Construction Payment Fraud: What the $14.7M Mobile Scam Teaches Contractors

Construction payment fraud became a national headline in October 2026 when officials in Mobile, Alabama, disclosed that a fraudulent vendor payment had diverted $14.7 million intended for work on the city’s new Regions Arena.

The payment was associated with an approximately $300 million construction project. According to reporting published October 27, the criminals allegedly spent months impersonating a legitimate vendor, developing relationships with city employees, and using genuine invoice information to support a fraudulent payment request.

For general contractors, subcontractors, construction companies, and specialty trade businesses, the incident provides a warning that extends beyond one city or project.

Construction payments often involve substantial amounts of money, multiple vendors, project-specific invoices, change orders, and tight deadlines. An email that appears to come from a familiar supplier or contractor may reach an employee who is already balancing several jobs and payment approvals.

That combination creates opportunities for criminals to impersonate trusted businesses and redirect payments.

However, an important distinction matters in this case. Mobile officials stated that their IT systems had not been compromised. Based on the information publicly available at the time, the incident involved fraudulent vendor communications and failures in payment verification rather than a confirmed technical intrusion.

That makes the lesson especially relevant: cybersecurity technology is important, but it cannot replace a reliable process for confirming where money is going.

Da-Com IT Pros helps businesses throughout St. Louis, St. Charles, the Metro East, and Southern Illinois review managed IT services and cybersecurity safeguards that support secure business operations.

In this guide, we will examine what happened in Mobile, why construction payments attract fraudsters, six practical controls contractors should consider, and how financial procedures and managed IT can work together to reduce risk.

Quick Answer: How Can Contractors Prevent Construction Payment Fraud?

Construction payment fraud often involves criminals impersonating legitimate contractors, suppliers, or executives to redirect payments. To reduce the risk, construction companies should independently verify changes to banking information, require appropriate approvals, protect financial accounts, train employees to recognize fraudulent requests, and establish a clear response process.

Six practical safeguards include:

1. Independently verify banking changes using previously established contact information.
2. Require appropriate approval controls for new vendors, changed payment details, and high-value transactions.
3. Consider a verification hold before sending funds to newly changed accounts.
4. Secure email and financial accounts with appropriate authentication, monitoring, and access management.
5. Train employees who handle payments to recognize impersonation, suspicious invoices, and unusual requests.
6. Prepare an immediate incident response plan that begins with contacting the financial institution.

These measures address different parts of the problem. Financial controls help prevent unauthorized transfers, while cybersecurity safeguards help protect the systems and accounts involved in preparing, reviewing, and approving payments.

What Happened in Mobile’s $14.7 Million Construction Payment Scam?

In October 2026, the City of Mobile confirmed that a fraudulent transaction had diverted $14.7 million associated with the construction of Regions Arena.

According to October 27 reporting from FOX10 News, the scheme began in late May when someone posing as a representative of B.L. Harbert International, the arena’s general contractor, contacted the city’s finance department.

The reported sequence involved multiple communications over several months, changes to vendor information, and the use of information from a legitimate contractor invoice to help make a fraudulent payment request appear authentic.

Timeline of the Reported Fraud

According to officials, the city had also faced a separate fraudulent payment attempt in August. That transaction was identified more quickly, and the funds were recovered.

The two incidents demonstrate why prompt detection, independent verification, and rapid response matter.

The City of Mobile’s official news releases and ongoing reporting provide additional information about the investigation and the city’s response.

As of October 29, 2026, the investigation remained a developing matter. Details about the perpetrators, the ultimate recovery of funds, and the complete sequence of internal decisions could change as additional findings become available.

Was the General Contractor’s Email Account Hacked?

Publicly available information did not establish that the general contractor’s email account was compromised.

Mobile officials also stated that the city’s IT systems had not been compromised and described the incident as a sophisticated vendor impersonation scheme.

This distinction is important because business email compromise and related payment fraud can involve several methods, including stolen email accounts, spoofed addresses, fraudulent documents, and social engineering that does not require a successful technical intrusion.

The Mobile case illustrates why a construction company needs both secure technology and independent financial verification.

Why Construction Payment Fraud Targets Contractors and Subcontractors

Construction projects create a particularly attractive environment for vendor impersonation and payment scams.

