Every wire transfer, ACH payment, and banking-change request. Verified before it clears AP.
Why construction firms lose wire transfers to fraud, and how to stop it
Wire fraud and business email compromise (BEC) attacks on construction payments have become the industry’s most expensive cyber problem, and the most preventable one. The FBI’s Internet Crime Complaint Center has flagged construction as one of the top BEC-targeted sectors year after year. The attack pattern is consistent: an attacker compromises a sub’s email account (or spoofs the domain convincingly enough), monitors the AP correspondence, waits for an invoice cycle or change-order payment, then sends updated banking instructions from what looks like a trusted sender. By the time the wire lands in the attacker’s account, the GC’s AP team thought they were paying a legitimate sub. The sub never received the money. And the prime is holding a loss that cyber-insurance may or may not cover. Depending on whether the firm followed a documented verification protocol before sending.
The losses are not small. Individual BEC incidents in construction regularly run six and seven figures. A $400K change-order payment redirected to a fraudulent account represents a real cash loss to the firm, a damaged sub relationship, and, if the firm lacks cyber coverage or the carrier disputes the claim, a loss that comes directly off project margin. We have seen firms absorb wire fraud losses that exceeded the profit margin on the contract entirely.
What makes construction uniquely exposed is the combination of factors that don’t exist the same way in other industries: high-dollar, time-sensitive payments tied to project milestones; multiple tiers of subs and suppliers, each with their own AP contacts; frequent legitimate changes to banking information as subs open new accounts, switch payroll processors, or change banks mid-project; and project management platforms where email threads containing payment instructions live alongside change orders, submittals, and RFIs. An attacker who compromises one email account gets context that makes their spoofed wire-change request look completely plausible.
The 15 items on this checklist are the controls that actually close the gap. They are not theoretical best practices copied from a cybersecurity textbook. They are the specific verification steps that would have caught the attack in the cases we reviewed: a callback to a known phone number before processing a banking change; a dual-control approval requirement for wires above a defined threshold; a standing policy that no payment instruction change is ever processed based on email alone; MFA on the accounting system; positive-pay enrollment with the bank. Each item is a named failure point in a real BEC incident. The firms that had these controls in place didn’t lose the wire. The firms that didn’t, did.
This checklist is not a one-time audit. It is a standing verification protocol. Something that runs before every wire and ACH above your threshold, every time a sub requests a banking change, and on a defined training cadence with everyone who touches AP. Print it, post it where AP works, and use it as the basis for a 30-minute tabletop with your finance team once a year. The dollar cost of a lost wire pays for years of the discipline required to prevent it.
Who this checklist is for
- Mid-market general contractors managing AP across multiple active projects with dozens of subs and suppliers in the payment queue
- Prime contractors on federal and commercial projects where change-order payment cycles are frequent and sub banking changes are common
- Specialty subcontractors acting as lower-tier primes, routing payments to their own subs and material suppliers
- Construction CFOs and controllers establishing AP controls and wire-verification policy across the finance team
- Project managers and owners who want a documented verification protocol before any project-related wire or ACH clears
The 15-point wire-fraud verification protocol
The checklist covers 15 verification points every AP team must run before processing construction wire transfers, ACH payments, and vendor banking changes.
- Establish a callback-verification protocol for all wire and ACH requests. Any wire or ACH payment instruction, including initial setup and all changes, must be confirmed via a phone call to a pre-verified contact number before the payment is processed. The callback number must come from the firm’s own records or the sub’s original onboarding documentation, never from the email requesting the change. A returned email confirming the instructions is not a callback. Callbacks are non-negotiable even when the requestor seems familiar, the email looks legitimate, and the project timeline is tight.
- Set a dual-control approval threshold for all wires. No single individual should have authority to initiate and approve a wire transfer above a defined dollar threshold. Establish the threshold in writing (common ranges: $25K–$50K for project-level APs; $10K for sub-tier APs), require two named approvers, and document who approved each wire and when. Dual control is the single most effective structural control against insider fraud and external BEC because the attacker would need to compromise two independent individuals simultaneously.
