A construction firm stops a fake subcontractor bank-change request with callback verification and vendor-master controls
A commercial construction firm of about 90 staff in South Florida, with 300 active subcontractors and suppliers.
- Scale
- About 90 staff, 300 vendors, 2 people on every bank-detail change, 1 weekly change report, 1 ERP vendor master
- Engagement
- Six weeks to put the controls in, then monthly review of every vendor change
The challenge
Accounts payable received bank-detail changes by email, usually as a reply inside an existing thread, and the person who edited the vendor record in the accounting system could also release the payment. A subcontractor's mailbox had been taken over, so a request that looked like part of a normal conversation asked for a progress payment to go to a new account. Nothing in the firm's process was written to stop it.
Payment fraud against contractors has a reason to exist: construction pays large sums on a fixed rhythm, to many small companies, against invoices that arrive by email. A fraudster who has read a real thread knows the amounts, the project names and the date the next progress payment is due.
The first fix was a rule, not a tool. An emailed request can start a bank change but can never complete one. The callback goes to a number that was in the vendor record before the request arrived, and the person who makes the call writes down who answered. If the number is out of date, the change waits until the vendor is reached in a way the firm already trusts.
The accounting system did the rest. Entering a vendor change and approving it became two different people, and neither could release a payment, so a single stolen mailbox or a single careless afternoon could not move money on its own. Every change landed in a log, and the controller read the weekly report against the call notes. A changed account had to survive a hold and a bank validation or a zero-dollar prenotification before the first dollar went to it.
Mail controls made the fake harder to build. Authenticated mail from the firm's own domains means a lookalike cannot pass as an internal message, and warnings on external messages that mention banking or payment give the clerk a reason to slow down. The team also tested the process with a staged request in a live thread, where the clerk followed the callback rule and recorded the result.
The rule held up because it does not depend on spotting a fake. A takeover of a vendor's mailbox can produce an email that reads exactly like the real ones, and in this case it did. Staff were told to make the call whenever the bank details change, whatever the thread looks like. This is the same work our team does for any company that pays by transfer: it makes a faked instruction insufficient to move money, and it does not detect every fake.
What our team delivered
- A written change rule: no bank detail changes from an email request alone. Every change is verified by a callback to a phone number already in the vendor record, never one given in the request, and the call is noted on the change
- Vendor-master change control in the accounting system: one person enters a change, a second person approves it, and neither can release payments. Every change to a bank account, address or remittance contact is written to a log
- A hold on the first payment to any changed account, with account ownership confirmed through the bank's validation service or a zero-dollar prenotification before money moves
- A weekly report of every vendor-master change, reviewed by the controller against the callback notes, plus a quarterly check that nobody holds both entry and release rights
- Mail protection with SPF, DKIM and DMARC at enforcement, banners on external messages that mention payment or banking, and rules that flag replies from a vendor's address when the reply-to has changed
- Phishing-resistant sign-in and conditional access for the accounts payable team, and a short training session on the one rule that holds even when the thread looks real
Result
A request to move a $186,400 progress payment to a new account was held at the callback step: the subcontractor's office manager confirmed that nothing had changed, and the money stayed in the firm's account. In the six months after rollout, 41 vendor changes went through the new path and 2 failed verification and were refused. That is one illustrative outcome, not a promise: the controls do not detect every takeover, they make a request alone insufficient to move money. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 5 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.