By Eagle Tech Corp • October 2026 • 7-minute read
Quick Answer
Quick Answer: No. In architecture, construction, and millwork firms, the most expensive cyber incidents usually start with a person, not a system: a project accountant who processes a fake change to a supplier’s banking details, or a project manager who opens a convincing link from a familiar general contractor. Security tools block a lot, but they cannot make every judgment call. Every employee needs to know who to contact, how to verify a payment or banking request, and how to report something suspicious without fear of blame.
For firms across Northern Virginia, Maryland, and Washington, DC that move large progress payments to subcontractors and suppliers every month, a clear verification habit is one of the most effective protections available, and it costs almost nothing to put in place.
Key Takeaways
- Construction payments are a prime fraud target because they are large, recurring, and routinely sent to outside companies.
- The most common scam is a request to change a vendor’s banking details, often sent from a real but compromised email account.
- “Be careful” is not a plan. Employees need a specific verification step and a named person to contact.
- Staff who fear blame stay quiet, and delay is what turns a small incident into a large loss.
- Leadership sets the standard. When owners and principals follow verification steps, everyone else does too.
Boardroom Brief
Firm owners and principals do not need to understand every technical detail to lead on this.
Ask a simpler question:
If a supplier emailed today asking us to send payment to a new bank account, what exactly would our team do?
Think about who receives the request, who approves it, how it gets verified, and whether anyone would pick up the phone before the money moves.
If the answer depends on who happens to be in the office that day, the process is not yet a process.
It’s 4:17 on a Friday Afternoon
Your project accountant receives an email from a millwork supplier you have worked with for years. It references the right job and the right invoice. It says the company has changed banks and asks that this week’s progress payment go to the new account.
The name is right. The tone sounds familiar. And with everyone trying to close out the week, the easiest thing to do is update the details and send the payment.
There is only one problem. The supplier never sent it.
Your IT provider can put strong protections in place, but it cannot stop every rushed reply or split-second decision. Some decisions still come down to whether one employee knows what to do when something feels off.
Why Are Architecture and Construction Firms Targeted?
Architecture and construction firms are targeted because they combine large, predictable payments with long vendor relationships and busy, distributed teams.
A typical project involves dozens of subcontractors, suppliers, and consultants, with payments moving on a regular schedule. Email threads about invoices, pay applications, and change orders are constant. Staff split time between the office, the shop, and the job site. For a criminal, that is an ideal environment: real conversations to imitate, real money on a predictable calendar, and people too busy to stop and check.
This is not theoretical. In a case described in a federal indictment and reported by Engineering News-Record, criminals used a fake email in July 2024 to redirect more than $1.6 million in payment for a construction project. The victim was an architecture firm.
Closer to home, a case decided in federal court in Maryland shows how costly one unverified email can be. A general contractor working at Naval Air Station Patuxent River received what looked like a routine message from its electrical subcontractor, asking that payment be sent somewhere new. The sender’s address ended in .net instead of .com. The contractor followed the instructions, the real subcontractor was never paid, and the court ruled that the contractor still owed the full payment. Being deceived did not cancel the debt.
The Assumption That Leaves Firms Exposed
The truth: your defenses are tested every time someone decides whether to trust an email, link, or request.
Many firm owners believe cybersecurity lives somewhere behind the scenes. The IT provider has tools. The workstations have protection. Updates are scheduled. Security is handled.
In reality, those decisions happen every day across every role: the estimator opening a bid invitation, the project manager downloading drawings from a link, the office manager approving a vendor change. Strengthening security means making sure each of those people knows what to do when something does not look right.
Why Can’t Technology Stop These Attacks on Its Own?
The truth: good tools block most attacks, but they cannot make judgment calls about legitimate-looking requests.
Today’s phishing is not obvious. Messages mimic familiar writing styles, reference real projects and real vendors, and arrive in the middle of genuine conversations. In some cases, they come from a real vendor’s email account that has itself been compromised, so every technical check passes.
When a general contractor’s project manager sends a new file-sharing link, a supplier legitimately updates its banking details mid-project, or a consultant needs access to a model they have never opened, a person has to decide what happens next. Technology cannot always tell a fraudulent request from a real one. A trained employee with a clear process can.
What Should Employees Do When Something Looks Suspicious?
The truth: “be careful” is not a cybersecurity plan.
