The $30,000 Email: How Payment Fraud Targets Chicago Contractors (and How to Stop It)

A general contractor I know in the trades lost thirty thousand dollars to a single email.

Not a hack in the movie sense. No alarms, no locked screens, no ransom note. Just an invoice that looked exactly like the ones his client had paid a dozen times before. The bank account number was the only thing that had changed.

By the time anyone noticed, the money was gone, the client was furious, and a relationship he had spent years building was suddenly in question. The hard part was not the loss itself. It was the look on his face when he realized his own business had been the weapon used against the people who trusted him.

If you run a construction or contracting business in Chicago, this is the threat you should actually be worried about. Not some shadowy figure breaking through a firewall. An email. A redirected payment. A fake invoice that slips through because everything about it looks normal.

Why contractors are a favorite target

Cybercriminals are not picking on contractors at random. The construction business has a few traits that make it an easy mark, and the people running these attacks know all of them.

You move large dollar amounts. A single progress payment or material order can run into five and six figures, so one successful redirect pays for itself many times over. You work with a lot of moving parts. Subs, suppliers, architects, lenders, and clients are all emailing back and forth, often from the field, often in a hurry. And payment timing is unpredictable, so a fake invoice arriving "a little early" or "a little late" does not raise the same flags it might in a tidier business.

Add it up and you get the perfect environment for what the FBI calls business email compromise: a scam where a criminal either breaks into an email account or imitates one, watches the conversation, and waits for the right moment to slip in fraudulent payment instructions. It is now one of the costliest forms of cybercrime in the country, and small businesses absorb the worst of it.

What the attack actually looks like

It almost never starts with the wire. It starts quietly, weeks earlier, with access.

A criminal gets into an email account. Maybe through a phishing message that looked like a Microsoft login. Maybe through a password that was reused from another site that already leaked. Once they are in, they do not announce themselves. They read. They learn how you talk, who pays whom, what your invoices look like, and when the big jobs are closing out.

Then they wait for a real payment to come due and step into the conversation at exactly the right moment. The email comes from a familiar name. The invoice carries the right logo and the right project number. The only difference is a sentence explaining that the banking details have changed, please update your records. The payment goes out the door to the criminal, and everyone involved believes they did their job correctly.

That is what makes this so damaging. There is no obvious mistake to point to. The system worked exactly as designed. The design just did not account for someone reading over your shoulder.

The mindset that keeps you exposed

Most contractors I talk to are not careless. They are busy, and they are operating on a few quiet assumptions that used to be true and no longer are.

The first is "we are too small to be a target." The opposite is the case. Criminals automate these attacks across thousands of small businesses at once because small businesses rarely have anyone watching. The second is "we would notice." This attack is built specifically so you do not notice until the money is gone. The third is "my bookkeeper handles that." Your bookkeeper handles the math. Catching a sophisticated impersonation in the middle of a busy week is a different job entirely, and it is not fair to leave it on one person's shoulders.

None of these are signs of a bad operator. They are just the old rules. The threat changed faster than the habits did.

How to actually stop it

You do not need to become a security expert. You need a few simple controls in place and a system watching the things people cannot watch on their own. This is the heart of how we think about protection at Red Door Shield, and it follows a simple pattern we call the KIT Framework: Keep, Inspect, Trust.

Keep what is valuable secure. Lock the door and set the alarm. Every email account that touches money needs multi-factor authentication turned on, so a stolen password alone is not enough to get in. This one step shuts down the most common way these attacks begin. Pair it with a password manager so your team stops reusing the same login across a dozen sites.

Inspect what is coming in. Walk the perimeter so you do not have to. Strong email security filters catch the impersonation attempts and lookalike domains before they ever reach an inbox, which means your project manager never has to make the judgment call in the first place. The best defense is the email your team never sees.

Trust through validation. You do not give trust freely. You verify it. Put one rule in writing that everyone follows without exception: any change to payment or banking details gets confirmed by a phone call to a known number, never by replying to the email that requested it. That single habit would have stopped the thirty thousand dollar loss completely.

Those three moves, working together, close the door this attack walks through.

What "ready" looks like

Here is the shift I want for you. Right now, payment fraud is probably a low background worry, the kind of thing you figure you will deal with someday. The goal is not to trade that for fear. The goal is to trade it for certainty.

Picture the next time a banking change request lands during a hectic week. Instead of a quiet "I hope this is fine," your team makes a thirty second call, confirms the details, and moves on. The system caught what it could catch, your people knew exactly what to do, and the money stayed where it belonged. That is what ready feels like. Not hoping nothing goes wrong. Knowing you are prepared for it.

You built your business by showing up and doing the work right. Protecting the payments that keep it running is part of that same work. If you want to know where your business stands today, that is a conversation worth having before the next invoice comes due, not after.