Key topics covered in this article:

• AI-generated emails, documents, voices, and video can make fraudulent payment instructions difficult to distinguish from legitimate requests.
• A diverted construction payment can disrupt schedules, materials, subcontractor relationships, and claims, not merely create a financial loss.
• The compromise may originate with the contractor, subcontractor, supplier, owner or another participant in the payment chain.
• Independent verification, separation of duties, vendor-master monitoring and rapid escalation can break the fraud chain before or after money moves.
• A companion readiness checklist and focused Construction Payment Fraud Readiness Review create practical next steps for clients.

The pay application was legitimate.

The amount matched the approved schedule of values. The project details were correct. The subcontractor’s lien waiver appeared complete.

Then an email arrived requesting updated banking instructions.

Accounts payable called the number provided in the message. The person answering knew the project, the outstanding balance, and the project manager’s name. To eliminate any doubt, the subcontractor’s “controller” joined a short video call and confirmed the change.

The payment was released.

Several days later, the real subcontractor asked when it would be paid.

The contractor now faces more than a stolen payment. The subcontractor still expects the money it earned. Work may stop. Materials may not arrive. A lien or payment-bond claim could follow. The project team must determine what happened, whether other payments were affected, and whether insurance will respond.

A single diverted payment can quickly become a project issue rather than a finance issue. The legitimate subcontractor or supplier still expects to be paid, while the missing funds may delay materials, interrupt work, disrupt schedules, strain critical relationships and increase the likelihood of liens, bond claims or legal action.

Every approval may have been documented. Every employee may have followed the written procedure.

Nothing appeared suspicious because every verification step pointed to the attacker.

The control still failed because the attacker controlled every source used to verify the request.

AI is changing what “verified” means

Construction companies have traditionally relied on recognizable signals when evaluating a payment request:

• The email came from a known contact.

• The message used familiar project terminology.

• The invoice and supporting documents looked correct.

• The person answering the telephone knew the project.

• The voice sounded familiar.

• The person appeared on video.

Generative AI makes each of those signals easier to imitate.

Criminals can use compromised email accounts, publicly available information, and details collected from previous correspondence to create highly convincing requests. AI can help them reproduce an executive’s writing style, clone a vendor representative’s voice, fabricate supporting documents, or create a synthetic video confirmation.

The FBI reported in 2026 that cyber-enabled crimes resulted in nearly $21 billion in reported losses during 2025, with business email compromise remaining one of the most financially damaging categories of cybercrime.

For construction companies, the exposure is amplified by how money moves through a project.

Payments routinely pass among owners, general contractors, subcontractors, suppliers, and joint-venture partners. Project teams operate across offices and job sites. Urgency is common. Banking changes do occur. Delayed funds can affect labor, materials, and the schedule.

The compromise may occur on either side of the transaction. In some cases, the criminal gains access to the contractor’s email environment. In others, the subcontractor, supplier, owner, or another project participant is compromised. The objective remains the same: monitor a legitimate payment process, learn how the parties communicate, and insert fraudulent instructions at the moment money is expected to move.

An attacker does not need to fabricate an entire transaction. The attacker may only need to redirect one legitimate payment.

The construction payment process creates multiple entry points

Fraud does not begin and end with an invoice.

An attacker may target:

• A subcontractor’s monthly pay application.

• A supplier’s request for a material deposit.

• New instructions for a joint-check payment.

• A retainage release at project completion.

• A refund or credit associated with a change order.

• A payment to a replacement subcontractor or supplier.

• An owner draw or transfer between project entities.

• A final payment submitted with closeout documents.

These transactions often carry supporting documents that make the request appear credible. But a valid pay application, invoice, lien waiver or purchase order does not authenticate the destination of the payment.

That distinction is critical.

A document may prove that an obligation exists. It does not necessarily prove that the bank account receiving the money belongs to the party that earned it.

Five places to break the fraud chain before money moves

1. Separate banking changes from the pay-application process

A request to change payment instructions should follow a controlled process that operates independently from invoice submission and approval.

Employees should never use a telephone number, email address or link contained in the change request to verify that request. Instead, they should contact an authorized person using information previously established in the executed contract, vendor master file or another trusted record.

The question is not whether someone confirmed the change.

The question is whether the organization controlled how that person was reached.

2. Require two independent approvals

No single employee should be able to receive a banking change, update the vendor record, and release the related payment.

One authorized employee should verify and document the requested change. A second employee should independently review the evidence and approve the vendor-master update. The organization may also place a temporary hold on the first payment following a change.

Higher-dollar or unusual requests may require approval from the controller, CFO, or project executive.

Executive urgency should never override the control.

3. Treat certain construction payments as higher risk

Some transactions warrant additional scrutiny because they involve urgency, unfamiliar parties, or a break from established payment patterns.

Examples include:

• Mobilization and material deposits.

• First payments to new subcontractors or suppliers.

• Joint checks and split payments.

• Retainage releases.

• Changes made immediately before a scheduled payment run.

• Payments involving a supplier substitution.

• Closeout payments.

• Requests to send funds to an account outside the vendor’s expected location.

Management should define which circumstances require enhanced review before an incident forces employees to make that decision under pressure.

4. Monitor the vendor master—not only the payment

Many organizations focus their review on the payment amount and approval while giving less attention to changes in the vendor master file.

