Your Subcontractor Was Never Paid Because the Draw Went to a Fake Account

Your project manager calls on a Tuesday morning. The framing subcontractor on your Frisco job says they never received last month's progress payment. Your accounting team is confused, because the payment went out nine days ago, on time, to the bank account the subcontractor's office asked you to use. That account was not theirs. The money is gone, the crew wants to be paid, and the owner's lender wants a clean lien waiver before it releases the next draw.

This is business email compromise, or BEC, landing on a construction job. BEC is the name for a scam where a criminal gets into, or convincingly imitates, a real business email account and uses it to redirect a payment. It is the most common reason North Texas businesses call us after something goes wrong, and construction is one of the places where it hurts most. A single progress payment can be six figures, the payment schedule is predictable, and dozens of companies email bank details back and forth on every project.

This post is written for the person who has to deal with it: the owner of a general contracting firm, the controller, the project accountant, or the developer who funds the draws. It covers what to do in the first hour, why a construction payment fraud can leave you owing the same money twice, and how to sort out the subcontractor, the owner, the lender and the insurance carrier without making it worse.

How a Progress Payment Ends Up in a Criminal's Account

Most construction payment fraud does not start with a hacker breaking into your accounting software. It starts with an email account. Somebody at the subcontractor's office, or at your own office, clicks a fake Microsoft sign-in page and types in a password. The criminal now reads that mailbox quietly, sometimes for weeks. They learn which projects are active, who approves pay applications, when draws are funded and how the people involved write to each other.

Then they wait for the right moment. Usually that is just after a pay application is approved. A message arrives inside the real email thread about that pay app, from the subcontractor's real address, saying their bank has changed and attaching a new voided check or a letter on their letterhead. Because the message really did come from the subcontractor's account, every tip about checking the sender address fails. We covered that general pattern in our post on a supplier's real mailbox sending new bank details. Construction adds a few things that make it worse.

The first is volume. A mid-size general contractor in Collin County may pay forty subcontractors and suppliers on a single project, and bank changes are routine because subcontractors switch banks, merge or start factoring their receivables. The second is timing. Draw schedules are monthly and predictable, so the criminal knows exactly when a large payment will move. The third is the lien system, which is where the real business risk sits, and we will get to that shortly.

The First Hour Belongs to the Bank

The moment anyone suspects a payment went to the wrong account, stop every other payment to that subcontractor and to any vendor whose banking details changed in the last sixty days. Then call your bank's fraud line, not your branch, and use the words business email compromise. Ask them to send a recall on the wire, or a reversal request if it was an ACH payment, which is the standard electronic bank transfer most payroll and vendor payments use.

Ask one more question that most people do not know to ask. Will the bank send the recall with a hold harmless letter? That is a written promise from your bank to the receiving bank that it will cover them if returning the money turns out to be a mistake. Some receiving banks will not freeze or release funds without one, and asking for it on the first call can save a day you cannot afford to lose.

Speed is everything here. Criminals move stolen money out of the receiving account within hours, often in pieces to other accounts. If the money is still sitting there when the receiving bank gets the recall, you have a real chance of getting it back. If it has already moved, the odds drop quickly. Our post on recovering money after paying a fake invoice by wire walks through the wire side in more detail, and the first hour after a fraudulent ACH payment covers the ACH side.

Within the same day, file a report with the FBI's Internet Crime Complaint Center, known as IC3, at ic3.gov. The FBI runs a Recovery Asset Team that works directly with banks to freeze stolen funds, and it works best when the report is filed early and includes the receiving bank, the account number, the amount and the exact time the payment left. Keep every email. Do not delete the fraudulent message, do not forward it around the office, and do not reply to it. It is evidence.

Why Construction Payment Fraud Can Make You Pay Twice

This is the part that separates a construction loss from an ordinary fake invoice. In most industries, if you pay the wrong account, you have lost that money and you argue about whose fault it was. In construction, the subcontractor who never got paid still has rights against the project, and those rights do not disappear because a criminal fooled your accounting team.

Texas gives unpaid subcontractors and suppliers the right to file a mechanic's lien, which is a legal claim against the property itself for work that was not paid for. A lien on the property is a problem for the owner, for the lender and, through your contract, for you. Lenders typically will not fund the next draw while an unresolved lien claim sits on the project. Owners do not like hearing that their building has a claim against it because their general contractor paid a criminal.

Lien waivers do not save you here the way people assume. Since 2022, Texas has required specific statutory lien waiver forms. A conditional waiver, which is the kind most subcontractors sign when submitting a pay application, only takes effect when the subcontractor actually receives the payment. If the money went to a criminal, the subcontractor never received it, so the waiver they signed did not release anything. You may be holding a stack of paperwork that looks complete and protects nothing.

The practical result is that a general contractor can end up paying the same progress payment twice, once to the criminal and once to the subcontractor, just to keep the project moving and the lender funding. Texas lien notice deadlines are short and strictly counted, so call a construction attorney the same day you discover the loss. Do not let the subcontractor's lien deadline become the thing that decides how this ends.

Find Out Whose Mailbox Was Actually Taken

Everyone will want to know where the fake bank change came from, and the honest answer at the start is that nobody knows yet. It might be the subcontractor's mailbox. It might be yours, if a criminal is inside your project accountant's account reading pay applications and replying with altered instructions. It might be neither, if the message came from a lookalike domain that differs from the real one by a single letter.

