Business Email Scams Are Targeting Contractors More Than Ever
Okay, let’s paint this familiar picture.
A small contractor gets an email late Friday afternoon. It appears to be from a regular supplier and references an outstanding invoice. It says their banking information has changed. Suspecting everything is ‘business-as-usual,’ the office manager updates the payment information and sends $8,700 to the new account.
And on Monday, the real supplier calls asking about the overdue invoice.
Uh-oh.
Yeah, unfortunately, scenarios like this are becoming increasingly common. Business email scams are especially dangerous for contractors because construction and service businesses routinely exchange invoices, estimates, payment instructions, schedules, and documents by email. Further, routinely paying these suppliers and clearing that email from an inbox is the everyday, routine behavior of an AP Manager or office manager — they’re almost working on autopilot — and criminals know that, and they’re keen to take advantage of it.
Why Contractors Make Attractive Targets
Contractors often have money moving in several directions at once. Customers pay deposits. Subcontractors submit invoices. Vendors want payment. Office staff may be coordinating all of it while answering phones and scheduling crews.
An attacker doesn’t necessarily need to hack your accounting system. They don’t even need a lot of sophisticated spyware to figure out your bank accounts. They simply need to impersonate someone your staff already trusts. They just have to appear as routine.
A convincing email might claim to come from the owner asking for an urgent payment, a vendor announcing new banking information, or a customer requesting a refund to a different account. And the hacker is taking advantage of all of that chaos.
How to Protect Your Business
Verify payment changes another way. If a vendor emails new banking or payment instructions, call them using a phone number you already have. Never rely on the phone number included in the suspicious email.
Require a second set of eyes. Consider requiring two people to approve payments above a certain dollar amount. This simple procedure can stop an expensive mistake before money leaves the bank.
Protect your email accounts. Every employee should use multi-factor authentication, particularly anyone handling invoices, payroll, banking, or administrative work. A stolen password should not be enough to access your company email.
Teach employees to recognize unusual requests. Staff don't need extensive cybersecurity training or a degree in information systems security. They do need permission to question an email that feels unusual, rushed, or financially sensitive—even when it appears to come from the boss.
Good Email Security Protects More Than Email
Preventing business email scams isn't just about avoiding fraudulent payments. A compromised mailbox can expose customer information, contracts, employee records, invoices, and years of correspondence.
For a small contractor, one successful scam can mean thousands of dollars lost, damaged vendor relationships, and days spent figuring out what happened.
That hypothetical contractor who lost $8,700 could have stopped the entire incident with one phone call.
The goal isn't to make your business harder to operate. It's to put a few sensible safeguards between a convincing email and your bank account.
If you operate a small business or contracting company in Vancouver, WA or Portland, OR, Mickler & Associates, Inc. can help review your email security, Microsoft 365 environment, cybersecurity practices, cloud services, and overall IT setup. Contact us when you'd like a practical second opinion.
R
