Payment Fraud Prevention for the Construction Industry

The Australian Federal Police and the Australian Signals Directorate have both issued specific warnings about business email compromise (BEC) scams targeting the construction industry. Construction is not just vulnerable by accident. The way the industry operates creates the exact conditions that payment fraud exploits.

Construction projects involve dozens of subcontractors, each with their own ABN, bank account, and invoicing process. New subcontractors appear on every project. Existing subcontractors change bank details when they switch providers, restructure their business, or set up project-specific accounts. Your accounts payable team is constantly processing new and updated banking information.

Payments are high-value and time-sensitive. Progress claims, retention releases, and variation payments can run into hundreds of thousands of dollars. Delays cause site shutdowns, contractual disputes, and relationship damage. This time pressure is exactly what scammers exploit: they know your team is under pressure to get payments out, and that pressure leads to shortcuts in verification.

The prevalence of sole traders and small subcontractors makes things worse. These businesses often lack corporate email domains, making it easier for scammers to impersonate them with free email accounts. A spoofed email from a sole trader plumber is much harder to detect than one from a large engineering firm with a corporate domain.

Most construction businesses verify subcontractors at the start of a project. They check the ABN on the Australian Business Register, confirm insurance certificates, and collect bank details. But this initial check has two critical gaps.

First, it does not confirm that the bank account belongs to the ABN holder. An ABR lookup tells you that the ABN is valid and active. It does not tell you who owns the bank account on the invoice. A scammer can use a real ABN with a fraudulent bank account, and the ABR check will pass.

Second, the initial verification does not protect you for the life of the project. Subcontractors submit multiple progress claims over months or years. Between claims, their bank details might change legitimately, or a scammer might submit a fraudulent change. Without re-verification before each payment, you are relying on the assumption that nothing has changed since the last check.

For head contractors managing large projects with 50 or more subcontractors, the volume makes manual verification impractical. You cannot call every subcontractor before every progress payment. The process either becomes a bottleneck that delays payments, or it gets skipped under time pressure. Neither outcome is acceptable.