Protecting businesses in every province and territory
Experiencing a breach? Get help now
Cybersecurity for construction
Progress-payment invoice fraud, site laptops and remote crews. Security built for how construction actually works.
CONSOLEDemo tenantSOC online00:00:00 MT3MTFinance / Payment runs
Payment run review
Payment run queue
EFT file to bank at 15:00 MTLive,
Prairie Steel Fabrication
Holdback release, 10%
Why $186,400.00 CAD was held
Email "Updated remittance for holdback release" requested new banking details 2 days before the draw.
Vendor master
ap@prairiesteelfab.ca
Domain since 2011, 46 invoices paid
Sender of change request
ap@prairiesteel-fab.com
Registered 6 days ago, DMARC none
Certified partner of
Why this cannot wait
What attackers want
General contractors, trades and developers move large progress payments and holdbacks on tight schedules, often based on emailed invoices and banking details. Construction has everything invoice fraudsters look for: large, regular payments to many suppliers and subcontractors, deadlines that pressure people to pay fast, and lots of people in the field who approve things from a phone.
Ransomware is the second concern. A builder that cannot reach estimating, scheduling or payroll for a week loses bids and goodwill with owners.
Invoice arrives by email
Subcontractor or supplier
Where attacks landA compromised supplier mailbox sends a real-looking invoice from the genuine account.
Approval from a phone
Project manager on site
Where attacks landApprovals happen in the field, on deadline, with little time to question details.
Banking details change
Controller or accounts payable
Where attacks land"We've switched banks, please use the attached details," timed for when the draw is due.
Progress draw is paid
Accounts payable
Where attacks landThe payment goes out to the attacker's account. Filters do not catch it because the email was genuine.
Holdback release
Owner, developer or GC
Where attacks landUpdated wire instructions arrive "from the trade's lawyer" at substantial completion. Same pattern, bigger number.
The control that works: phone verification to a known number, before any banking change is accepted.
Risks and coverage
We know your people are on site, not at a desk. Protection has to work for a controller at head office, a project manager approving from a phone on site and a shared tablet in a trailer.
Progress-payment and invoice fraud
Attackers compromise a subcontractor or supplier mailbox and send a real-looking invoice with new banking details right when a draw is due.
Covered by
Ransomware on estimating and project systems
Encrypted estimating, scheduling and accounting systems stall bids, payroll and site coordination.
Covered by
Unmanaged field devices and site networks
Shared tablets, site trailer Wi-Fi and personal phones are often outside IT's view and easy to compromise.
Covered by
Bid and design data theft
Tender pricing, drawings and owner security information can be valuable to competitors and to attackers targeting your clients.
Covered by
Microsoft 365 and email security catches impersonation and flags compromised mailboxes, the starting point for most payment fraud.
Managed detection and response and endpoint security cover head office and field devices, with AI-assisted triage and human analysts who investigate and contain threats.
Incident response helps you find the compromised mailbox, preserve evidence and work with your bank and insurer.
Scenarios
Illustrative scenarios based on common patterns, not specific clients. Pick one to see how it unfolds and where it could have been stopped.
ScenarioGeneral contractor, Calgary
A month before
The concrete subcontractor's mailbox is compromised. The attacker reads along quietly.
Draw week
An email from the subcontractor's controller arrives with the monthly progress invoice and a note: "We've switched banks, please use the attached details."
Payment day
The payment goes out to the new account.
Three weeks later
The subcontractor calls asking where their money is. Both firms now argue about who bears the loss.
What breaks the chain
ScenarioDeveloper, Mississauga
Before release
An attacker has been reading the project manager's email and knows the project, the amounts and the people.
Substantial completion
Holdback funds are due to be released.
Release day
Updated wire instructions arrive "from the trade's lawyer." Same pattern as a progress draw, bigger number.
What breaks the chain
ScenarioBuilder with a head office and active sites
On site
A superintendent's laptop in a site trailer has local admin rights and no endpoint protection.
Then
A malicious attachment installs remote access software.
Two weeks later
The head office accounting server is encrypted on a Sunday night.
What breaks the chain
Job sites and field devices
If a device reaches your email, project management platform or accounting, it needs protecting. Site Wi-Fi should be separate from anything that reaches head office.