- Implement a standing policy: no payment change based on email alone. Put this in writing and train every AP team member on it. No change to payee banking information, account number, routing number, ACH details, wire destination, is ever processed based on an email request, regardless of who appears to have sent it. Every change requires a voice callback to a pre-verified number. Document the policy, date it, and have every AP staff member sign it. When your insurance carrier asks whether you had a documented verification protocol, this is the artifact.
- Enroll all operating accounts in the bank’s positive-pay and ACH-block services. Positive-pay is the bank-side control that flags checks for manual review if the payee or amount doesn’t match the firm’s issued-check file. ACH-block (or ACH debit filter) restricts which companies can pull funds from your account via ACH. Anything not on the approved list gets rejected automatically. These services cost nearly nothing at most commercial banks and eliminate entire categories of fraudulent transactions before they clear. If your bank doesn’t offer them, ask. If they can’t explain them, change banks.
- Verify DMARC, SPF, and DKIM configuration on your firm’s email domain. Business email compromise attacks often spoof the sender’s domain to make fraudulent wire instructions appear to come from a legitimate internal address. A properly enforced DMARC policy at p=quarantine or p=reject blocks the most common domain-spoofing vectors. Verify your domain’s configuration externally using mxtoolbox.com. Don’t rely on your email provider’s dashboard. This is a one-time setup with ongoing monitoring; once configured correctly, it eliminates a major attack surface for inbound spoofing of your own domain.
- Require MFA on accounting system, banking portal, and project management platform. Multi-factor authentication on the accounts that touch payment data is non-negotiable. This means the accounting system (QuickBooks, Sage, Viewpoint, etc.), the bank’s online portal, and any project management platform where payment-related communications live (Procore, Autodesk Construction Cloud, etc.). MFA on email alone is not sufficient. An attacker with access to a PM’s Procore account can read the payment correspondence context needed to make a spoofed wire request believable.
- Conduct phishing-simulation training for all AP staff on a defined cadence. The human layer is the entry point in most construction BEC incidents. AP staff who have never been tested against a simulated phishing attempt have click rates of 25–40% on average. That is the population processing your wire transfers. Run a phishing simulation at minimum annually, quarterly for high-risk roles (AP manager, controller, owner). Track click rates and require remedial training for staff who click. Document the cadence and results; this record matters to your cyber-insurance carrier at renewal.
- Validate sub banking-information changes against original onboarding documentation. Before processing any change to a sub’s banking information, pull the original bank details from the sub’s onboarding packet and compare. If the sub provided a voided check at onboarding, require a new voided check for the updated account. Require the change request to come from the sub’s principal or CFO, not an AP clerk, and confirm via callback as required under item 1. Document every banking-change event with a timestamp, the name of the requestor, the callback number used, and who approved the change on the GC side.
- Assign a dedicated wire approver or named AP owner for all project wire approvals. Wire fraud risk increases when payment authority is diffuse. When any PM can initiate a payment, or when the AP inbox is monitored by multiple staff without a clear accountability chain. Assign a named individual (or named two-person team under dual-control) as the wire approver for each project. All wire and ACH instructions for that project route to that individual first, regardless of where the request originated. PMs, superintendents, and project engineers do not initiate wires independently.
- Review and confirm cyber-insurance coverage terms for social-engineering and wire-fraud losses. Not all cyber-insurance policies cover wire fraud arising from social engineering. Some policies contain sublimits (e.g., $250K on a $1M policy) or exclusions for losses where the insured “voluntarily” transferred funds. Even if that transfer was induced by fraud. Review your cyber policy and standalone crime policy annually with your broker, specifically asking: “Does this policy cover a loss where we were deceived into wiring funds to a fraudulent account? What’s the sublimit? What verification steps are required to maintain coverage?” Get the answer in writing.
