Payment diversion fraud is when a criminal persuades you to pay a genuine subcontractor or supplier invoice into their bank account, usually by getting into an email account and sending "new bank details" at the right moment. Construction is an easy target because payment runs are large, regular and predictable. Stop it with a written bank-detail change process, call-backs on numbers you already hold, two people to approve new payees, multi-factor authentication (MFA) on every mailbox, and alerts on mailbox rules.
Why are construction payments such an easy target?
Construction pays a lot of suppliers, in large amounts, to a timetable anyone can predict. A main contractor might have dozens of subcontractors on one job, each applying for payment against a monthly valuation, with suppliers and plant hire invoicing on top. The Construction Industry Scheme (CIS) fixes the rhythm too: the CIS tax month runs from the 6th to the 5th, and the monthly return is due by the 19th (HMRC). A criminal reading your email for a few weeks can work out exactly when the money moves.
Payments are authorised away from the office. QSs and site managers approve valuations on phones between site visits, so a quick "approved, please pay" email is normal and a fake one is hard to spot.
The supplier list keeps changing. New subcontractors are onboarded at the start of every package, often in a hurry. If bank details are collected by email, a criminal can supply their own.
Retentions are paid long after the work. Retention is released at practical completion and at the end of the defects period, sometimes more than a year later. By then the person who set up the payee may have left, and "we've moved bank since the job" sounds entirely plausible.
The NCSC has singled out construction for this reason: firms of all sizes are targeted because of the high-value payments they handle.
How does a payment diversion scam actually unfold?
Most cases follow the same pattern, and each stage has a control that breaks it.
| Stage | What the criminal does | What stops it |
|---|---|---|
| 1. Get in | Phishes a password from your QS, accounts team or director, or from the subcontractor's own mailbox | MFA on every account, email security, staff who report suspicious emails |
| 2. Hide | Creates a mailbox rule that moves replies from the target into an obscure folder, so the real person never sees them | Alerts on new inbox and forwarding rules, external auto-forwarding blocked |
| 3. Watch | Reads valuation threads to learn names, amounts and dates | Unusual sign-in alerts, a 24/7 security operations centre |
| 4. Strike | Sends new bank details, often from a lookalike domain, timed to a payment run or retention release | A written change process with a call-back to a number already on file |
| 5. Get paid | The payment goes out with the normal run, often as part of a bulk file | Two-person approval for new or changed payees, Confirmation of Payee |
| 6. Vanish | Money is moved on within hours. The fraud is found when the real subcontractor chases | Speed: calling your bank in the first hour |
Stage 2 is the one most firms miss. Microsoft 365 can block forwarding to outside addresses, but a rule that moves the subcontractor's emails into the "RSS Feeds" folder isn't forwarding anything. Only an alert on new inbox rules catches it.
How big is the problem, and will the bank pay you back?
UK Finance recorded £41.3 million lost to invoice and mandate scams in 2025, across 2,305 cases. Businesses lost £28.0 million of that across 1,217 cases, about £23,000 a case, and only 48% of invoice and mandate scam losses were returned (UK Finance, Annual Fraud Report 2026).
Don't assume you'll be reimbursed. Since 7 October 2024, mandatory reimbursement for authorised push payment fraud (where you're tricked into sending the money yourself) over Faster Payments and CHAPS, up to £85,000, has covered only individuals, micro-enterprises and charities (PSR). A micro-enterprise is broadly a business with fewer than 10 staff and a turnover or balance sheet of no more than €2 million. Most contractors running subcontractor payment runs are bigger, so recovery depends on how quickly the receiving bank freezes the money.
Which controls actually stop it?
The strongest control is a written process for changing bank details, with no other way to do it.
Bank details only change through one route. A change request is logged on a form, never actioned from an email alone. Someone who didn't receive it rings the subcontractor on the number held on file from onboarding, not the number in the email, letter or signature. Collect and phone-verify bank details at onboarding too, before the first valuation.
Separate set-up from release. The person who adds or changes a payee in the banking platform shouldn't be the person who releases the payment. Switch on dual authorisation for new payees and for anything above a threshold.
Treat Confirmation of Payee as a stop sign. It checks the account name when a payee is set up or changed (Pay.UK). A "no match" or "close match" on new details means stop and ring them, not fix the spelling. Ask your bank whether payments uploaded as a bulk file from your accounts software get the same check.
Hold retentions to a higher standard. Reconfirm bank details by phone before every retention release, even if nothing has changed. It's large, late and expected, which makes it the payment most likely to be diverted.
Then the technical layer, which keeps criminals out of the conversation:
- MFA on every mailbox, with finance, QSs and directors on phishing-resistant methods where possible. See passwords, MFA and passkeys.
- Alerts on new inbox and forwarding rules, and external auto-forwarding explicitly set to off.
- DMARC at "reject" on your own domain, an email authentication setting that stops criminals emailing your subcontractors as your accounts team.
- Email security that flags lookalike domains, such as a subcontractor's name with one letter changed.
Most of this is already in Microsoft 365 Business Premium. It just needs switching on.
Worked example: a retention release
Example (an illustration, not a real client): a 60-person civils contractor in Lanarkshire is releasing a £38,000 retention to a drainage subcontractor, 14 months after practical completion.