Large projects involve multiple businesses, different payment schedules, and frequent exchanges of financial and project information.

Payments may move from an owner to a general contractor, then to subcontractors, suppliers, and specialty trade businesses.

Along the way, employees process pay applications, invoices, change orders, retainage, and payment approvals.

Large Payments Are Part of Normal Operations

For many businesses, a six-figure invoice would be unusual. In construction, large progress payments may be part of the normal financial process for a substantial project.

A fraudulent payment request can therefore be presented as another expected transaction instead of an obviously unusual expense.

Multiple Companies Share Project Information

Owners, architects, general contractors, subcontractors, suppliers, and lenders may all communicate about different parts of the same project.

Company names, project titles, contact information, and schedules may appear in legitimate documents or public announcements.

Criminals can use those details to create messages that appear credible.

Project Managers Often Work Remotely

Project executives and managers may review invoices or approve work from jobsite trailers, mobile devices, or remote locations.

That convenience creates additional considerations for authentication, account security, and verification procedures.

A familiar sender name on a phone screen should never be the only reason a change to payment information is accepted.

Urgency Can Become an Effective Distraction

Fraudulent requests may claim that a supplier needs immediate payment, a shipment will be delayed, or a subcontractor is waiting for funds before work can continue.

The request is designed to make an employee feel that following the normal verification process would create a project problem.

A strong financial process should be usable even under deadline pressure.

Construction Payment Fraud by the Numbers

The Mobile incident involved an unusually large fraudulent payment, but the broader category of business email compromise creates substantial losses across industries.

According to the FBI’s 2025 Internet Crime Complaint Center Annual Report, business email compromise accounted for:

• 24,768 reported complaints during 2025.
• Approximately $3.05 billion in reported losses.

Business email compromise was among the largest categories of reported financial loss.

These figures describe reported U.S. complaints and losses across industries. They are not construction-only statistics, and they should not be interpreted as a prediction of what any individual contractor will lose.

The FBI’s Business Email Compromise guidance describes how criminals target businesses and individuals involved in transferring funds, often through compromised communications or deceptive account-change requests.

For a construction company, the lesson is straightforward: a convincing message does not establish that a payment instruction is legitimate.

How Construction Invoice and Payment Scams Work

Construction payment fraud can take several forms. Understanding the common patterns helps employees recognize when an otherwise routine request deserves additional verification.

1. The Vendor Bank Account Change

An accounts payable employee receives an email that appears to come from a familiar supplier or subcontractor.

The message explains that the company has changed banks and provides new payment instructions.

It may include a letterhead, tax information, a signed form, or a document resembling a legitimate invoice.

The goal is to redirect an upcoming payment to a fraudulent account.

2. The Compromised Email Account

A criminal gains access to a legitimate email account and reviews messages to learn how the business works.

The attacker may identify suppliers, invoice schedules, project managers, and upcoming transactions.

A payment instruction sent from a genuine account can be particularly convincing because the sender’s address is familiar.

3. The Lookalike Email Domain

Instead of compromising a real mailbox, an attacker creates an email address using a domain that closely resembles a trusted company’s domain.

One letter may be changed, a word added, or the spelling altered slightly.

A copied signature and familiar writing style can make the message look legitimate at first glance.

4. The Urgent Executive Request

A message appears to come from a company owner, chief financial officer, or project executive.

It asks for a payment to be approved immediately and may discourage additional questions.

The criminal relies on authority and time pressure to bypass the usual process.

5. The Altered Construction Invoice

An attacker obtains information from a legitimate invoice and changes the account information while leaving the project details, amount, and description largely unchanged.

The invoice may match an expected payment application closely enough that staff focus on the familiar details and overlook the banking change.

Common Construction Payment Fraud Warning Signs

Six Controls That Can Help Prevent Construction Payment Fraud

No single safeguard can eliminate every fraud attempt. A more effective approach combines clear financial procedures, technical account protection, employee awareness, and rapid incident response.

1. Verify Every Change to Banking Instructions Independently

When a vendor requests changes to bank account information, do not rely solely on the email, phone number, or documents provided in the request.

Call the vendor using a telephone number already recorded in an approved system or established through a trusted relationship.

