Your Name on a Fake Invoice: How Attackers Use Construction Companies to Steal from Their Clients — and What That Means for Your Business
THE SHORT ANSWER
A Minnesota developer lost $735,000 when attackers manipulated email communications and rerouted a subcontractor payment. A North Carolina church lost $793,000 because fraudsters impersonated their construction company. The City of Athens, Ohio lost $721,976 to someone posing as Pepper Construction. The construction industry accounts for over $1.2 billion in annual email fraud losses in the US alone. Your firm is exposed from both directions — as the target paying a fake invoice, and as the identity being spoofed to steal from your clients. Either way, the attack starts with one email and an email environment that was never hardened to stop it.
IT Accuracy | Managed IT Services, Los Angeles | Date: May 1, 2026 | 9 min read
AT A GLANCE
AT A GLANCE
The general contractor did not get hacked. Nobody broke into their server. Nobody stole their client list. Attackers simply registered a domain one character off from their company name, created an email address that looked identical at a glance, and used it to intercept a payment that a long-standing client was expecting to make. The client wired the money. The GC never received it. Both parties were victims. For construction companies in Los Angeles, where active projects, rotating subcontractors, and high-value billing cycles are the norm, this is not a distant threat. It is an active one. Construction email security in Los Angeles starts with understanding how the attack works before it reaches your billing cycle.
Three Real Cases. Three Different Victims. The Same Attack.
The documented cases of construction-related email fraud share a consistent structure: an attacker inserts themselves into a trusted payment relationship, swaps the bank details, and the money moves before anyone realizes the email was fake. What varies is who bears the loss.
Three cases. A developer. A church. A city. Combined losses of over $2.25 million across incidents where the common denominator was the construction billing relationship. In the Elkin Valley and Athens cases, the construction firm itself was not the direct financial victim. But their name, their domain, and their trusted relationship with the client was the weapon. That exposure does not require your systems to be breached. It requires your domain to be spoofable — and most construction company email environments are.
Why Construction Is the Perfect Target
Email fraud targeting invoice payments is not randomly distributed. It concentrates where the conditions favor it: high transaction values, multiple simultaneous vendor relationships, time pressure on billing cycles, and an email-centric culture where payment changes are communicated routinely. Construction checks every box — and in a market like Los Angeles, where GCs regularly run multiple concurrent projects across different neighborhoods and trade relationships, the attack surface is especially wide.
A general contractor running three active projects may be managing invoices from twenty or thirty subcontractors simultaneously. Framing, concrete, electrical, plumbing, HVAC, roofing — each with their own billing cycle, their own contact at accounts payable, and their own history of prior payments that establishes credibility. When an invoice arrives at the expected time for approximately the expected amount from what appears to be the expected sender, it does not get scrutinized. That is the gap the attack lives in.
The subcontractor relationship structure creates a second exposure that most GCs have not thought through. Attackers do not need to compromise your systems to steal from you. They can compromise a subcontractor’s email account, monitor the billing relationship, and insert a modified invoice at the moment a payment is due. The payment goes to a criminal account. The real subcontractor calls asking why they have not been paid. You are now liable for both the fraudulent payment and the original invoice. Email security configured for construction environments in Los Angeles means closing this gap at both ends of the relationship — protecting your domain from being used to defraud your clients, and protecting your inbox from being monitored to defraud you.
The double liability nobody talks about
When a construction company pays a fraudulent invoice, it is still legally obligated to pay the real one. The fraud does not extinguish the underlying contract. A $200,000 payment intercepted by an attacker leaves the firm owing $200,000 to the real subcontractor on top of the loss. That double exposure is why the true cost of a single incident almost always exceeds the intercepted payment amount.
THE EMAIL FRAUD NUMBERS THAT DEFINE CONSTRUCTION'S EXPOSURE
Real estate and construction BEC losses in 2023
$1.2B
Reported to the FBI — among the most targeted sectors in the country
Average BEC claim cost in 2024
$183,000
Up from $84,000 in 2023 — a 118% increase in a single year
Vendor email compromise increase in 2023
137%
Year over year, with construction among the most affected industries globally
How the Attack Works: From Your Domain to Someone Else's Bank Account
Understanding the mechanics makes it clear why most construction companies have no idea how exposed they are. The attack does not require any technical sophistication on the attacker’s part or any mistake on your part — beyond having an email environment that was set up without the specific controls that prevent spoofing.
HOW A CONSTRUCTION INVOICE FRAUD ATTACK UNFOLDS STEP BY STEP
Your company is identified as a target identity
Attackers search public permit records, LinkedIn, your website, and Procore or similar platforms for information about your active projects, client relationships, and billing contacts. They identify which clients owe you money and when payments are typically due. This takes under an hour.
A lookalike domain is registered
yourgcfirm.com becomes yourgc-firm.com, or yourgcfirms.com, or yourgcfirm.net. The difference is invisible in a busy inbox or on a mobile device. Because most construction company domains have no DMARC enforcement, the receiving mail server has no way to reject email impersonating your domain. It arrives in the client’s inbox as legitimate-looking correspondence.
