--- title: "Invoice Fraud in Construction: How Attackers Hijack Wire Transfers" description: Learn how invoice fraud targets the construction industry, the tactics used by attackers, and prevention strategies to protect your payments with TMGC. image: https://www.tmgcinc.com/hubfs/invoice%20fraud.webp --- [Skip to the main content.](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#main-content) [![TMGC\_Logo\_Main\_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=130&height=112&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) [![TMGC\_Logo\_Main\_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=150&height=129&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [GET STARTED](https://www.tmgcinc.com/contact) Toggle Menu Toggle Menu [GET STARTED](https://www.tmgcinc.com/contact) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) 4 min read # Invoice Fraud in Construction: How Attackers Hijack Wire Transfers [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : November 6, 2026 [Construction](https://www.tmgcinc.com/blog/tag/construction) ![Invoice Fraud in Construction: How Attackers Hijack Wire Transfers](https://www.tmgcinc.com/hubfs/invoice%20fraud.webp) Last month, the City of Mobile, Alabama sent a routine $14.7 million payment on its new arena project. The invoice was real, and so was the contractor. But the bank account belonged to a fraudster. According to [ENR](https://www.enr.com/articles/64095-fraudster-spent-months-posing-as-contractor-before-diverting-147m-payment), someone had been posing as the general contractor since late May. They used real employees' names, sent convincing documents, and eventually got the contractor's banking details changed in the city's payment system. When the October payment went out, nothing looked unusual except where the money landed. The city says its systems were never breached. That's how simple and oftentimes unassuming invoice fraud is in the [construction industry.](https://www.tmgcinc.com/architecture-engineering-construction-it-services) Hackers just need one person in accounts payable to trust one email or phone call. Here's how it works and what stops it.   ## Key Takeaways - Invoice fraud redirects a legitimate payment to an attacker's account, usually by changing a vendor's banking details - Construction is an easy target because payments are large, frequent, predictable, and spread across dozens of subs and suppliers - Business email compromise drove about $3.05 billion in reported U.S. losses in 2025, according to the FBI - A phone call to a number you already have on file stops most of these schemes before they succeed   ## Table of Contents 1. [What Is Invoice Fraud?](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#what) 2. [Why Is Construction a Common Target?](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#why) 3. [How Do Attackers Hijack a Pay App?](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#how) 4. [What Does Invoice Fraud Cost a Contractor?](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#cost) 5. [Red Flags Your AP Team Should Know](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#flags) 6. [Invoice Fraud Prevention: Controls That Work](https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers#controls)   ## What Is Invoice Fraud? Invoice fraud is any scheme that tricks your company into paying the wrong party. In construction, it usually takes one of three forms: - **Bank change requests:** A "supplier" asks you to update their remittance details, and the next payment goes to the attacker. - **Hijacked invoices:** A real invoice is intercepted and resent with new payment instructions. - **Fake invoices:** A convincing bill for work that never happened, often timed to match a real project phase. It's a form of accounts payable fraud, and it often rides on business email compromise. We covered how attackers break into and impersonate email accounts in our post on [business email compromise](https://www.tmgcinc.com/blog/business-email-compromise-arent-we-more-advanced-than-that). This post focuses on what happens next: how that access turns into a wire transfer.   ## Why Is Construction a Common Target? Attackers go where the money moves often and in large amounts. Construction checks every box. - **Payments are big and predictable:** Monthly pay apps, retainage releases, and progress draws follow a schedule anyone can figure out. - **The payee list is long:** A single project can involve dozens of subs, suppliers, and equipment vendors, so a new name or a new bank account doesn't stand out. - **Project details are public:** Bid boards, permits, press releases, and job signs tell an attacker who's working with whom, and on what. - **Deadlines create pressure:** When a sub says crews won't show up until they're paid, people move fast and skip steps. - **Work happens on phones:** Project managers and supers approve things from the field, where it's harder to spot a lookalike email address. Construction is already one of the top three industries for ransomware. We covered why in our post on [construction cybersecurity](https://www.tmgcinc.com/blog/construction-cybersecurity-why-contractors-became-a-top-ransomware-target). Invoice fraud is the quieter version of the same problem, and it can be just as expensive.   ## How Do Attackers Hijack a Pay App? Most schemes follow the same pattern: 1. **Research:** The attacker picks a project and learns who the GC, key subs, and owner are. 2. **Get a foothold:** They break into a sub's or supplier's email account, often through a phishing link, or register a lookalike domain that's one letter off. 3. **Watch quietly:** Once inside a mailbox, they set up rules to hide or forward messages and read along for weeks to learn names, invoice formats, and payment timing. 4. **Strike at the right moment:** Right before a pay app or retainage release, they send "updated banking information" from what looks like a trusted contact. 