The FBI recommends using a separate communication channel to verify requests involving account changes.

Document the verification according to company policy, including who confirmed the information and who authorized the change.

Be particularly cautious when a request involves a new account, an unexpected payment destination, or a change immediately before a scheduled draw.

2. Require Appropriate Approval Controls

One employee should not necessarily be responsible for requesting, approving, and executing a major change to vendor banking information.

Construction companies should consider separating these responsibilities and requiring additional approval for sensitive changes.

A written process may address:

• Adding new vendors.
• Changing banking information.
• Approving high-value transfers.
• Granting exceptions to standard payment procedures.
• Reviewing unusual or previously unapproved destinations.

The approval thresholds should reflect the company’s size, transactions, and risk assessment.

An additional approval is meaningful only when the reviewer independently checks the appropriate information rather than simply approving the same unverified document.

3. Consider a Verification Hold for Banking Changes

A short waiting period between a bank-account change and the first payment to that account can provide additional time for review.

For example, a company may choose to establish a defined verification hold for certain high-risk changes.

The duration should be determined by the business, its payment obligations, and the relevant financial controls.

A hold is not a substitute for independent verification. It is an additional opportunity to detect inconsistencies before money moves.

4. Strengthen Email and Account Security

Although the Mobile incident was not reported as an IT-system compromise, stolen business accounts are another common route to payment fraud.

Construction companies should review authentication and access controls for:

• Executive email accounts.
• Accounting and accounts payable mailboxes.
• Project management systems.
• Vendor portals.
• Financial applications.
• Cloud document repositories.
• Remote access accounts.

Multifactor authentication helps reduce the risk associated with stolen passwords. Phishing-resistant methods should be considered where available and appropriate.

IT teams should also review suspicious forwarding rules, unusual sign-ins, inappropriate administrative privileges, and access belonging to former employees or contractors.

Da-Com IT Pros’ Managed IT and Cybersecurity Services can help businesses assess applicable technical safeguards and define ongoing support responsibilities.

5. Train the Employees Who Handle Construction Payments

Cybersecurity awareness should not stop with the IT department.

Employees who create vendors, approve invoices, manage accounting systems, and authorize pay applications need practical training on payment fraud.

Training should include realistic examples such as:

• A supplier requesting an account change.
• A general contractor sending revised payment instructions.
• An executive requesting an immediate wire transfer.
• An invoice arriving from a lookalike email address.
• A familiar email thread containing unexpected banking details.

Employees should know exactly where to report concerns and how to verify a request without using contact information supplied in the suspicious communication.

Leadership should reinforce that following the verification procedure is expected, even when a project is under time pressure.

6. Prepare a Written Response Plan Before Money Is Lost

Construction businesses should establish a process for responding immediately to suspected fraudulent payments.

The response should identify who contacts the bank, who notifies leadership, who coordinates with IT, and who handles reports to law enforcement and relevant outside parties.

If a transfer may have been fraudulent:

1. Contact the sending financial institution’s fraud department immediately.
2. Ask about stopping, recalling, or attempting to recover the transfer.
3. Notify the appropriate company leadership and security contacts.
4. Preserve the relevant emails, transaction details, and other records.
5. Report the incident through the FBI’s Internet Crime Complaint Center.
6. Follow applicable contractual, insurance, legal, and notification requirements.

Recovery is time-sensitive, but no specific recovery window or outcome is guaranteed.

Do not delay contacting the financial institution while waiting for a full technical investigation.

Where Managed IT Fits Into Construction Payment Fraud Prevention

Payment verification belongs primarily to the company’s financial controls.

However, those controls depend on the technology employees use to communicate, review invoices, store documents, and approve transactions.

An accounts payable process can become less reliable when email accounts are poorly protected, employee access is outdated, or important systems are not maintained.

That is where a managed IT partner can help support the broader prevention strategy.

Email Security and Account Protection

Appropriate authentication, account monitoring, and administrative controls can help reduce the likelihood that an attacker successfully takes over a mailbox or misuses an account.

For contractors, these safeguards are particularly relevant to accounting, project management, and executive users.

Technology Success Planning

Da-Com’s Technology Success Program focuses on aligning technology with business goals, reducing technology-related risk, and helping organizations make more informed technology decisions.

For construction businesses, this may involve reviewing how employees access important financial systems and where better technical controls or support procedures are needed.

Virtual Chief Information Officer Services

Da-Com’s virtual Chief Information Officer, or vCIO, services are intended to help business leaders evaluate technology priorities and make strategic decisions.

For a construction company, a vCIO conversation may address identity security, account access, software administration, technology policy, and coordination between IT and operations.

Decisions about payment authorization and financial control ownership should remain with the appropriate company leaders and financial advisers.

Backup and Business Continuity

Payment fraud may occur without ransomware or data loss, but construction companies still need to prepare for broader technology disruptions.

Da-Com provides backup and business continuity solutions that can be evaluated around business systems, files, and recovery requirements.

Backups support restoration of covered information. They cannot reverse an unauthorized payment that has already been transferred.

Employee Access and Offboarding

Contractors may work with seasonal employees, subcontractors, temporary project staff, and outside specialists.

Access should be approved according to roles and reviewed when those relationships change.

Former employees and contractors should not retain unnecessary access to email, accounting, project platforms, or shared documents.

Because vendor impersonation can succeed even when technical systems are secure, these services should complement, not replace, independent payment verification.

Construction Payment Fraud Prevention for General Contractors and Subcontractors

Construction businesses can approach this problem from both sides of the payment relationship.

A general contractor may be responsible for reviewing invoices and releasing payments to subcontractors. A subcontractor may be waiting for a legitimate payment while criminals attempt to impersonate its business.

Both parties benefit from clear instructions for changing vendor information.

For General Contractors

Establish a standard process for onboarding subcontractors and approving banking changes.

Require employees to use established contacts for verification and ensure financial staff understand who may authorize exceptions.

Review access to payment-related records and communications.

For Subcontractors

Tell customers and general contractors how your company communicates legitimate changes to banking information.

Establish a trusted point of contact for payment verification and encourage paying parties to independently confirm unusual requests.

Monitor expected payments and follow up promptly when an important transaction has not arrived.

For Specialty Trade Businesses

Smaller organizations may have limited accounting staff, making separation of duties more challenging.

Even when one person handles most accounting functions, leadership can establish a second review for vendor account changes or sensitive payments.

The process should be realistic enough to use consistently.

Build a Culture Where Payment Verification Is Normal

Construction payment fraud is more difficult when employees feel comfortable slowing down an unusual request.

Fraudsters frequently rely on urgency, authority, familiarity, and the expectation that an employee will not want to question an important business relationship.

Leadership can reduce that pressure by making verification part of normal operations.

Tell suppliers, subcontractors, and customers that changes to payment instructions will be independently confirmed.

Explain the procedure during vendor onboarding and make the rules available to employees.

When a suspicious request arrives, the employee following the procedure should be supported rather than criticized for delaying a payment.

Run a Short Payment Fraud Exercise

Construction companies can test their readiness through a simple tabletop scenario.

Bring together an accounts payable employee, a project manager, an executive, and the person responsible for technology security.

Present a fictional bank-account change request from a familiar subcontractor.

Ask:

• Who first receives the request?
• Who has authority to change vendor banking information?
• How is the request independently verified?
• Who approves the change?
• What would happen if the request arrived just before a payment deadline?
• Who would recognize a suspicious email domain?
• What would happen if money had already been sent?

Document any gaps identified during the exercise and assign responsibility for addressing them.

The objective is to make the process dependable under real conditions, not simply to confirm that a written policy exists.

Construction Payment Fraud Prevention Checklist

Use this checklist to review your company’s payment and cybersecurity procedures.

• Establish a documented process for vendor bank-account changes.
• Verify changes using previously trusted contact information.
• Require appropriate independent approvals for sensitive transactions.
• Consider a verification hold for newly changed payment details.
• Use appropriate authentication for email and financial accounts.
• Review suspicious mailbox rules and account activity.
• Remove unnecessary access when employees or contractors leave.
• Train accounts payable, finance, and project management employees.
• Communicate verification expectations to suppliers and subcontractors.
• Monitor important expected payments and unusual transaction activity.
• Maintain an incident response contact list.
• Know how to reach the financial institution’s fraud department.
• Keep the FBI IC3 reporting process accessible.
• Review payment controls periodically as the business grows.
• Coordinate technical safeguards with the company’s managed IT provider.

