Email security for construction companies: the risks and how to stop them

Construction runs on email. Bids, drawings, change orders, pay applications and lien waivers all pass between owners, general contractors, subcontractors and suppliers, often read on a phone at a jobsite. Criminals know large payments follow those emails on a predictable schedule. This guide covers the email threats specific to construction, with the FBI's own descriptions, and a checklist you can apply across the office and the field.

Why are construction companies targeted by email?

Construction companies are targeted because they move large, expected payments based on email instructions, among many parties who don't all know each other. A project can involve an owner, a general contractor, dozens of subcontractors and suppliers, and city or county permit offices. Each relationship is a chance for an impostor.

Three things make the industry an easy target:

• Predictable money. Progress payments, retainage releases and supplier invoices arrive on known dates. A fake bank change sent the week before a large draw looks routine.
• Public project data. Permit applications, bid results and public contract awards tell criminals who is working with whom, and for how much.
• Mobile, busy staff. Superintendents and project managers read email on phones between site tasks, where a lookalike address is harder to spot.

The numbers back this up. The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses across all industries (IC3 2025 report). BEC is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money. The same report says IC3 received more than 1,400 ransomware complaints from organizations outside the critical infrastructure sectors. "Contracting services", such as electricians and general contractors, made up 17% of those, second only to legal services.

What email scams target contractors?

Construction companies see general phishing, plus several schemes built around how projects pay and get approved.

Fake bank details on pay applications

The most expensive version is simple. A criminal either compromises a mailbox at a sub, supplier or general contractor, or registers a lookalike domain, then sends new bank details just before a payment is due. If they've taken over a real mailbox, the message can arrive in the existing email thread, with the right project names and amounts. Our guide to vendor invoice fraud walks through the call-back procedure in detail, and email thread hijacking explains how attackers reply inside real conversations.

Here's an example of the kind of message to stop and verify:

Example: "Hi Sarah, ahead of the Pay App #7 payment on the Riverside job, please note we've moved our operating account. Updated ACH details are attached. Please confirm once the system is updated, as the old account closes Friday."

Fake permit fee invoices

In March 2026, the FBI warned that criminals were impersonating city and county planning and zoning officials to request fees for land-use permits (IC3 PSA I-030926-PSA). The FBI says the emails:

• contain "detailed, accurate information" about the request, including property addresses, case numbers and the true names of officials
• come from addresses that look like the planning department's but originate from non-government domains, such as "@usa.com"
• may be timed to coincide with your real correspondence with the city or county
• carry PDF invoices that ask you to request payment instructions by email, rather than telephone, to deter you from calling
• demand payment by wire transfer, peer-to-peer payment or cryptocurrency, and threaten permit delays

The FBI's advice is to call the government office using the number on its official website before paying anything.

Fraudulent orders for building materials

If you supply materials, you can be the victim rather than the payer. The FBI has warned that criminals spoof the email domains of real US companies to place bulk orders, often on Net-30 or Net-60 credit terms, using fake credit references and W-9 forms. Construction materials are the first item on its list of targeted goods (IC3 PSA I-032423-PSA). Vendors usually find out when payment never arrives. The FBI's sample lookalikes for a company using @company.com include @co-pany.com, @company-usa.com and @companygroupinc.com.

How do you stop payment fraud on construction projects?

Stop payment fraud with a process that doesn't trust email alone for any change to where money goes. The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). For a contractor, that becomes:

1. Record bank details at contract signing, along with a named contact and phone number for payment questions.
2. Never change bank details on an email or a PDF. Call the named contact on the number you recorded, not one in the message.
3. Require two people to approve any bank detail change and any payment above a set amount.
4. Hold the payment if you can't reach the contact. A real sub would rather wait a day than lose a draw.
5. Put it in writing to your clients and subs: "We will never change our bank details by email." Add it to your invoices and pay application cover sheets.
6. Check the sender's full domain on every payment-related message, especially on a phone, where only the display name may show.
7. If money has gone, call your bank for a recall at once and file at ic3.gov. The FBI says "time is of the essence."

How do you protect field staff and jobsite devices?

Protect field staff by giving each person their own account with multi-factor authentication, and by keeping company email on managed or at least locked devices. Shared logins such as jobsite1@ are common in construction and are a weak point: everyone knows the password, nobody gets an MFA prompt, and nobody can tell who sent what.

• One account per person for anyone who approves orders, signs change orders, submits pay applications or opens drawings.
• MFA everywhere. CISA's joint phishing guidance recommends phishing-resistant MFA, such as FIDO security keys, and says to prioritize it for administrators and accounts with "broad access to customer or financial data" (CISA). Your AP staff fit that description.
• Lost-device plan. Phones and tablets left in trucks get lost. Make sure you can sign out and wipe company data remotely. See mobile email security and BYOD.
• Fast offboarding. Seasonal and project staff come and go. Disable accounts at the end of the job, as described in employee offboarding.
• Careful with plan-room links. Estimators open many "shared drawings" links. Train them to reach plan rooms by typing the address or using a bookmark. Our guide to file sharing notification phishing shows what fake share alerts look like.

How do you stop criminals impersonating your company?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication and can be rejected. DMARC is a DNS record that tells receiving servers what to do with mail that claims to be from your domain but fails those checks. Start in monitoring mode and move to enforcement once your real senders pass. A record at enforcement might look like this:

_dmarc.example-builders.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-builders.com"

CISA's phishing guidance asks organizations to "ensure DMARC is set to 'reject' for sent emails". Our DMARC from none to reject guide explains the steps.

DMARC doesn't stop lookalike domains such as examplebuilders-inc.com. For those, watch for new registrations and teach clients to call before paying. See lookalike domain phishing.

Construction email security checklist

1. Turn on MFA for every mailbox, starting with accounts payable, project managers and owners.
2. Replace shared jobsite logins with personal accounts.
3. Write down your payment change procedure and share it with clients, subs and suppliers.
4. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
5. Block risky attachment types and macros from outside senders. See dangerous email attachment types.
6. Filter inbound mail for phishing, spoofing and malware before it reaches phones in the field.
7. Check mailboxes for unexpected forwarding rules, a common sign of takeover. See malicious inbox rules.
8. Give staff one easy way to report a suspicious email, and brief estimators and AP staff on the scams above.

Next steps

• Check your domain's SPF and DMARC setup with the free Email Health Check.
• Send your payment change policy to your active subs and suppliers this week.
• Review the wider basics in the small business email security checklist.
• If you're adding a filtering layer, iBlockSpam prices per domain rather than per user, so seasonal crews don't change the bill. Unlimited mailboxes means mailbox count, not message volume: each domain includes 100,000 inbound messages a month.

More threat guides are in our phishing and threats topic.