Most firms tell employees to watch for suspicious emails. Far fewer tell them what to do next. Every employee, in the office and in the field, should know:
- Who to contact when a message, link, or request feels off
- How to verify any banking or payment change by calling the vendor at a number already on file, never one in the email
- Not to click links or open attachments until a request is confirmed
- What to do immediately if they already clicked or entered a password
- How to report it quickly, without worrying about being blamed
Without those steps, the full weight of a high-stakes decision lands on the person least equipped to make it in the moment. An employee who worries about bothering someone may stay quiet. Someone afraid of being blamed for a bad click may wait before reporting it. That hesitation is expensive. In payment fraud especially, the first few hours often decide whether funds can still be recovered.
Leadership Sets the Tone
Employees take their cues from owners, principals, and project leaders.
If a principal routinely skips verification because a payment is urgent, staff learn that speed matters more than process. If a superintendent makes it awkward to flag a strange email, crews stay quiet. If someone who clicked a bad link is criticized in front of the team, everyone learns to hide mistakes.
The opposite is also true. When leadership follows the same verification steps it asks of everyone else, staff take them seriously. When an employee who questions an unusual payment request is thanked rather than brushed off, the whole firm becomes more careful. When people trust leadership, they speak up before a situation becomes a crisis.
Eagle Insight
Five questions worth answering internally with your leadership team. These are for your own conversation.
- Do we require a phone call to a known number before changing any vendor’s banking details?
- Who approves payment changes, and does that hold even when the request seems to come from a principal?
- Would a field employee know who to call about a suspicious email received on a job site?
- When someone reports a mistake, how does our leadership respond?
- How quickly would we know if a payment had been sent to the wrong account?
If several of these are hard to answer, that is useful information on its own.
A 5-Point Security Culture Check
Use this as a discussion framework for principals and project leaders.
- Verification: Is there a written rule for confirming banking and payment changes?
- Contact: Does every employee know exactly who to call when something looks off?
- Reporting: Can staff report a mistake quickly without fear of blame?
- Leadership: Do owners and principals follow the same steps they expect of others?
- Reach: Do field and shop staff get the same guidance as the office?
There is no score here. The goal is to see which habits are already in place and which deserve attention next.
AI Consideration
AI makes fraudulent emails easier to write and harder to spot. Grammar and tone are no longer reliable warning signs, and criminals can now produce messages that closely match a real vendor’s style.
That shifts the defense from spotting bad writing to following good process. A firm that always verifies payment changes by phone is protected no matter how convincing the email looks.
Frequently Asked Questions
Is cybersecurity just the IT department’s responsibility?
No. IT tools block many attacks, but employees make decisions every day about which emails, links, and requests to trust. In architecture and construction firms, a single approved banking change can redirect a large payment, so every employee needs to know how to verify requests and who to contact.
What is the most common cyber scam targeting construction firms?
One of the most common is business email compromise, where a criminal poses as a supplier, subcontractor, or principal and asks to change banking details or send a payment. These messages often reference real projects and may come from a real but compromised email account.
How should a construction firm verify a vendor banking change?
Call the vendor using a phone number already on file, never one provided in the email requesting the change. Require this step for every banking update, regardless of who appears to be asking or how urgent it seems.
What should an employee do after clicking a suspicious link?
Report it immediately to the designated contact, change any password that was entered, and avoid further activity on the affected account until it is reviewed. Speed matters more than anything else, so firms should make reporting easy and free of blame.
How often should architecture and construction firms train employees on cybersecurity?
More often than once a year. Short, practical reminders throughout the year, focused on real scenarios like payment changes and file-sharing links, build stronger habits than a single annual session.
Who provides cybersecurity support for architecture and construction firms in Northern Virginia, Maryland, and Washington, DC?
Eagle Tech Corp, based in Springfield, Virginia, provides managed IT and cybersecurity services for architecture, construction, and millwork firms throughout Northern Virginia, Maryland, and Washington, DC, with support available in English and Spanish.
About Eagle Tech Corp
Eagle Tech Corp provides proactive Managed IT services, cybersecurity, Microsoft 365 management, and strategic technology consulting for architecture, construction, and millwork firms throughout Northern Virginia, Maryland, and Washington, DC.
Founded by Eduard Lavilla, former CTO of the Organization of American States, and serving the DC Metro area since 2012, we help design and build firms protect drawings, models, project systems, and payments, with assistance available in English and Spanish.
Cybersecurity Works Better When Everyone Knows Their Role
Back to that project accountant at 4:17 on a Friday afternoon.
The goal is not to make anyone paranoid about every email. It is to make sure that when something feels off, they know exactly what to do, who to ask, and how to verify. Speaking up should always feel like the right move.
If you are not sure your team would handle that Friday email the right way, it may be a good time to take a closer look.
Send us a note through the contact form and we will help you find the gaps in your current approach, with no pressure and nothing to prepare in advance.
