Payment Fraud on Construction Projects: Strengthening Controls Before Money Moves 

Construction firms move quickly by nature. Project timelines are tight, subcontractors need to be paid, materials must be secured, and change orders can shift cash needs with little warning. That pace creates opportunity, but it also creates risk. As construction activity continues across infrastructure, power, water, data center, and semiconductor projects, finance teams are managing larger payments, more vendors, and added pressure to keep projects moving.  

Payment fraud has become a growing concern in that environment. The FBI’s 2025 IC3 Annual Report reported cybercrime losses surpassing $20 billion, with business email compromise among the largest loss categories. The FBI describes business email compromise as a scam targeting businesses and individuals that perform funds transfers, often through compromised email accounts, social engineering, or unauthorized payment instructions.  

Why Construction Payments Are Attractive Targets 

Construction payments often involve multiple parties, large dollar amounts, and frequent account updates. A subcontractor may request an urgent draw. A supplier may send revised banking instructions. A project manager may approve an invoice while moving between job sites. Each step may be routine, but fraudsters often rely on routine behavior. 

The risk is not limited to poor cybersecurity. In many cases, the fraud succeeds because the request looks familiar. The vendor name is known, the invoice appears reasonable, and the timing matches an active project. That is why payment controls should not depend solely on whether an email looks legitimate. 

Vendor Changes Need More Scrutiny 

One of the most important control points is the vendor change process. Any request to change payment method, mailing address, or bank account information should receive a separate layer of review. A strong process may include confirming changes through a known phone number already on file, limiting who can update vendor records, and documenting the approval trail. 

These steps may feel slower in the moment, but they can prevent a much larger disruption. Once funds are wired to a fraudulent account, recovery can be difficult and time-sensitive. 

Approval Workflows Should Match the Risk 

Payment approval processes should reflect the size and nature of the transaction. Larger wires, first-time vendor payments, and payments tied to updated banking details deserve added attention. Segregation of duties, dual approval, and clear authority limits can help reduce reliance on one person or one inbox. 

Training also matters. Employees who process payments should feel comfortable pausing a transaction when something feels unusual, even if the request appears urgent. 

Building a Culture of Verification 

Fraud prevention is not only a finance issue. It involves project managers, executives, accounting staff, and anyone communicating with vendors or subcontractors. A culture of verification helps protect cash flow, vendor relationships, and project profitability. 

For construction firms, the goal is not to slow business down. It is to make sure payments reach the right parties the first time. Brady Martz can help organizations think through internal control considerations, payment processes, and risk awareness as projects and vendor relationships become more complex. 

Sources: 

Federal Bureau of Investigation. (n.d.). Business Email Compromise (BEC). Internet Crime Complaint Center. https://www.ic3.gov/CrimeInfo/BEC 

Federal Bureau of Investigation. (2025). Internet crime report 2025. Internet Crime Complaint Center. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf