It usually starts with a perfectly ordinary email. A regular supplier writes to your accounts team to say they’ve changed banks and would like the next payment to go to a new account. The logo is right, the signature is right, and it even replies to a genuine thread about last month’s invoice. Your team updates the details, the stage payment goes out, and nobody realises anything is wrong until the real supplier rings to ask where their money is.
By then, the funds have usually been moved on, and getting them back is difficult.
This is payment diversion fraud (sometimes called invoice fraud or business email compromise), and construction is one of the sectors that criminals like most. If you run a contractor or specialist firm with somewhere between 20 and 150 people, it’s worth understanding why.
Criminals go where the money moves, and in construction, the money moves constantly and in large amounts. A typical project involves dozens of suppliers, plant hire firms and subcontractors, with valuations, retentions and stage payments flowing back and forth for months. Large, irregular payments are normal, so an unusual one doesn’t stand out.
The way the industry works adds to the risk. Project managers and quantity surveyors are often on site, checking emails on their phones between meetings. Accounts teams tend to be small and busy. Suppliers change, new subcontractors come on board mid-project, and bank details genuinely do get updated from time to time. All of this gives a fraudster plenty of cover.
On top of that, contract values and tender outcomes are often public. It doesn’t take much research to work out who’s building what, who’s likely to be supplying them, and roughly when payments are due.
There are two common versions.
In the first, the criminal simply impersonates a supplier using a lookalike email address. Instead of accounts@smithscaffolding.co.uk, the email comes from accounts@smith-scaffolding.co.uk. On a phone screen, in a hurry, it’s very easy to miss.
The second version is more sophisticated and more dangerous. The criminal gains access to a real mailbox, either yours or your supplier’s, usually by stealing a password through a fake Microsoft 365 login page. Once inside, they sit quietly and read. They learn who pays whom, how invoices are worded, and when the big payments are due. Then, at exactly the right moment, they send a request from the genuine account, often setting up a rule that hides any replies from the real owner.
Because the email comes from a real address inside a real conversation, even careful staff can be fooled.
The good news is that most of these attacks can be stopped with a combination of sensible technology and a few simple habits.
Turn on multi-factor authentication for everyone. If a criminal steals a password but can’t get past the second check on the user’s phone, the most dangerous version of this attack is stopped in its tracks. For a Microsoft 365 business, this is one of the most effective protections available, and it costs nothing extra in most licences.
Make bank detail changes a phone call, every time. Agree on a rule that any request to change bank details is verified by calling the supplier on a number you already hold, never a number provided in the email. It takes two minutes and it defeats the scam outright. Write it into your finance procedures so it doesn’t depend on someone remembering.
Use two people for significant payments. A second approver for new payees or large amounts gives a fresh pair of eyes a chance to spot something odd.
Get your email security properly configured. Settings such as SPF, DKIM and DMARC help stop criminals sending emails that pretend to come from your domain. Good email filtering will also flag lookalike domains and warn staff when a message comes from outside the business.
Watch for suspicious mailbox activity. Alerts for unusual sign-ins (for example, a login from overseas at 3am) and for new forwarding or hiding rules can catch a compromised account before any money moves.
Train your people, especially accounts and site managers. Short, regular awareness sessions, including realistic practice phishing emails, help people pause before they click. The aim isn’t to make anyone paranoid, it’s to make checking feel normal.
Act quickly. Contact your bank immediately, as there’s sometimes a short window to freeze funds. Report it to Action Fraud. Reset the passwords on any affected accounts, check for mailbox rules you didn’t create, and tell the supplier so they can check their own systems too. The faster you move, the better your chances.
We work with construction businesses to put these protections in place without getting in the way of how your teams work. That means setting up multi-factor authentication that’s easy to use on site, configuring your email security properly, monitoring your Microsoft 365 environment for warning signs and giving your people practical, jargon-free training.
If you’d like to know how exposed your business is today, we’re happy to take a look. Call us on 01926 942 150 or visit magnetarit.co.uk to book a conversation.
Date: September 29, 2026
Author: Rafael Macedo