Email security for architecture and engineering firms

Architecture and engineering work moves through email. Proposals, fee invoices, drawing sets, RFIs, submittals and permit applications pass between your firm, clients, subconsultants, contractors and building departments every day. Criminals have learned that pattern: they send fake invoices timed to real fees, fake solicitations that lead to password-stealing pages, and fake permit fee requests. This guide covers the email risks particular to A/E firms and a checklist for a design practice of any size.

Why are architecture and engineering firms targeted?

A/E firms are targeted because they combine large, scheduled payments with heavy file sharing and a lot of public project information. Several features of design practice make attacks easier:

• Fee payments on a schedule. Clients pay design fees by phase, and firms pay structural, MEP, civil and landscape subconsultants on similar cycles. A fake bank change sent just before a phase invoice looks routine.
• Constant file sharing. Drawing sets and models are large, so they arrive as links to file transfer services and project portals. A fake share notification fits right in.
• Public pursuits. Firms respond to public RFQs and RFPs, and award results are published. That tells criminals who you work with and when.
• Permits on owners' behalf. Architects and engineers often handle permit applications, which makes them a target for fake permit fee emails.
• Valuable files. Project archives hold years of drawings, client data and, for some firms, sensitive government work. That makes ransomware painful.

Business email compromise (BEC), fraud in which a criminal impersonates or takes over a trusted email account to redirect money, is the costliest of these. The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses across all industries (IC3 2025 report).

What email scams target A/E firms?

Fake RFPs and bid invitations

Pursuit teams open unsolicited solicitations for a living, so a fake one is an effective lure. Most lead to a credential page dressed up as a document portal. Others misuse an agency's name to extract information or goods. The GSA Office of Inspector General warns that scammers pose as federal, state, local, hospital or university procurement staff, using real officials' names and addresses that look official but use domains like .net, .org or .com (GSA OIG). Its advice applies to any unsolicited request: "Locate the phone number for the listed procurement official using an independent source", and "Be suspicious of any purported procurement officials who refuse to communicate by telephone."

Example: "City of Lakeside, Request for Qualifications: Design Services for Fire Station No. 4. Your firm has been shortlisted. View the RFQ package and addenda here before Friday."

Real public solicitations are normally posted on the agency's procurement portal. If you can't find it there, don't sign in through the email.

Drawing-share and plan-room lures

Fake "files shared with you" notifications are a common phishing lure, and design firms receive real ones all day. The fake page usually asks for your Microsoft 365 or Google password. Our guide to file sharing notification phishing shows what they look like. For attachments, see HTML smuggling attachments and SVG attachment phishing, two formats attackers use to get past filters.

Fake permit fees

In March 2026 the FBI warned that criminals were impersonating city and county planning and zoning officials, with emails containing "detailed, accurate information about planning and zoning requests", and asking for fees by wire, peer-to-peer payment or cryptocurrency (FBI IC3). Firms that file permits for clients are a natural target. Our construction company guide covers the FBI's red flags in detail; the short version is to call the building department on the number from its official website before paying anything.

How should an A/E firm handle fee and subconsultant payments?

Never let an email change where money goes. The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" (FBI IC3). For a design firm, that becomes:

1. Record bank details at contract signing for clients (for refunds) and subconsultants, with a named contact and phone number.
2. Call to confirm any change, using the number you recorded, not one in the email or attached letter.
3. Two people approve any bank detail change and any payment above a set amount.
4. Tell clients your rule. Put "We will never change our bank details by email; call us at the number in our agreement" on every fee invoice.
5. Watch for thread hijacking. A bank change that arrives inside a real project thread can still be fake if the mailbox was compromised. See email thread hijacking.
6. If money has gone, call your bank to recall the payment at once and file at ic3.gov. Our vendor invoice fraud guide covers the first hours.

Do CMMC or federal rules apply to your firm's email?

They can if you design for the Department of Defense. The DFARS final rule that adds the Cybersecurity Maturity Model Certification (CMMC) to DoD contracts took effect on November 10, 2025 (Federal Register). It phases in: "During the first three years of the phased rollout, the CMMC requirement will be included only in certain contracts". After that, it applies where a contractor must use its information systems to handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

For an A/E firm, the practical questions are:

• Does the solicitation include a CMMC level? Read each DoD solicitation and subcontract flow-down.
• Will CUI touch email? Design documents for DoD projects may be marked CUI. If staff email them, your email system is likely to fall within the assessment scope.
• Can you keep CUI out of general email? Many firms use a separate, controlled environment for CUI projects so the rest of the firm isn't in scope.

At the time of writing (November 2026), check DoD's current CMMC program pages for the phase in effect. This is general information, not legal or compliance advice; talk to counsel or a CMMC advisor before bidding.

How do you stop criminals impersonating your firm?

Publish SPF, DKIM and DMARC on your domain and move DMARC to enforcement, so mail faking your exact domain is rejected. DMARC is a DNS record that tells receiving servers what to do with mail that claims your domain but fails authentication. CISA's joint guidance asks organizations to "Ensure DMARC is set to 'reject' for sent emails" (CISA and partners, October 2023). An enforced record looks like this (example domain):

_dmarc.example-architects.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-architects.com"

Before enforcing, make sure every service that sends as your domain passes, including your proposal software, project management platform and accounting system. See authenticating third-party senders and DMARC from none to reject.

DMARC doesn't stop lookalikes such as example-architect.com. Run your name through the Lookalike Domain Generator, and read lookalike domain phishing for next steps.

A/E firm email security checklist

1. MFA on every mailbox, phishing-resistant for principals, finance and IT admins.
2. Payment change rule written down and shared with clients and subconsultants.
3. SPF, DKIM and DMARC on your domain, with DMARC moving to p=reject.
4. Bookmark project portals and file transfer services; never sign in from a share notification.
5. Block risky attachment types from outside senders, including HTML, SVG and macro-enabled Office files. See dangerous email attachment types.
6. Verify solicitations on the issuing agency's own site before opening documents.
7. Confirm permit fees with the building department by phone.
8. Tested, offline backups of project archives, so ransomware doesn't take years of drawings.
9. Check mailboxes for forwarding rules to outside addresses, a common sign of takeover. See malicious inbox rules.
10. Scope CUI before bidding DoD work.

Next steps

• Run the free Email Health Check on your firm's domain to see where SPF, DKIM and DMARC stand.
• Add the bank-change line to your fee invoice template this week.
• Brief your pursuit team on fake RFPs and your project teams on share-link lures.
• If you want inbound filtering in front of Microsoft 365 or Google Workspace with quarantine, attachment filters and domain monitoring, see iBlockSpam for small businesses, priced per domain with unlimited mailboxes. Filtering is one layer; it doesn't replace MFA, payment verification or backups.