ProofRelaySubcontractor payment fraud in construction
Construction has a structural problem with payment fraud that most industries do not: subcontractors genuinely do change bank details. New entities, factoring arrangements, restructures, a different account for a different site. The change request that would look alarming anywhere else looks ordinary here.
That normality is the vulnerability, and it is why builders and civil contractors are consistently targeted.
Why the industry's normal practice creates the opening
- Progress claims arrive by email as attachments, from many parties, on a monthly cycle everyone can predict.
- Payment runs are large and processed in batches, so an individual line gets little attention.
- Subcontractors appear and disappear between stages, so an unfamiliar name is not itself suspicious.
- Genuine bank-detail changes are common enough that staff are trained, in effect, not to find them odd.
- The claim cycle is time-pressured, and delaying a subcontractor's payment has real consequences on site.
In most industries a bank-detail change is rare enough to be a signal. In construction it is routine — so the signal has to come from the verification, not from the surprise.
Where it usually lands
Two patterns dominate. In the first, a subcontractor's mailbox is compromised and their next progress claim arrives with altered payment details — genuine claim, genuine amount, genuine sender, wrong account.
In the second, someone impersonating a subcontractor emails the accounts team ahead of the claim to update details on file, so that the next legitimate claim pays out to them automatically. This one is more dangerous because the fraudulent step and the payment are separated in time, and nothing looks wrong on the day the money moves.
Controls that work on a real payment run
- Treat a bank-detail change as a separate event from the claim it arrives with. Approve the work and the account separately — the claim can proceed while the account is verified.
- Verify by phone on the number in your subcontractor records, established when they were onboarded, never a number in the change request.
- Where a change is attributed to factoring or a new entity, ask for it on letterhead and confirm the entity's ABN and registered name independently. This is the one case where paperwork genuinely helps, because a legitimate restructure can produce it easily.
- Check the payment run against verified accounts before releasing the batch, not line by line during preparation. A batch-level check catches the line nobody looked at.
- Require a second approver for any line paying an account changed since the previous run.
The retention and final-claim moment
Final claims and retention releases deserve particular care. They are large, they often come after a gap in contact, and by then the subcontractor's details may not have been used for months.
A long gap since the last payment is precisely when a compromised mailbox goes unnoticed and when a change request is least likely to be questioned. Verify these even when the account looks familiar.
Call the supplier on a number you already had — from an earlier invoice, their website that you navigated to yourself, or your own records. Never a number written in the email or invoice you are checking. The person who wrote that document chose that number.
Common questions
Subcontractors change details all the time. Won't verifying every change slow us down?
Only slightly, and only on the exceptions. A call takes a few minutes and does not have to hold up the claim itself — approve the work, verify the account in parallel, release when both are done. Against the cost of one redirected progress payment, it is not a close comparison.
What about payments to a factoring company?
Legitimate factoring arrangements are documented and the factor is a real, checkable business. Ask for the assignment notice, confirm the factor's ABN and registered name independently, and call the subcontractor on your existing number to confirm they entered the arrangement. Attackers use factoring as a cover story precisely because it explains a change of account.
Does the security of payment legislation affect this?
It governs your obligation to pay a valid claim within statutory timeframes — it says nothing about which account the money goes to. Verifying the destination does not put you at risk of a late payment if you approve the claim on time and resolve the account in parallel.
Related guides
- Is this invoice a scam? Seven checks before you pay
The seven things worth checking on an invoice that doesn't feel right, and the one check that actually settles it.
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- You've paid a scammer. What to do in the first hour
If money has already gone, speed decides the outcome. The order of operations that gives you the best chance.