Cybercriminals are targeting Australia’s construction industry through fake invoices and Business Email Compromise (BEC) scams. For tradies and construction businesses, the best defence starts with pausing before paying. By Shane Conroy
A supplier invoice lands in your inbox. The branding looks right. The amount seems plausible. The job is moving quickly, the payment is due, and there is no obvious reason to question it.
That is exactly the kind of everyday moment cybercriminals are exploiting through Business Email Compromise (BEC) scams. These scams typically involve cybercriminals posing as a legitimate business contact over email to deceive victims into redirecting payments to fraudulent accounts.
For tradies and construction businesses, the threat is real. Across Australia, scammers stole more than $152.6 million through BEC attacks in 2024, a 66 per cent increase from the $91.6 million reported in 2023.
The AFP has also warned of a sharp rise in BEC attacks aimed specifically at Australia’s construction sector. These scams are not just targeting large organisations. They can also affect smaller operators that rely on trust, repeat suppliers, and fast payment processes to keep work moving.
WHY CONSTRUCTION IS BEING TARGETED
Construction companies are an attractive target because payments must often be made to a complex network of subcontractors and suppliers. Invoices can be large, deadlines can be tight, and payment details may pass through busy inboxes.
“The construction sector, with its high-value transactions and complex subcontracting chains, has become an attractive target for organised cybercrime groups operating both domestically and offshore,” says AFP Assistant Commissioner Cyber Command Richard Chin.
The AFP says a lack of cybersecurity resources, especially among time poor small and family-run construction businesses, may increase exposure to BEC scams, because scammers know how to exploit trust and urgency.
For example, scams can succeed when a business accepts a request to change bank details by email, rushes an urgent payment, or fails to confirm a request through a trusted contact.
“Unfortunately, victims often don’t realise they’ve been defrauded until it’s too late and the funds have already been moved through multiple international accounts,” explains AC Chin.
HOW THE SCAM WORKS
BEC scams can be highly targeted. According to the AFP, criminals may watch public tender information to learn who is working on a project, then pose as a real supplier and send a fake invoice with their own bank details.
Some scammers may also call and claim an invoice is overdue and pressure the recipient to act quickly. Once the payment is made, the money may be moved into overseas accounts and may be unrecoverable.
For example, a NSW construction company received fraudulent invoices totalling $41,800 from criminals who made invoices appear to come from the email address of a business the company already knew and dealt with.
After making the payment, the victim texted the remittance to the supplier using a known mobile number and was told the bank details were incorrect. The victim immediately reported the incident to police through ReportCyber, and the full amount was recovered. In Queensland, scammers pretended to be a real construction company and appeared to know details about its existing relationship with the victim organisation.
Investigations found links to offshore syndicates, and while some funds were recovered, total losses amounted to more than $1 million.
These examples show how, in many cases, the scam depends on making a false payment request look familiar enough to pass through ordinary business processes.
HOW TO PROTECT YOUR BUSINESS
The most important protection is simple: pause before paying.
“We’re all busy and it’s easy to rush through tasks, but when it comes to payments, taking a moment to stop and verify can be the difference between protecting your hard-earned cash and becoming a victim to cybercrime,” says AC Chin.
Verification matters most when bank details change, an invoice arrives unexpectedly, or someone applies pressure to pay quickly. And, critically, do not use the contact details listed on the suspicious invoice to verify it. Those details may belong to the scammer.
“No matter how legitimate a request may appear, always confirm payment instructions through a secondary through ReportCyber.
Construction businesses do not need to become cyber experts overnight. But they do need firm payment rules, communication channel, such as a trusted contact you’ve previously engaged with,” AC Chin recommends.
That might mean calling a supplier on a number already saved in your records, or checking with the person you usually deal with before approving payment. For larger payments, it may mean asking a second person inside your business to review and approve the transaction.
The AFP also recommends contacting your financial institution immediately if you believe you have made an incorrect payment, and reporting suspicious activity to police trusted contact records, and a culture where people are encouraged to slow down and verify payments before money leaves the account.
“The AFP is working closely with industry partners; state, territory and international law enforcement, and financial institutions to disrupt these criminal syndicates,” says AC Chin.
“Cybercrime prevention is a shared responsibility, and even small steps can stop significant financial losses.”
Photography: FABRIKACRIMEA – 123RF