Three weeks earlier, a QS entered his password on a fake Microsoft sign-in page. The criminal added an inbox rule moving the subcontractor's emails into "RSS Feeds" and read along. When the retention came up, an email arrived from a domain one letter different from the subcontractor's, saying they'd changed bank since the job.
Under the old process, the payee would be updated and the money would go in Friday's bulk run. Under the new one, three things catch it: the call-back on the onboarding number confirms nothing has changed, Confirmation of Payee returns "no match", and the inbox rule alert had already flagged the QS's mailbox. The cost is a password reset. Without the controls, the contractor pays the retention twice.
What should you do in the first hour if money has gone?
Receiving banks can sometimes freeze funds that haven't been moved on yet, but criminals move money within hours.
- Call your bank's fraud team immediately, using the number on your bank's website or card, and ask them to contact the receiving bank to freeze the funds. Have the date, amount, payee details and payment reference ready.
- Report it to the police. In Scotland, call Police Scotland on 101 and get a crime reference number. Elsewhere in the UK, report to Report Fraud (formerly Action Fraud) on 0300 123 2040.
- Secure the mailbox. Reset the password, sign the user out of all sessions, remove unrecognised MFA methods and check inbox and forwarding rules. Don't delete anything: it's evidence.
- Tell the real subcontractor by phone, and check every payee changed in the last 90 days.
Scottish organisations with fewer than 20 staff can also call the Cyber and Fraud Centre – Scotland's incident response helpline free on 0800 1670 623 (weekdays, 9am–5pm). Tell your insurer, and if the mailbox held personal data, you may need to report a breach to the ICO within 72 hours.
How Indigo does this. Indigo Unified Communications supports 15+ construction businesses from our Glasgow office. Every managed IT client gets INKY email security, part of the Kaseya 365 stack, and multi-factor authentication for every user. Our Platinum package adds a dedicated security team (a security operations centre, RocketCyber) watching 24/7 for suspicious sign-ins and mailbox changes. For a Central Scotland building firm of about 160 staff, we rolled out Microsoft Intune across its devices, and the firm has since achieved Cyber Essentials Plus. Cyber security →
What to do next
- Write down your bank-detail change process this week: a form, a call-back to the number on file and a second approver. Tell subcontractors you'll never change details by email alone.
- Switch on dual authorisation for new and changed payees in your banking platform, and ask your bank how bulk files are checked.
- Check MFA is on for every mailbox, starting with finance, QSs and directors.
- Turn on alerts for new inbox and forwarding rules in Microsoft 365, and set external auto-forwarding to off.
- Check your DMARC record and move it towards "reject". If you're not sure where to start, read our construction guide chapter on cyber security.
Frequently asked questions
What is payment diversion fraud?
Payment diversion fraud, also called invoice or mandate fraud, is when a criminal tricks a business into paying a genuine invoice into the criminal's bank account. It usually starts with a compromised or spoofed email account, followed by a message saying the supplier's bank details have changed. UK Finance recorded £41.3 million lost to invoice and mandate scams in 2025.
Where do you report payment fraud in Scotland?
Call your bank's fraud team first, then Police Scotland on 101 for a crime reference number. Organisations with fewer than 20 staff can also call the Cyber and Fraud Centre – Scotland's free helpline on 0800 1670 623. Outside Scotland, report to Report Fraud on 0300 123 2040.
Will my bank refund a payment diversion loss?
Not necessarily. Mandatory reimbursement, introduced in October 2024, covers individuals, micro-enterprises and charities, up to £85,000, for Faster Payments and CHAPS. Most contractors are larger than a micro-enterprise, so recovery depends on the receiving bank freezing the money quickly. Call your bank's fraud team within the hour.
How should we verify a subcontractor's change of bank details?
Log the request on a form and never act on the email alone. Someone else rings the subcontractor on the number held on file from onboarding, not the one in the email or letter. A second person approves the change, and any Confirmation of Payee "no match" is a reason to stop.
Sources: UK Finance, Annual Fraud Report 2026, 15 June 2026 (https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf) · Payment Systems Regulator, APP fraud reimbursement protections, accessed September 2026 (https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/) · Pay.UK, Confirmation of Payee FAQs, accessed September 2026 (https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/) · HMRC, What you must do as a CIS contractor: file your monthly returns (https://www.gov.uk/what-you-must-do-as-a-cis-contractor/file-your-monthly-returns) · Report Fraud, Reporting a fraud, accessed September 2026 (https://www.reportfraud.police.uk/reporting-a-fraud/) · Cyber and Fraud Centre – Scotland, Incident response helpline, accessed September 2026 (https://cyberfraudcentre.com/community/incident-response) · Microsoft Learn, Control automatic external email forwarding from cloud mailboxes (https://learn.microsoft.com/defender-office-365/outbound-spam-policies-external-email-forwarding) · NCSC, Business email compromise: defending your organisation (https://www.ncsc.gov.uk/pdfs/guidance/business-email-compromise-defending-your-organisation.pdf) · NCSC, Cyber Security for Construction Businesses (2022, archived)
Related: What is phishing, and how do you stop it? · Passwords, MFA and passkeys · Construction guide: cyber security · IT support for construction companies · Cyber security
How secure is your business, really?
Book a free security review. We'll check your Microsoft 365, devices and backups against Cyber Essentials and give you a short list of fixes.