A timed invoice is sent to your client
An invoice arrives in your client’s AP inbox at the expected point in the billing cycle, formatted identically to prior legitimate invoices, for an amount consistent with the project scope. The only change is the bank account or wire instructions. The email explains this plausibly: a new banking partner, an accounting system migration, a treasury management change.
The client processes payment to the fraudulent account
The AP clerk or project manager approves the payment. It matches an expected vendor and an expected amount. The funds move to a criminal-controlled account, often overseas. The attacker immediately begins moving the money onward through layered accounts to make recovery nearly impossible.
You discover it when your client asks why you have not invoiced yet
Or when they say they already paid. At that point the client relationship is damaged regardless of who absorbs the loss. In the Athens and Elkin Valley cases, the real construction firm had done nothing wrong — and still had to manage the aftermath of their name being used to commit fraud against someone who trusted them.
The Controls That Stop It Before Stage Three
Every stage of this attack has a corresponding control. None require exotic technology. All require deliberate configuration that most construction company email environments have never received.
The most important is DMARC at enforcement. SPF, DKIM, and DMARC working together at enforcement policy tell receiving mail servers to reject email that claims to come from your domain but cannot pass authentication. This directly stops the lookalike domain spoofing scenario that enabled the City of Athens attack and the Elkin Valley Baptist Church attack. A client whose mail server checks DMARC would have seen those emails rejected before they reached anyone’s inbox. Most construction company domains have no DMARC policy at all, which means any attacker can register a lookalike domain and send email that appears to come from your company with nothing to stop it. IT Accuracy’s email security service implements and maintains DMARC at enforcement as a baseline deliverable for every client.
The second control is MFA on every email account. The Beck Properties case involved email communications being manipulated — which in higher-sophistication attacks means the attacker gained access to a real inbox and monitored it before acting. MFA stops that. A stolen or phished password does not get an attacker into the inbox if accessing it requires a physical device they do not have. Every email account involved in project billing, client communication, and subcontractor coordination should require MFA. Many construction firm email setups, particularly accounts accessed from job site tablets or shared project management inboxes, do not enforce this. This is part of the security posture IT Accuracy’s cybersecurity assessment covers for construction clients.
The third control is a payment change verification protocol. No technology required — just a written policy stating that any change to payment details must be confirmed by a callback to a number already on file in your accounting system. Not a number in the email. Not a callback to the number provided in the change request. One rule, communicated to every person with AP access, stops the majority of invoice fraud attempts before any wire moves.
The construction industry is a prime target due to its high-value transactions, frequent invoicing, and often limited cybersecurity resources, especially among small, family-run businesses. Cybercriminals monitor email conversations, set up hidden rules that automatically forward messages containing keywords like invoice or payment, and use this access to execute fraud over weeks without detection.
Australian Federal Police, Operation Dolos advisory on business email compromise in the construction sector, October 2025
What Your Firm Can Do Before the Next Invoice Goes Out
You do not need a full IT engagement to close the most critical gaps. Construction email security in Los Angeles does not start with a six-month project. There are three things you can verify or implement immediately that address the primary vectors illustrated by all three cases above.
Three immediate actions for construction firms — do these before the next billing cycle
Check your DMARC policy today. Go to mxtoolbox.com and enter your company domain. If DMARC is missing, set to “none,” or set to “quarantine” rather than “reject,” attackers can send email impersonating your company to your clients right now with no technical barrier. This is the gap that enabled the City of Athens attack. Your IT provider should be able to move this to enforcement within a day. If they cannot tell you what your DMARC policy is, that is itself the answer.
Enforce MFA on every email account your team uses for client and subcontractor communications. This includes accounts accessed from job site tablets, shared project inboxes, and any account that has not been reviewed since it was originally set up. If any account can be accessed with a username and password alone, a phished or purchased credential is all an attacker needs to monitor your billing relationships silently for weeks. The Beck Properties attack involved email manipulation that MFA would have significantly complicated.
Write and communicate a bank account change policy. One sentence is enough: no change to payment details will be acted on without a verbal confirmation using a number already on file in your accounting system. Every person with AP access at your firm needs to know this rule exists. The Elkin Valley Church loss could have been stopped at this step. The clerk was following what appeared to be legitimate instructions. A protocol requiring a callback to a known number would have revealed the fraud before the wire moved.
Your clients may hold you responsible even if you are the identity victim
In the Elkin Valley and Athens cases, the real construction firm bore significant reputational and relationship damage even though their systems were not compromised. Clients who lose money to a fraudster impersonating your company may pursue legal claims based on the argument that your domain was spoofable and your email environment had no authentication controls. DMARC at enforcement is increasingly cited in these disputes as the standard of care that a legitimate business should have in place.
NETWORK SECURITY TOPIC CLUSTER
IT Accuracy
Managed IT Services — Los Angeles, CA
IT Accuracy provides cybersecurity and security awareness training, managed network services, cloud solutions, and help desk support for businesses across Los Angeles and nationwide.