Management should receive reports showing:

• Recently changed bank accounts.

• Changes made shortly before payment.

• Inactive vendors reactivated for payment.

• Multiple vendors using the same bank account.

• Changes entered and approved by the same person.

• Vendors whose contact or ownership information has also changed.

Internal audit can test whether verification occurred, whether the evidence came from an independent source, and whether the process can be bypassed.

A signed checklist is not enough if the checklist permits someone to verify a request using information supplied by the requester.

5. Prepare for the first hour after discovery

The possibility of recovering a fraudulent payment can decline quickly.

The response plan should identify who will:

• Contact the financial institution and request a recall or freeze.

• Notify leadership, legal counsel and the insurance broker or carrier.

• Preserve emails, access logs, payment records and call information.

• Contact the legitimate subcontractor or supplier.

• Report the incident to the FBI’s Internet Crime Complaint Center.

• Review other recent and pending payments involving the affected project or account.

• Determine whether compromised credentials remain active.

Construction companies should understand in advance whether and how their cyber, crime, social-engineering, funds-transfer-fraud, and other potentially applicable coverage might respond. Recovery often depends on the specific facts, how the payment was authorized, applicable sublimits, or exclusions, and whether the organization satisfied notice and consent requirements.

Management should review priority fraud scenarios with its broker and counsel before an incident occurs.

The issue reaches beyond accounts payable

Protecting construction payments requires participation from more than the finance department.

Project executives and project managers may receive the first request. Procurement controls who enters the vendor relationship. Finance maintains banking information and releases funds. Information technology may identify the compromised account. Legal and risk-management teams may need to address contracts, claims, and insurance.

Subcontractors and suppliers are also part of the control environment. Construction companies should communicate that email instructions alone will not change the approved payment destination, and that banking changes require independent verification.

The process should be intentionally inconvenient for an attacker—even when that creates a small amount of additional work for the organization.

The strongest control may be the simplest

It may simply be an independent verification process that the attacker cannot influence. The organizations most likely to prevent payment diversion are not necessarily those with the most sophisticated technology. They are the organizations that ensure critical payment decisions can be verified through independent, controlled channels that an attacker cannot influence.

Technology can identify suspicious activity and strengthen access controls. It cannot compensate for a process that allows the requester to supply the email address, telephone number, documents, and people used to approve the request.

The question construction leaders should ask

AI-generated emails, documents, voices, and videos will continue to improve. Training employees to “spot the fake” cannot be the primary defense.

The stronger approach assumes that a request may look and sound legitimate.

Construction leaders should ask:

Could an attacker complete our payment-verification process while controlling every source of information our employees use?

If the answer is yes, the company may have a documented process without an effective control.

The most important improvement may be surprisingly simple: one independent contact method, established before the request, that the attacker cannot change.

That additional step can protect more than a payment. It can protect the project schedule, subcontractor relationships, insurance recovery, and the trust required to keep work moving.

Would your payment controls stop a convincing request?

Is your payment process designed to detect a fake—or to remain effective when the fake is impossible to recognize?

PBMares can help you find out before a payment is lost. Our Construction Industry Team and Cyber & Risk Advisory professionals can evaluate how your organization handles vendor onboarding, banking changes, payment approvals and fraud escalation, then identify practical control gaps across finance, project management and technology.

Bring the results to your next leadership discussion and connect with PBMares to schedule a Construction Payment Fraud Readiness Discussion. Together, we can evaluate potential vulnerabilities and pressure-test whether your current controls would stop today’s AI-enabled payment schemes before funds leave your organization.

The strongest control may be the simplest

It may simply be an independent verification process that the attacker cannot influence. The organizations most likely to prevent payment diversion are not necessarily those with the most sophisticated technology. They are the organizations that ensure critical payment decisions can be verified through independent, controlled channels that an attacker cannot influence.

Technology can identify suspicious activity and strengthen access controls. It cannot compensate for a process that allows the requester to supply the email address, telephone number, documents, and people used to approve the request.

The question construction leaders should ask

AI-generated emails, documents, voices, and videos will continue to improve. Training employees to “spot the fake” cannot be the primary defense.

The stronger approach assumes that a request may look and sound legitimate.

Construction leaders should ask:

Could an attacker complete our payment-verification process while controlling every source of information our employees use?

If the answer is yes, the company may have a documented process without an effective control.

The most important improvement may be surprisingly simple: one independent contact method, established before the request, that the attacker cannot change.

That additional step can protect more than a payment. It can protect the project schedule, subcontractor relationships, insurance recovery, and the trust required to keep work moving.

Would your payment controls stop a convincing request?

Is your payment process designed to detect a fake—or to remain effective when the fake is impossible to recognize?

PBMares can help you find out before a payment is lost. Our Construction Industry Team and Cyber & Risk Advisory professionals can evaluate how your organization handles vendor onboarding, banking changes, payment approvals and fraud escalation, then identify practical control gaps across finance, project management and technology.

Bring the results to your next leadership discussion and connect with PBMares to schedule a Construction Payment Fraud Readiness Discussion. Together, we can evaluate potential vulnerabilities and pressure-test whether your current controls would stop today’s AI-enabled payment schemes before funds leave your organization. For more information contact Antonina McAvoy, Partner, Cyber & Risk Advisory or Jennifer French, Partner, Construction Team Leader.