How should construction firms verify bank change requests?

What is construction payment fraud?

Construction payment fraud usually starts with a routine-looking message: a subcontractor, supplier or owner asks to change the bank account for future payments. The message comes from a compromised or look-alike email account, and the next progress payment lands in an account the criminal controls. Vendor bank account verification, a callback before any change takes effect, is the control that stops it. The FBI tracks this scam as business email compromise (BEC). Its 2025 Internet Crime Report counts 24,768 BEC complaints and more than $3 billion in adjusted losses for the year.

BEC does the most damage where large, routine payments move on a predictable schedule, and a general contractor fits that pattern closely. It pays dozens of subcontractors and suppliers on a monthly cycle, the amounts are large and expected, and project announcements and job signs make it easy to learn who works for whom. Architecture and engineering firms face the same risk from the other side, when a client's accounts payable team receives a fake request to redirect the firm's fees.

Why are progress payments an easy target?

The payment is already expected, the amount is already approved, and the only thing the criminal has to change is the destination. By the time a pay application reaches accounts payable, the project manager has reviewed it, lien waivers are moving, and the payment run has a deadline. A request to update banking details right before that run reads like administrative cleanup.

Timing is part of the attack. A criminal who has been reading a vendor's mailbox knows when the next pay application is due, which project it belongs to and who usually signs off. The fake request can reply inside a real email thread, use the vendor's real invoice format and arrive the same week the money is scheduled to move.

How does vendor bank account verification work?

Call the vendor at a phone number you already had on file, and never use a number provided in the request. The FBI's guidance on payment change fraud says to "verify all payment changes and transactions in person or via a known telephone number" and to contact vendors "through telephone numbers on file rather than through a number provided in emails" (FBI PIN 20210317-001). Its 2024 BEC alert adds using secondary channels or two-factor authentication to verify requests for changes in account information.

A written procedure makes that check happen when people are busy:

• Accept bank changes only on a signed form, and never on the strength of an email alone.
• Call back using the number in your vendor master file or the subcontract, and speak with someone you already know at the vendor.
• Have a second person, other than the one who made the call, approve the change in the accounting system.
• Hold or flag the first payment to a changed account, or confirm a small test amount with the vendor before the full payment goes out.
• Log who called whom, when, and on what number.
• Treat urgency as a warning sign. The FBI tells payers to "be skeptical of unexplained urgency regarding payment requests."

The same discipline protects your receivables. Tell clients in writing, at contract signing, that your firm's bank details will never change by email, and that they should call a named person at a known number before sending funds anywhere new.

Can you confirm who owns a new bank account?

Partly. Many banks and accounts payable platforms offer account validation services that check whether an account is open and whether the account holder's name matches the vendor on file. Ask your treasury management contact what your bank offers for ACH and wires. Treat a match as supporting evidence for the callback, never as a substitute, because a criminal can open an account under a name close to your vendor's.

Do the 2026 Nacha rules affect firms that pay by ACH?

They may, if your firm originates ACH payments through its bank. Nacha's fraud monitoring rule took effect in two phases in 2026: March 20 for the largest Originators, and June 22 for all other non-consumer Originators (the official June 19 date fell on a federal holiday). It requires risk-based processes reasonably intended to identify ACH entries suspected of being unauthorized or authorized under False Pretenses, and a review of those processes at least annually.

Nacha defines False Pretenses as inducing a payment by misrepresenting a person's identity, their association with or authority to act for another person, or the ownership of the account to be credited. A fake bank change request fits that definition. The rule does not require screening every payment individually, but Nacha says that at a minimum a party should conduct a risk assessment that separates higher-risk transactions from lower-risk ones. A first payment to a recently changed account is an obvious higher-risk case.

Your bank's ACH agreement governs how the rules apply to your firm. Ask your treasury management contact what the bank expects from Originators and which tools it offers, such as positive pay or account verification, for ACH and wires.

What role does email security play?

Most payment change fraud depends on a mailbox, either the vendor's or yours. When the vendor's mailbox is the one taken over, the scheme is often called vendor email compromise. Once a criminal controls an account, they can read real invoices, reply inside real threads and create rules that hide replies from the real owner. The FBI recommends requiring multi-factor authentication for all email accounts and prohibiting automatic forwarding of email to external addresses (FBI PIN 20210317-001).

In Microsoft 365, that translates to a short list:

• Multi-factor authentication for every user, including field staff and shared project mailboxes.
• Alerts when someone creates an inbox rule or sets up external forwarding.
• External sender tags, so a look-alike domain stands out.
• Review of unusual sign-ins on accounts payable, controller and project manager accounts.

Mailbox security on your side cannot stop a request sent from a subcontractor's compromised account. The callback is what catches that case.

What if a payment already went to the wrong account?

Call your bank immediately and ask it to recall the funds, then file a complaint at ic3.gov. The FBI's 2024 alert says to "immediately contact your financial institution and request a recall of the funds" and to file with IC3 regardless of the amount lost. Speed matters: the 2025 report says the IC3 Recovery Asset Team's Financial Fraud Kill Chain froze about $679 million in 2025 and reports a 58 percent success rate.

After the bank and IC3, secure the mailbox involved, preserve the change request and its email headers, and notify your insurance carrier. Then tell the real vendor, since their mailbox may still be compromised and their other customers may be next.

What should you do this quarter?

• Write a one-page bank change procedure and have the controller and project managers sign off on it.
• Review vendor master changes from the last 12 months and confirm each one was verified by a callback.
• Ask your bank how its Nacha fraud monitoring expectations apply to your ACH payments.
• Send subcontractors, suppliers and clients a short notice that bank details change only through a callback.
• Turn on multi-factor authentication and forwarding alerts in Microsoft 365 if they are not already on.
• Run a short tabletop with accounts payable: a convincing change request arrives two days before a payment run. Who calls whom?

How can s90 help?

s90 supports architecture, engineering and construction firms in Los Angeles and Orange County. We harden Microsoft 365 against mailbox takeover, set up alerts on forwarding and inbox rules, and help controllers document a callback procedure that fits the pay application cycle. If a bank change request ever feels off, call us and we can review the email trail with you before any money moves.