- Build and rehearse a wire-fraud incident-response playbook. When a fraudulent wire is discovered, the first four hours determine whether the money is recoverable. The FBI’s Internet Crime Complaint Center (IC3) and the FBI’s local field office can initiate a Financial Fraud Kill Chain request that may recall the wire before it clears the receiving bank. This only works if the firm acts within hours of discovery, not days. Your playbook should include: who to call first (your bank’s fraud line, not your account manager), the FBI IC3 reporting URL (ic3.gov), your cyber-insurance carrier’s claims line, outside counsel contact, and the sequence of documentation to preserve. Print it. Keep it with the AP checklist.
- Audit AP system access controls and remove stale credentials quarterly. Former employees, terminated subs, and inactive vendor accounts with live access to the accounting system or banking portal are a persistent exposure. Run a quarterly access review: pull the active user list from the accounting system and banking portal, compare against current HR records and active vendor list, and revoke any access that cannot be justified. Document each review with a timestamp and the name of the reviewer. Stale-credential exploitation is a common path in insider fraud and in BEC attacks where the attacker has already compromised a former employee’s credentials.
- Implement lookalike-domain monitoring for your firm and key subs. Attackers register lookalike domains before launching BEC attacks. They use these domains to send spoofed payment-instruction emails that bypass email authentication because the domain is technically legitimate, just slightly wrong. Subscribe to a domain-monitoring service (many are free or low-cost: Google Alerts on your firm name, Namecheap’s domain monitoring, or a commercial service) that alerts when new domains similar to yours or your key subs’ domains are registered. Early detection gives you time to warn your team and your subs before an attack lands.
- Establish executive-impersonation protections for high-value wire approvals. A common BEC variant targets the CFO or owner directly: the attacker spoofs the email of an executive and sends an urgent wire instruction to AP, bypassing normal process because it appears to come from the top. Protections: establish an out-of-band confirmation requirement for any wire instruction that arrives via email from an executive, regardless of urgency. Brief executives that they should expect a callback before any wire they request via email is processed. Configure your accounting system so executive-email-based override is not possible without a second approver.
- Document and log every wire and ACH transaction with verification artifacts. For every wire and ACH above your threshold, maintain a log entry that includes: payee name and account details verified against, the callback number used and who was reached, the names of both approvers under dual control, the timestamp of authorization, and the file reference for any banking-change documentation. This log is your evidence that the firm followed the verification protocol. It matters to your bank (in a recovery dispute), your insurance carrier (in a claim), and your board or ownership if a loss occurs. Retain the log for a minimum of three years.
How to run the wire-fraud verification protocol
Post this checklist where AP works and train every team member who touches wire or ACH payments on each item before they process their first transaction. For ongoing use:
- Run items 1, 2, 3, 6, and 9 as standing AP policy. These are the structural controls that must be in place before any single wire is processed.
- Run items 4 and 5 as a one-time setup task, then verify annually with your bank and mxtoolbox.
- Run item 8 every time a sub submits a banking-change request. Treat it as a mandatory checklist step, not a judgment call.
- Run items 7 and 14 on a defined annual (or quarterly) training cadence.
- Run items 10 and 11 at insurance-renewal time and after any significant change to the firm’s AP process.
- Run items 12 and 15 on a quarterly review schedule.
- Run item 13 as an ongoing monitoring task. Set up the domain alerts and leave them running.
Keep a signed copy of the policy statement (item 3) in the firm’s compliance file. If a loss occurs, the log from item 15 and the policy from item 3 are the two artifacts your carrier will ask for first.
Stop running wire verification from memory
The 15 controls on this checklist take 15–30 minutes to establish as standing AP policy. The average construction BEC loss that bypasses all of them runs six figures. Contracts Connected’s approval-workflow engine lets you build a documented verification gate directly into your payment-approval process. Every wire above your threshold routes through a named dual-control chain, every banking-change request triggers a documented callback step, and every approval is logged with a timestamp and reviewer. The paper checklist works. A workflow-enforced version works when the paper is in a drawer and the timeline is tight.
