Construction firms pay a lot of people. Suppliers, plant hire, subcontractors, stage payments, retentions. The sums are large, the list of payees is long and changes from job to job, and a lot of it is arranged by email. To a fraudster, that is an ideal target.
Payment fraud in construction rarely involves anything clever. It works because one convincing email arrives at a busy moment and nobody stops to check.
How it usually happens
The most common version is a change of bank details. An email arrives that appears to come from a supplier or subcontractor you already pay. It says their bank has changed and asks you to update their details before the next payment. It might include a letter on their headed paper. The next payment goes to the fraudster.
There are two ways that email gets to you:
- A look-alike address. The fraudster registers an email address that is one letter off the real one and copies the supplier’s style. It is easy to miss on a phone.
- A real, compromised mailbox. The fraudster has broken into the supplier’s email, or yours. They can read the real conversation, wait for an invoice to be due, and reply in the same thread. This is the dangerous one, because everything about the email is genuine except the bank details.
The second version is why “check the email address” is not enough on its own. If the supplier’s mailbox has been taken over, the address is right.
Why construction is exposed
A few things make building firms an easy target:
- New payees on every job. A new subcontractor sending bank details for the first time looks the same as a fraudster doing it.
- Large one-off payments. A single stage payment can be worth more than a month of a smaller firm’s turnover.
- People on the move. Directors and site managers approve payments from their phones, between sites, in a hurry.
- Small office teams. Often one person sets up payees and makes payments, so there is no second check.
The controls that actually stop it
None of these needs expensive technology. They need to be written down and followed every time.
- Never accept a bank detail change by email alone. Phone the supplier on a number you already hold, not one in the email, and confirm the change with someone you know.
- Two people for new payees and changes. One person sets up or changes the details, a second approves. That one rule stops most of these frauds.
- Use Confirmation of Payee. UK banks check the name on the account against the name you enter. Treat a “no match” or “close match” warning as a stop sign, not an inconvenience.
- Send a small test payment for new payees, and confirm by phone that it arrived before sending the full amount.
- Be suspicious of urgency. “Pay today or the job stops” is a classic pressure line. A genuine supplier will wait an hour while you check.
Protect your own mailbox too
If a fraudster gets into your email, they can do this to your customers, sending invoices with their bank details from your real address. That is how one firm’s breach becomes another firm’s loss.
The basics matter here:
- Multi-factor sign-in on every mailbox, including shared ones and the accounts of people who have left
- Alerts for suspicious sign-ins and for new mail-forwarding rules, which fraudsters often set up to hide replies
- Email authentication (SPF, DKIM and DMARC) so others can tell when someone is pretending to be you. See our email authentication guide.
If it happens
Speed matters. The sooner the bank knows, the better the chance of recovering anything.
- Phone your bank immediately and ask them to try to recall the payment.
- Report it. In Northern Ireland, report to the PSNI on 101 and through Report Fraud, the national service that replaced Action Fraud. The PSNI has guidance on reporting fraud.
- Secure the mailbox. Reset passwords, sign out all sessions, check for forwarding rules, and find out how they got in.
- Check whether personal data was exposed. If it was, you may need to report it to the ICO within 72 hours. The ICO explains what counts as a personal data breach.
The same fraud hits accountancy practices and conveyancing solicitors in slightly different ways. See invoice fraud in accountancy practices and payment redirection fraud in conveyancing.
Related: IT support for construction companies in Northern Ireland
Find out where your IT stands
Book a free 15-minute call. If it’s a fit, the next step is our IT Risk and Ownership Review: £295 + VAT, using read-only access to your Microsoft 365, and credited against your first month.
