or changed payment instruction through a trusted communication method before money moves.

Email alone should not be considered enough proof, even when a request appears to come from an executive, project manager, supplier, or subcontractor.

Why construction payment requests can look convincing

Construction projects involve frequent invoices, change orders, new vendors, schedule pressure, and large payments. A criminal who gains access to a real mailbox may be able to study ongoing conversations and wait for the right time to insert fraudulent bank details.

The message may contain a real project name, accurate signature, familiar writing style, and a legitimate invoice with only the payment information changed.

Technology can block many suspicious messages. It cannot determine whether every real-looking bank change was approved by the correct person.

Require independent verification

Create a written procedure for new vendors and payment changes. It should require employees to:

• Call a known contact using a phone number already on file
• Confirm the change with an authorized person
• Avoid phone numbers supplied only in the change request
• Record who verified the information and when
• Require additional approval for higher-risk or unusual payments

If a vendor calls to confirm a change, return the call using an existing record. Do not rely only on caller ID.

Protect the accounts involved in payment

Require multi-factor authentication for email, Microsoft 365, banking, accounting, payroll, and financial applications where the feature is available.
Limit access according to role. Employees using Vista Viewpoint, Sage HCM, hh2, HCSS, ServiceTitan, Procore financial tools, or other systems should receive only the permissions necessary for their responsibilities.

Administrator access should be separate from routine work. Former employees and vendors should be removed promptly.

Improve email protection

Email security should include more than filtering obvious spam. Review:

• Anti-phishing policies
• Protection against executive impersonation
• Suspicious forwarding rules
• Sign-ins from unusual locations
• Lookalike domains
• External-sender labeling
• Links and attachments

Employees should have a simple way to report suspicious messages. Early reporting matters because a compromised account may still appear to work normally.

Train with realistic examples

Payment-fraud training should use examples an employee might actually see:

• A subcontractor sends replacement bank details
• An executive asks for a confidential transfer
• A supplier says an invoice is overdue and requests immediate payment
• A project manager shares a document through an unexpected login page
• A familiar vendor begins using a slightly different email domain

Finance, project management, payroll, and executive support employees may need more frequent training because their work involves sensitive approvals.
Prepare for a suspected fraudulent payment

If fraud is suspected, act quickly:

• Contact the financial institution using a trusted number.
• Notify the person responsible for incident response.
• Preserve email, invoice, and related records.
• Secure any affected email or application accounts.
• Review sign-ins, forwarding rules, and recent messages.
• Contact legal counsel, the insurer, and law enforcement when directed by company policy.
• Warn affected vendors or partners through verified channels.

Do not delete suspicious emails. It may be important to the investigation.

Frequently asked questions

Is multi-factor authentication enough to prevent invoice fraud?

No. MFA reduces account-compromise risk, but fraudulent requests can also come from a vendor’s compromised account or through nontechnical impersonation. Payment verification remains necessary.

Should every bank change require a phone call?

A strong policy should require independent verification through a trusted method. The company should define the exact approval process with its financial, legal, insurance, and security advisers.

What is business email compromise?

Business email compromise is a form of fraud in which criminals use or imitate a business email account to persuade someone to send money or sensitive information.

Learn More

SisAdmin helps construction companies protect Microsoft 365, manage access, strengthen devices, and prepare for security incidents. Payment controls still belong to company leadership and finance, but the technology around those controls should make fraud harder to carry out and easier to detect.