For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.
Frequently asked questions about the wire-fraud prevention checklist
What is business email compromise (BEC) and why does it target construction?
Business email compromise is a fraud scheme where attackers gain access to or spoof a legitimate business email account to deceive an employee into transferring funds or sensitive information. Construction is a high-target sector because of the combination of large, time-sensitive payments tied to project milestones; frequent legitimate banking changes as subs switch accounts or payroll processors mid-project; and multi-tier payment chains where the GC’s AP team is one degree removed from the vendor they are actually paying. FBI IC3 reports six- and seven-figure individual losses in construction BEC as routine. The attack is not technically sophisticated. It is socially sophisticated, exploiting trust that the GC has legitimately built with their subs over time.
Does cyber-insurance cover wire fraud losses in construction?
It depends on the policy language, and many construction firms are surprised to find their coverage limited. Standard cyber policies often contain sublimits on social-engineering losses. A $1M cyber policy may have only $250K of coverage for a wire-fraud event. Some crime policies contain “voluntary transfer” exclusions that apply when the insured was deceived into sending funds rather than the funds being taken without consent. Review your cyber and crime policies specifically for social-engineering and wire-fraud language, ask your broker for the sublimit, and ask what documented verification steps are required to maintain coverage. Some carriers will refuse a claim if no callback-verification protocol was in place.
What is positive-pay and does it prevent wire fraud?
Positive-pay is a bank service that matches outgoing checks against the firm’s issued-check file before clearing. Any check that doesn’t match is flagged for manual review. ACH positive-pay (or ACH debit filter) restricts which companies can initiate ACH pulls from the account. Neither service stops fraudulent wire transfers initiated by the account holder directly, but positive-pay prevents check forgery and unauthorized ACH pulls, two related fraud vectors. Positive-pay and ACH-block services are typically low-cost or included with a commercial checking account and should be enrolled on every operating account. They are the bank-side control layer; callback verification is the process-side layer.
How do I handle a sub that requests a banking-information change mid-project?
Treat every mid-project banking-change request as a high-risk event regardless of how it arrives or who sends it. The steps: (1) Do not process the change based on the email request alone. (2) Call the sub’s principal or CFO at a phone number from your original onboarding file, not a number provided in the email. (3) Confirm the change verbally. (4) Request a new voided check or official bank letter on the sub’s letterhead. (5) Document the callback: who you reached, the number you called, the date and time, and who on the GC side approved the change. (6) Update the payment record only after all five steps are complete. This process takes 20–30 minutes. A fraudulent wire takes zero minutes to lose.
What should we do in the first four hours after discovering a fraudulent wire?
Act immediately. Wire-fraud recovery is almost entirely time-dependent. The sequence: (1) Call your bank’s fraud line the moment you discover the fraud, not your account manager, the dedicated fraud line. Ask the bank to initiate a wire recall and a Financial Fraud Kill Chain request. (2) File a complaint at ic3.gov (FBI Internet Crime Complaint Center) and specifically request a Financial Fraud Kill Chain escalation. This is the FBI mechanism that can freeze funds at the receiving bank if acted on within hours. (3) Call your cyber-insurance carrier’s claims line. (4) Contact outside counsel with wire-fraud experience. (5) Preserve all evidence: the fraudulent email, wire confirmation, AP logs, and any communications with the apparent sender. Do not delete anything and do not contact the apparent sender. You may be tipping off the attacker.
How often should we retrain AP staff on wire-fraud verification?
At minimum annually for all AP staff; quarterly for high-risk roles including the AP manager, controller, CFO, and any project manager with payment authority. Training should include a review of this checklist, a walkthrough of at least one real BEC case study (IC3’s annual report has sanitized examples), and a live phishing simulation where staff don’t know they are being tested. Track click rates from the simulation and require remedial training for anyone who clicks. Document each training session with attendee names, date, and content covered. This documentation is increasingly required by cyber-insurance carriers as a condition of coverage at renewal.