Accounting, estimating, scheduling, document systems, sometimes an on-premises ERP
Typical weak point
Ransomware that stalls bids, payroll and site coordination
Superintendent laptops, site Wi-Fi, guest Wi-Fi
Typical weak point
Unprotected laptops with local admin rights, and trailer networks that reach head office
Shared tablets, project managers' phones, personal devices
Typical weak point
A shared tablet with a saved login to email, project management or accounting
CONSOLEDemo tenantSOC online00:00:00 MT3MTAssets / Endpoints
Ransomware stopped
Ransomware behaviour on ACC-LT-11
Accounts laptop · Calgary office · sensor: SentinelOne
Files encrypted
\\FS-01\Finance
60 files watched
Process tree
outlook.exe
└─ winword.exe Invoice_Nov.docm
└─ powershell.exe -enc JABz...
└─ svchost32.exeKILLED
Ransomware still reaches contractors through phishing and unmanaged laptops, and downtime on an active project is expensive. With managed endpoint detection and response on office and field laptops, analysts see the behaviour, stop the process and isolate the device.
Response commitment: critical alerts are triaged and response begins within 15 minutes, 24/7/365.
Endpoint securitySecurity baseline
Eight controls that match how contractors actually get hit. Tick what is true for your company today.
Nothing you tick is sent anywhere. It is a quick way to see your gaps before a call.
Budget
Most construction losses we hear about are payment fraud, not sophisticated hacking. That changes where the budget should go.
Spend here first
A written verification procedure, MFA and good email security will prevent more losses than an expensive network appliance at every site trailer.
Do not skip
Ransomware still reaches contractors through phishing and unmanaged laptops, and the downtime on an active project is expensive.
Talk to your broker
Insurers increasingly ask about MFA, backups and payment verification on construction cyber applications. The answers affect your premium and whether a claim is paid.
Training is part of the cheap, high-value layer: short lessons built on invoice fraud scenarios your controllers and project managers will recognize.
Security awareness trainingCONSOLEDemo tenantSOC online00:00:00 MT3MTAwareness / Lessons
Payment change fraud
From: accounts@prairie-steel-supply.co
Updated banking details for invoice 4471
Never change payment details from an email alone.
Question 2 of 3
A supplier emails new bank details before a CAD 38,600 payment. What do you do first?
Why: contact details in a fraudulent email lead back to the attacker.
Regulations and obligations
Construction has few cybersecurity-specific laws, but several obligations still bite. Here is what each one means for a builder in practice.
PIPEDA, Alberta PIPA, BC PIPA or Quebec Law 25
You hold employee SINs, banking details and sometimes health information for workers' compensation and safety.
What to have in place
Owner and public-sector contract security clauses
Public owners, hospitals, utilities and large private owners increasingly include security clauses.
What to have in place
Contract Security Program and CPCSC
Contractors on federal projects may face security clearance requirements. Defence-related work may bring the Canadian Program for Cyber Security Certification, available at Level 1 since April 1, 2026, according to Public Services and Procurement Canada.
What to have in place
Policy conditions, including social engineering coverage terms
Cyber and crime policies often set specific conditions for social engineering fraud coverage. If your policy requires call-back verification and you did not do it, the claim may be denied.
What to have in place
General information, not legal advice.
FAQ
An attacker gets into a subcontractor's or supplier's email, often weeks before a draw. They learn the project, the amounts and the people involved. Then they send an invoice or a banking change from the real account, timed for when payment is due. Because the email is genuine, filters do not catch it. Phone verification to a known number is the control that works.
Not always. Many cyber policies treat social engineering or funds transfer fraud as a separate coverage with a lower sub-limit, and some exclude it unless you followed a stated verification procedure. Read that section of your policy now, not after a loss. Your broker can tell you exactly what conditions apply.
Yes, if they access your email, project management platform or accounting. A shared tablet with a saved login is an easy way in. Put field devices under mobile device management, require a PIN or biometric, and use MFA on the apps. Site Wi-Fi should be separate from anything that reaches head office.
Call your bank right away and ask for a recall of the payment. Report to local police and the Canadian Anti-Fraud Centre. Then figure out whose mailbox was compromised, yours or the supplier's, because the attacker may still be inside. Preserve the emails and headers. Contact your insurer early to protect any coverage.
Get started
A free scoping call with a certified specialist. Bring your controller or whoever approves payments. Pricing is quote only, in CAD, after the call.
Every Cyberphore employee holds industry certifications
Regional detail:CalgaryVancouverCyber insurance readiness