5. **Collect and disappear:** The money moves through accounts quickly. By the time the real vendor asks where their payment is, it's often gone. The Mobile case skipped step two entirely. The impostor simply built trust over months with documents, emails, and phone calls. That's why technology alone won't solve this. Your process has to hold up even when the request looks completely legitimate.   ## What Does Invoice Fraud Cost a Contractor? The FBI's latest Internet Crime Report put [business email compromise losses at about $3.05 billion in 2025](https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/), second only to investment fraud. The Association for Financial Professionals found that [74% of organizations were hit by business email compromise](https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags) last year, and nearly half of companies under $1 billion in revenue reported actual financial losses from payments fraud. On a project, those losses show up in more places than the bank account:   | **Cost** | **What It Causes on a Project** | **Who Feels It** | | --- | --- | --- | | The stolen payment | A pay app or retainage release lands in the wrong account | Owner, GC, or sub (whoever sent it) | | Paying twice | The real vendor still needs to be paid | CFO, project budget | | Schedule risk | Unpaid subs slow down or walk off | Project manager, owner | | Relationship damage | Trust breaks down between GC, subs, and owner | Everyone on the job | | Insurance gaps | Many policies limit or exclude social engineering losses | CFO, owner |   In Mobile's case, the city covered the contractor's payment from contingency funds while law enforcement chased the stolen money. Most small and mid-sized contractors don't have a $15 million contingency to fall back on.   ## Red Flags Your AP Team Should Know Train everyone who touches payments, including PMs who approve pay apps, to slow down when they see: - **Any change to banking details:** Especially by email or close to a payment date. - **Urgency or secrecy:** Requests like "we need this today" or "please don't call, I'm on a jobsite." - **Small changes to an email address:** An extra letter, a swapped domain, or a reply-to address that doesn't match the sender. - **New account names that don't match the vendor:** Or banks in a different state from the vendor's office. - **Invoices that arrive out of rhythm:** Like a second pay app in the same month or a retainage request before closeout.   ## Invoice Fraud Prevention: Controls That Work Setting up the right controls is the first step that contractors can take for invoice fraud prevention. Here’s some things every construction company should keep in mind: - **Call back on a number you already have:** Verify every bank change by phone using contact info from your own records, never from the email or document requesting the change. - **Require two people for bank changes:** One person enters the change, a second verifies and approves it. - **Hold new banking details:** Wait a set period, such as 10 business days, before sending money to a newly changed account, and confirm again before the first payment. - **Tell your subs and suppliers your process:** If they know you'll always call to confirm, they'll be suspicious of anyone who says otherwise. - **Lock down email:** Use MFA on every account, block lookalike domains, set up DMARC, and alert on new mailbox forwarding rules. - **Run phishing training for AP and field staff:** The people approving payments need practice spotting fake requests. - **Check your insurance:** Confirm whether your policy covers social engineering and funds transfer fraud, and at what limit. Our post on [what cyber insurers are asking for](https://www.tmgcinc.com/blog/cyber-insurance-requirements-mfa-and-session-monitoring) is a good place to start. At TMGC, we help [contractors](https://www.tmgcinc.com/architecture-engineering-construction-it-services) put these protections in place as part of one flat monthly rate, with projects included. That means email security, MFA, monitoring for suspicious mailbox activity, and ongoing phishing training for your office and field teams. If you want a second set of eyes on how your company handles cybersecurity, [give us a call](https://www.tmgcinc.com/contact).   Our Story Our Story Started in 1999, The Millennium Group Computing is a proud veteran-owned business that is a complete technology solution provider. We are 100% committed to making sure business owners have the most reliable and professional IT service in Denver Metro. Our team of talented IT professionals can solve your IT nightmares once and for all. ###### ![](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1%20(1).webp?width=125&height=108&name=TMGC_Logo_Main_V1%20(1).webp) Who We Serve Who We Serve - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [Engineering](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Defense & Govcon](https://www.tmgcinc.com/it-support-defense-contractors) - [Financial](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) Resources Resources - [TMGC Blog](https://www.tmgcinc.com/blog) - [About Us](https://www.tmgcinc.com/about) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Privacy Policy](https://www.tmgcinc.com/privacy-policy) © 2026 The Millennium Group Computing - Denver's Leader In IT Tech Services [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) *Designed by [Warden Strategy](https://www.wardenstrategy.com/)* Return to top ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony DiDonato", "url" : "https://www.tmgcinc.com/blog/author/tony-didonato" }, "dateModified" : "2026-11-06T14:15:53.247Z", "datePublished" : "2026-11-06T14:15:53.000Z", "headline" : "Invoice Fraud in Construction: How Attackers Hijack Wire Transfers", "image" : [ "https://www.tmgcinc.com/hubfs/invoice%20fraud.webp" ], "mainEntityOfPage" : { "@id" : "https://www.tmgcinc.com/blog/invoice-fraud-construction-how-attackers-hijack-wire-transfers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.tmgcinc.com/hubfs/TMGC_Logo_Main_V1.webp" } } } ```