That answer matters for three reasons. If it is your mailbox, the criminal may still be inside and may already be working on the next payment, on this project or another one. If it is your mailbox, other companies you work with may receive fraudulent messages that appear to come from you, which is the situation we describe in what to do when a fraudulent invoice leaves your own mailbox. And the answer shapes who carries the loss, which brings the lawyers and the insurance carrier into the conversation.

Finding out requires looking at sign-in records, mailbox rules and message headers before they are overwritten. Microsoft 365 keeps some of these records for a limited time, and a well-meaning employee resetting passwords and deleting suspicious rules can destroy the evidence you need. That is the job of digital forensics, which in plain terms means preserving and reading the electronic trail so you can show what happened and when. If the evidence points to one of your own accounts, our guide to the first 48 hours after a compromised Microsoft 365 mailbox covers locking it down without wiping the record.

The Subcontractor, the Owner, the Lender and the Insurer

Once the bank call is made and the evidence is preserved, you have four relationships to manage, and each one needs a different conversation.

The subcontractor needs to hear from you quickly and calmly. They have a crew to pay and they are likely to assume you are making excuses. Tell them the payment was diverted by fraud, that you have reported it to your bank and the FBI, and that you are working out the path forward with your attorney. Ask them to have their own IT provider check their email, because if their mailbox was the one compromised, every other general contractor they bill is at risk too. Do not promise to pay again until your attorney and your insurer have weighed in, and do not accuse them of anything until the evidence says who was compromised.

The owner and the lender need facts, not reassurance. Give them the amount, the date, the steps already taken and a realistic timeline. A lender that hears about the problem from you, early and in writing, is far easier to work with than one that discovers a lien claim during its draw inspection.

The insurance carrier needs to hear from you the same day. Many cyber policies and commercial crime policies cover this kind of loss under a section often called social engineering fraud or funds transfer fraud, but the coverage is frequently a smaller sublimit than the main policy, and some policies only pay if your team followed a callback procedure before changing the bank details. Builder's risk and general liability policies usually do not cover it at all. Call your broker, report the loss and ask what the policy requires before you admit anything or pay anyone twice.

Who ultimately carries the loss depends on your subcontract, on whose mailbox was compromised, and on who was in the best position to catch the fraud. We answer that question in more depth in the FAQ on our business email compromise response page. The short version is that it is a question for your lawyer and your insurer, and the quality of your evidence will decide much of it.

Changing How Your Office Approves Bank Changes Before the Next Draw

Once the immediate crisis is under control, the next draw date is the deadline that matters. Criminals who succeed once often try again, sometimes against the same project.

The single most effective change is a written rule that no subcontractor or supplier banking detail changes without a phone call to a number already in your vendor file, from the original contract or an older invoice, never a number taken from the email requesting the change. That call should be logged with the date, the person reached and who in your office made it. Pair it with a waiting period, so a bank change received this week does not apply to a payment going out this week. Many carriers now ask about exactly this procedure on the application, so it also helps at renewal.

On the technical side, email security controls can flag messages from lookalike domains, warn staff when a sender is outside the company and catch sign-ins from places your team never works. Dark web monitoring can alert you when an employee's work password shows up in a stolen credential list, which is often the first step before a mailbox is taken over. Neither replaces the callback rule. They narrow the window in which a criminal can work unnoticed.

Talk to Someone Before the Next Draw Goes Out

If a progress payment, retainage release or supplier payment from your company just went somewhere it should not have, call 512-518-4408 now. We work with general contractors, subcontractors and developers across McKinney, Frisco, Plano and the rest of North Texas on the response side of these incidents: preserving the evidence, finding out whose mailbox was compromised and giving your attorney and insurer a clear timeline. You can also reach us through our contact page. If nothing has happened yet but your office changes subcontractor bank details by email, our free assessment is a good place to find out how exposed your payment process is, and our Frisco team page covers how we support businesses near your job sites.

Frequently Asked Questions

Can a subcontractor file a lien if we already paid but the money went to a scammer?

Often, yes. In Texas, the subcontractor's lien rights depend on whether they were actually paid, not on whether you sent the money. A conditional lien waiver only takes effect when the subcontractor receives the payment, so a diverted payment usually does not release their claim. Call a construction attorney the same day, because lien deadlines are short.

What should our accounting team do first when a construction payment went to the wrong account?

Stop any other payment to that vendor, then call your bank's fraud line and ask for an immediate recall of the wire or reversal of the ACH payment, along with a hold harmless letter to the receiving bank. File an FBI IC3 report the same day and keep every email untouched. Every hour of delay lowers the chance of getting the money back.

Does insurance cover a progress payment sent to a fraudster?

Sometimes. Cyber and commercial crime policies often include social engineering or funds transfer fraud coverage, but usually at a lower limit, and some require that your team verified the bank change by phone first. Builder's risk and general liability policies generally do not cover it. Report the loss to your broker the same day and ask what the policy requires.

How do we know if it was our email or the subcontractor's email that was hacked?

You find out by examining sign-in records, mailbox rules and the headers of the fraudulent message, ideally before anyone resets passwords or deletes rules. Those records are time-limited and easy to destroy by accident. A forensic review gives you the answer and a documented timeline that your attorney, your insurer and the subcontractor can all rely on.