Ask a builder what a cyber attack looks like and most will describe something dramatic — screens locked, a ransom note, the office at a standstill. That happens. But the attack that actually costs the construction industry the most money is quiet, patient, and usually involves nobody at the victim's end noticing anything was wrong until the money has gone.
It is called business email compromise, or in its most common form, payment redirection fraud. The Australian Cyber Security Centre consistently reports it among the highest-cost categories of cybercrime reported by Australian businesses, and the construction sector has a particular set of characteristics that make it an attractive place to run it.
Why construction, specifically
Three things line up.
The amounts are large. Progress claims, subcontractor payments, deposits and retention releases are routinely five and six figures. A single successful redirection can exceed what most other small-business frauds would net in a year.
The timing is predictable. Progress claims run on a schedule — often a statutory one under security of payment legislation, with defined windows for claims, schedules and payment. An attacker who has been reading a mailbox knows roughly when the next large payment conversation will happen and can be ready for it.
The parties often do not know each other well. A head contractor, a subcontractor they have used twice, a supplier's accounts team, a client's project manager — money moves between people who communicate almost entirely by email and would not recognise each other's voice. Nobody thinks it odd to receive banking details by email, because that is how it has always been done.
Put those together and you have exactly the conditions a patient criminal wants: a large, scheduled payment, discussed over email, between parties who will not verify by any other channel.
How the attack actually works
The common assumption is that it involves a fake email address — a lookalike domain, a misspelled company name, something a careful reader would catch. Sometimes it does. But the version that succeeds most often is worse than that.
The attacker gets into a real mailbox. Usually through a phishing email that harvests a password, sometimes through a password reused from another breached service, occasionally by guessing. Once in, they do not announce themselves. They read. They set up a mailbox rule that quietly forwards or hides certain messages. They learn who pays whom, how invoices are formatted, who signs off, and when the next claim is due.
Then, at the right moment, they intervene in a genuine conversation. A real invoice is intercepted and re-sent with the bank details changed. Or a message goes out — from the correct address, in the correct tone, referencing the correct project — advising that the account has changed. Nothing about the email is fake. It is a real email from a real account about a real payment. The only false thing in it is the BSB and account number.
The money is paid. It is usually moved out of the receiving account within hours. By the time the legitimate supplier chases the unpaid invoice — often weeks later — recovery is close to impossible.
The controls that actually work
Because the attack starts inside a mailbox rather than with a fake domain, the effective defences are the ones that protect and watch the mailbox. In order of impact:
- Verify every change of bank details by phone, to a number you already hold. Not a number in the email. Not a number on the invoice. A number from your existing records or the supplier's website. This costs nothing, takes two minutes, and defeats the attack completely — the attacker controls the email, not the supplier's phone. Make it a written rule, apply it without exception, and make sure the accounts team knows they will never be criticised for a two-minute delay.
- Multi-factor authentication on every account, especially email. A harvested password on its own should not be enough to get in. This is the single technical control that stops most mailbox compromises before they start.
- Alerting on suspicious mailbox rules and unusual sign-ins. Attackers almost always create forwarding or hiding rules, and they almost always sign in from somewhere your staff never do. Both are detectable if someone is watching, and neither is visible to the account owner.
- Email filtering that flags external senders imitating internal ones, and that marks messages from outside the organisation clearly. This catches the cruder lookalike-domain version.
- Scoped, time-limited access for subcontractors and project staff. The mailbox that gets compromised is frequently one nobody has looked at in months — a former estimator, a subcontractor who finished last year — still active because nobody removed it.
Notice that the most effective control on that list is not technical at all. The technology narrows the attack surface; the phone call closes it.
What to do if it has already happened
Speed matters more than anything. Contact your bank immediately and ask them to attempt recall of the payment; the receiving bank may be able to freeze funds if they have not yet moved. Report it to ReportCyber, the ACSC's reporting portal. Change the password and revoke sessions on every account that may have been involved, and check for mailbox rules you did not create — they are commonly left behind. Then work out how the attacker got in, because until that is known, assuming it is over is a mistake.
Where this sits in the bigger picture
None of this is exotic, and none of it requires enterprise tooling. It requires the mailbox to be treated as the financial system it has quietly become. That is the starting point of how we approach IT for construction and trades businesses: site access and document control matter, but payment fraud is the thing most likely to cost a builder real money this year.
If you want to know how exposed you are, the cyber security assessment we run starts with the mailbox for exactly this reason — and the honest answer for most businesses we look at is that MFA is partly rolled out, nobody is watching for mailbox rules, and there is no written verification rule for bank changes. All three are fixable in a week.
*Last updated: 17 September 2026.*