Frequently Asked Questions About Construction Payment Fraud

What is construction payment fraud?

Construction payment fraud involves deceptive attempts to redirect or obtain payments associated with construction work. Criminals may impersonate contractors, suppliers, subcontractors, or executives and use fraudulent invoices, altered banking instructions, or compromised communications.

How do criminals redirect construction payments?

A common method is to impersonate a trusted vendor and request a change to banking information. Other methods include compromised email accounts, lookalike domains, and altered invoices that appear to match legitimate project records.

Was the Mobile $14.7 million fraud caused by a hacked email account?

Based on public statements available as of October 29, 2026, Mobile officials said their IT systems had not been compromised. The reported incident involved vendor impersonation, deceptive documents and communications, and inadequate payment verification. Investigative findings may provide additional details later.

What should an accounts payable employee do when a vendor changes banks?

Follow the company’s approved verification procedure. Independently contact the vendor using previously established contact information, document the verification, and obtain any required approvals before changing payment details.

Can multifactor authentication prevent construction payment fraud?

Multifactor authentication helps protect accounts against certain forms of unauthorized access. It does not stop every impersonation or fraudulent payment request, especially when the criminal has not compromised a legitimate account. Financial verification controls remain essential.

Can small subcontractors be targeted by construction invoice fraud?

Yes. Fraudsters may target businesses of different sizes. Smaller companies can reduce exposure by establishing clear payment procedures, protecting accounts, limiting access, and requiring appropriate verification before sensitive changes.

What should a contractor do after sending money to a fraudulent account?

Contact the financial institution immediately and request assistance with stopping or recovering the transfer. Notify appropriate company personnel, preserve relevant records, and file a report with the FBI’s Internet Crime Complaint Center at ic3.gov. Follow any applicable insurance, contractual, and legal requirements.

How can managed IT services help construction companies?

Managed IT services can help with covered email systems, user accounts, endpoint security, authentication, monitoring, backups, and technology planning. These services support the technical side of a fraud prevention strategy but do not replace financial approval and bank-change verification procedures.

What is the most important construction payment fraud prevention step?

Independent verification of changed payment instructions is one of the most important practical controls. Businesses should also use appropriate approval procedures, protect their accounts, train employees, and prepare for rapid incident response.

Can Da-Com IT Pros help contractors in St. Louis and Southern Illinois?

Da-Com IT Pros provides managed IT and cybersecurity services for businesses in the St. Louis region and Southern Illinois. Contractors can contact Da-Com to discuss email security, identity management, technology risk, backup planning, and support needs. Specific services and coverage depend on the agreement.

Protect Your Payments, Projects, and Business With Da-Com IT Pros

The $14.7 million fraudulent payment in Mobile demonstrates that even a large, established construction project can become the target of a sophisticated vendor impersonation scheme.

The lesson for contractors is not that every invoice should be treated as suspicious. It is that important payment changes deserve independent verification, even when the request appears familiar.

Construction companies should protect the financial process and the technology that supports it.

That includes verifying banking changes, establishing appropriate approvals, protecting email accounts, managing employee access, training staff, and preparing to respond quickly when something appears wrong.

Da-Com IT Pros works with businesses throughout St. Louis, St. Charles, Chesterfield, O’Fallon, the Metro East, Belleville, Edwardsville, Collinsville, and Southern Illinois to help evaluate technology risks and support more reliable IT operations.

Our team can help construction businesses discuss:

• Managed IT Services.
• Email and account security.
• Cybersecurity solutions.
• Identity and access management.
• Employee technology support.
• Technology Success planning.
• Virtual CIO guidance.
• Backup and business continuity.

Your payment approvals and financial controls remain a leadership responsibility. Our role is to help you evaluate the technical safeguards and support services that protect the systems your team depends on.

Contact Da-Com IT Pros today to discuss construction cybersecurity, managed IT, and technology risk reduction for your business.

Explore our Managed IT Services and additional business cybersecurity articles to learn how proactive IT support can help protect employees, information, and day-to-day operations.