Payment Diversion Fraud in Construction: Stopping Fake Bank Detail Changes

Construction businesses pay a lot of people. Subcontractors, plant hire firms, merchants and consultants all send invoices, and many of those invoices arrive by email to a small accounts team working to tight payment runs. That makes payment diversion fraud one of the most practical cyber risks a contractor faces. It is not about clever malware. It is about a convincing email asking you to pay a genuine invoice into the wrong account.

This article looks at what payment diversion fraud is, why construction workflows are exposed to it, and the IT and process controls that make it much harder to pull off. It is practical guidance, not legal or banking advice.

What payment diversion fraud is

Payment diversion fraud (PDF) is also known as business email compromise (BEC) or mandate fraud. The National Crime Agency describes it as criminals impersonating others, creating or amending invoices, and diverting payments to bank accounts under their control. The NCSC’s guidance on business payment fraud describes the same pattern: an email tailored to your organisation, appearing to come from someone you deal with regularly, asking you to pay into a different account.

The government’s Stop! Think Fraud campaign breaks it into a few common forms:

• Invoice fraud: a supplier’s mailbox is compromised, or a lookalike domain is registered, and a “new bank details” letter or invoice is sent.
• CEO fraud: someone impersonates a director and pushes for an urgent payment outside the normal process.
• Salary diversion: a fraudster poses as an employee and asks payroll to change where their wages go.

Why construction is exposed

Nothing here is unique to construction, but several everyday habits in the sector line up with what fraudsters look for:

• Lots of suppliers and changing supply chains. New subcontractors are onboarded for each package, so a “new supplier” or “updated details” email does not look unusual.
• Invoices by email from small firms. Many subcontractors run on a single mailbox with no multi-factor authentication. If their account is taken over, the fraudster can reply inside a genuine email thread.
• Pressure around valuations and payment runs. Urgency is the fraudster’s friend, and month-end or year-end deadlines supply it.
• Site and office split. A project manager on site may approve work while the accounts team in the office pays it. Gaps between those two are where an altered invoice slips through.

Supply chain security matters here, which we covered in getting subcontractors onto a sensible cyber baseline.

The single most important control: verify bank detail changes

The strongest defence is a process, not a product. Stop! Think Fraud notes that it is rare for businesses to change bank accounts and that any such request should be treated with caution. The advice from the NCSC and the government campaign is consistent:

1. Never action a bank detail change from the email alone. Call the supplier on a number you already hold, from your own records or a previous contract, never the number in the email or on the new letter.
2. Confirm both the old and the new details with a contact you know at the supplier.
3. Use sign-off and a delay period. Require a second person to approve any change to supplier or payroll bank details. Some organisations hold a new account for a set period before paying into it, giving time to check.
4. Write it down and tell people. Put the process in your accounts procedures and tell suppliers how you will, and will not, notify them of changes to your own details.

Make the process easy to follow on a busy day. If checking takes ten minutes and a phone number is hard to find, people will skip it.

Confirmation of Payee helps, but is not proof

UK banks offer Confirmation of Payee, a Pay.UK service that checks the name you enter against the account’s sort code and account number and returns a match, close match, no match or unavailable result. A “no match” is a genuine warning sign and should stop the payment until you have checked by phone.

A match is not proof that the request is genuine, though. Banks themselves point out that fraudsters can open accounts in a name that matches, or talk staff into ignoring a mismatch. Treat Confirmation of Payee as one check alongside the call-back, not instead of it.

IT controls that cut off the easy routes

Process stops the payment. IT reduces how often a convincing fake email reaches the accounts team in the first place:

• Multi-factor authentication on every mailbox, especially finance, payroll and directors. The NCSC’s guidance on business email compromise names 2-step verification as a key protection.
• Email authentication for your own domain. Set up SPF, DKIM and DMARC so it is harder for someone to send email that appears to come from you.
• External sender warnings and lookalike domain checks so staff can see when a “supplier” email actually comes from outside your known contacts.
• Least privilege. Only the people who need to change supplier bank details in your finance or ERP system should be able to, and changes should be logged.
• Alerts on mailbox rules. Compromised accounts often have hidden forwarding or auto-delete rules added. Monitoring for new rules on finance mailboxes is a cheap win.
• Clean leavers. Former staff and finished subcontractors should not keep access to finance systems or shared mailboxes. See joiners, movers and leavers access that actually works.

Staff awareness rounds this off. The NCSC suggests making sure staff know the normal way key tasks such as payments are done, so unusual requests stand out. That fits with our view that phishing is a staffing problem as much as a technical one.

If a payment has already gone

Speed matters. The NCSC’s advice is to report it internally to IT straight away and contact your bank directly using its official website or phone number. Report it to Action Fraud as well. Then treat it as a possible account compromise: reset passwords, check mailbox rules and sign-in history, and check whether your own email was used to contact customers.

Quick checklist

• Bank detail changes verified by phone on a known number, never from the email
• Two-person sign-off for supplier and payroll bank changes
• Confirmation of Payee used, with “no match” treated as a stop
• MFA on all finance, payroll and director mailboxes
• SPF, DKIM and DMARC configured on your domain
• Alerts for new mailbox forwarding rules
• Supplier onboarding that sets out how payment details are changed
• A short, rehearsed plan for what to do if money goes to the wrong account

If you would like help reviewing your payment controls, email security or finance system permissions, KPCR offers IT consultancy and managed IT services for UK businesses. Get in touch for a practical conversation.