The construction industry has moved aggressively toward digital procurement — online plan rooms, electronic bid submissions, and cloud-based project management. This digitization brings efficiency but also exposes firms to a category of fraud that barely existed a decade ago: bid manipulation, vendor impersonation, and payment diversion through compromised digital channels.

For general contractors and subcontractors alike, a single compromised bid or diverted payment can mean six-figure losses and damaged relationships that took years to build.

The Digital Bid Fraud Landscape

Construction procurement fraud takes several forms in the digital age:

Bid Sniping and Manipulation

Attackers who gain access to a contractor's email or project management system can view competing bids and adjust their own accordingly. In some cases, they modify a legitimate contractor's bid after submission — changing prices, scope, or terms to disqualify the actual bidder.

Vendor Impersonation

Criminals create fake identities mimicking legitimate subcontractors or suppliers. They submit bids using spoofed emails and fraudulent credentials, win work, collect advance payments, and disappear. The real subcontractor never knew their identity was used.

Payment Diversion

The most common and costly attack. An attacker compromises a subcontractor's email, then sends the GC a message: "Our bank account has changed — please update your records." The next draw or progress payment goes to the criminal's account.

$3.1B
Estimated annual losses to payment diversion fraud in construction — nearly 40% of all construction fraud (Association of Certified Fraud Examiners, 2025)

Securing Your Bid Submission Process

For General Contractors Receiving Bids

For Subcontractors Submitting Bids

Real-World Case: A Virginia-based mechanical contractor lost a $2.4M project when an attacker accessed their PlanHub account (using a reused password from a previous breach), viewed the competing bid, and submitted a lower number through a spoofed identity. The GC awarded the project to the fraud entity, which collected a $240K mobilization payment before anyone realized the company didn't exist.

Payment Verification Controls

Payment diversion is preventable with simple procedural controls:

The Golden Rule: Never change banking or payment information based solely on an email, fax, or electronic message. Every change must be verified through a separate channel — a phone call to a known number, an in-person confirmation, or a verified secure portal.

  1. Establish banking information at onboarding — collect bank details in person or through a verified onboarding process, not via email
  2. Require dual authorization for banking changes — any modification to payment details must be approved by two people after independent verification
  3. Implement a cooling period — delay payments for 48-72 hours after any banking change to allow time for verification
  4. Call before sending — for payments above $25,000, call the subcontractor's office at the number in your original contract (not the number in the email) to confirm details
  5. Use positive pay — work with your bank to implement positive pay, which rejects checks and ACH transactions that don't match pre-approved details

Email Security for Construction Firms

Email is the primary attack vector for construction fraud. Secure it at every level:

Technical Controls

Procedural Controls

Secure Plan Room and Document Sharing

Bid documents, specifications, and pricing schedules are valuable targets. Protect them:

Vetting New Vendors and Subcontractors

Before awarding work to any new subcontractor, verify their legitimacy:

  1. Check state contractor licensing — verify their license number with the issuing authority
  2. Verify insurance independently — call the carrier directly to confirm coverage
  3. Confirm physical address — a Google Street View check takes 30 seconds and can reveal whether the "office" is actually a vacant lot
  4. Request bank verification letters — legitimate contractors can provide letters from their bank confirming account details
  5. Check references on recent projects — call project owners listed as references

Incident Response: When Fraud Is Detected

If you suspect bid fraud or payment diversion:

  1. Immediately contact your bank — if a payment was recently sent, a wire recall may recover funds within the first 24-72 hours
  2. Preserve evidence — do not delete emails, screenshots, or logs. Forward suspicious messages to your IT team
  3. File an FBI IC3 report — the Internet Crime Complaint Center tracks construction fraud and has recovered millions through rapid intervention
  4. Notify affected parties — if a subcontractor's identity was compromised, inform them immediately
  5. Engage legal counsel — fraud recovery often requires legal action across jurisdictions

Working with a managed IT services provider ensures your email systems, bid platforms, and payment processes have monitoring in place to detect anomalies before money moves.