Construction Company Cybersecurity: Payment Fraud and Job Sites

A general contractor in Brossard: 40 employees, three active sites. On a Friday afternoon, the controller gets an email from their formwork subcontractor. They've switched banks, here's a void cheque, please use the new account for this month's progress payment. The message lands in the right email thread, with the right invoice number and the right amount. The transfer goes out. Three weeks later, the real subcontractor calls: they were never paid.

There's nothing unusual about this story. According to the Canadian Anti-Fraud Centre (CAFC), construction, contracting and real estate are among the sectors most often targeted by payment redirection fraud. The CAFC reports more than $68 million in spear phishing losses in 2025, and nearly $31 million in the first three months of 2026 alone. In spring 2026, a Quebec business recovered about $3.5 million after two fraudulent wire transfers: banks flagged the beneficiary account and the incident was reported quickly.

Construction isn't targeted by accident. Here's why, and more importantly, how to shut the door.

Why fraudsters love construction

Several features of the industry make fraud profitable and easy to disguise:

• Frequent, large payments. Progress draws, holdbacks, material invoices: money is always moving.
• A long supply chain. Every subcontractor is one more mailbox that can be hacked, and it's often where the fraud starts.
• A predictable calendar. The CAFC notes that fraudsters study language patterns, payment schedules and key contacts before posing as a supplier or contractor.
• Lots of public information. In Quebec, public bodies post tenders and contract information on SEAO; other provinces and the federal government have their own portals. Add site signage, the "Our projects" page on your website and LinkedIn, and anyone can work out who works with whom.
• Approvals squeezed between meetings. A project manager okays an invoice on their phone, in the sun, without checking the sender's address.

This isn't just a Canadian problem. In the UK, the National Crime Agency ranks construction among the two sectors hit hardest by invoice fraud, pointing to complex supply chains, frequent high-value payments and reliance on email for payment instructions.

Anatomy of a payment redirection scam

1. The takeover. Someone at the subcontractor, or at your company, types their password into a fake sign-in page, often after an email like "New tender documents available for review."
2. The watching. The fraudster sets up a rule that quietly forwards emails to an address they control. They read, and wait for the right invoice.
3. The disguise. They reply in the real thread, or from a look-alike domain that's off by a single letter.
4. The ask. A new bank account, a sense of urgency, sometimes a letter "from the bank."
5. The discovery. Weeks later, the real supplier asks to be paid.

The payment procedure that stops fraud

Technology helps, but procedure is what saves the money. It fits on one page:

• Every banking change is confirmed by phone at the number already on file, never the one in the email.
• The person confirming isn't the person who received the request.
• Transfers above a threshold set by management need two approvals.
• A new bank account is never paid the same day the request arrives.
• Invoices that arrive during the construction holiday, summer vacations or year-end get extra scrutiny.
• If in doubt after a transfer: call the bank immediately, then report to police and to the CAFC (online or at 1-888-495-8501).

Our article on vendor banking change fraud includes a full procedure template.

Email: your first technical job

Since the fraud runs through email, that's where to invest first:

• Multi-factor authentication on every account, including shared inboxes and superintendents' mailboxes. The CAFC explicitly recommends it. Our guide to choosing the right MFA method helps you pick.
• Automatic forwarding to outside addresses blocked, with an alert whenever a new inbox rule appears.
• SPF, DKIM and DMARC configured so nobody can send email in your company's name. Our DMARC, SPF and DKIM checker shows where you stand in seconds.
• An "External sender" banner on incoming mail from outside, which helps staff spot look-alike domains.

Job sites, mobile devices and shared accounts

The site office is often a trailer, a cellular router and a few tablets that get passed around. The basics:

• Managed devices. Screen lock, encryption and remote wipe. A tablet left on the dashboard of a pickup holds drawings, photos and open sessions.
• Named accounts. A "site" account shared by six people makes it impossible to know who did what, or to cut off access when someone leaves.
• Temporary access for subcontractors. In your project management software and cloud folders, remove access when the contract ends.
• Changed default passwords on routers, security cameras and other devices installed on site.

Tenders and bid documents

Your bid prices are confidential until opening, and drawings can reveal details about your clients' security systems. Limit who can open bid files, prefer named sharing links that expire, and be wary of fake invitations to tender: if an email asks you to sign in to "view the documents," go directly to SEAO, CanadaBuys or the owner's portal instead.

Finally, picture the worst possible timing: ransomware the night before a major bid is due. Tested offline backups that include your estimating files make the difference between a delay and a lost bid.

Where to start

Start with a written payment procedure and multi-factor authentication: two low-cost measures that block the most common fraud. Our team can then run a cybersecurity audit covering your email accounts, site devices and financial procedures. If your offices are in Greater Montréal, we can also meet you on site.