Can a Fake Email or AI Voice Clone Trick Your Team Into Wiring Money?
Yes, and construction businesses are getting hit right now. A criminal emails your bookkeeper, poses as one of your subs, says the bank account changed, and asks for the next draw to go to a new number. The payment clears and the money is gone.
The fix is not a better app or a security suite. It is a short verification step you run before any money leaves the account. Here is the scam, the numbers, and the process that stops it.
How the payment scam actually works
The play is simple. Someone impersonates a vendor, a sub, or you, and redirects a payment that was going to happen anyway.
It shows up as a vendor emailing new banking details before a draw. Or a message that looks like it came from your accounting software. Or a phone call from a "supplier" you recognize, asking you to rush a deposit. The request always sounds normal, because the criminal studied a real job first.
The FBI calls this business email compromise. They describe scammers who impersonate trusted vendors to redirect wire transfers, sometimes by switching a real bank account number by a single digit (FBI IC3, ic3.gov). One digit. That is the whole trick.
The numbers are not small
This is the most expensive scam most builders have never heard of. The FBI's 2025 report logged 24,768 business email compromise complaints and $3.05 billion in reported losses (FBI IC3 2025 Internet Crime Report, ic3.gov).
It is getting worse because AI makes the con cheaper to run. Deloitte's Center for Financial Services projects fraud losses enabled by generative AI in the U.S. will climb from $12.3 billion in 2023 to $40 billion by 2027 (Deloitte Insights, deloitte.com).
That is not a consumer problem. Businesses moving large payments are the target, and you move large payments on every job.
Why contractors are an easy mark
Think about how a draw moves. Big dollar amounts, wired or transferred, on a schedule a criminal can predict from a permit or a public bid.
Your back office runs on email and text. Vendor banking details get sent in plain messages. The owner is on a roof, the bookkeeper is part time, and the approval is a quick "yep, pay it." Every one of those is a gap.
A remodeler wiring a $40,000 deposit to a supplier is a better target than a retiree, because the single score is bigger and the guard is lower.
AI made the old scam better
The scam used to be easy to spot. Broken English, a weird address, an obvious tell.
Now AI writes a clean email in your vendor's tone with no mistakes. It can clone a voice from a short clip pulled off social media, so the "supplier" who calls sounds real. AI-driven voice and deepfake fraud has been climbing fast across 2025 (Deloitte Insights, deloitte.com).
The lesson is not to fear the technology. It is to stop trusting the channel. An email, a text, or even a familiar voice is no longer proof of who you are talking to.
The fix is a verification step, not a tool
This is the same rule we run on everything. Do not buy software to solve it. Write down the step and run it every time.
The rule is one line: no payment and no banking change happens on the word of a message alone. Here is the process that backs it up.
Verify by callback. Any new bank account, or any change to an existing one, gets confirmed by phone on a number you already had on file. Never the number in the email.
Separate the request from the approval. The person who receives a payment change is not the person who approves it. Two sets of eyes, every time.
Set a dollar threshold. Any payment or change above a number you pick gets a second confirmation before it moves. Draws and deposits always clear that bar.
Slow the rush. Urgency is the scammer's main tool. A real vendor will wait ten minutes for a phone call. A thief will push you to skip it.
If your payment approvals live in one person's inbox with no second check, that is a process gap with a known fix. Book a systems consult at gofirstconsulting.com and we will map your payment controls in 45 minutes.
Build it once, run it every time
A rule you follow only when you remember is not a rule. It is a habit that breaks on the busy day, which is the exact day the scammer is counting on.
Write the verification step into your payment process. Brief your bookkeeper and anyone who can move money. Tell your real vendors up front that you confirm every banking change by phone, so it never feels personal when you do it.
The step costs you ten minutes. Skipping it can cost you a draw, a deposit, or the cash you needed to make payroll.
The point
AI is worth adopting, and the hours it gives back are real. But the same tools that help you are helping the people trying to rob you, and they are aiming at the payments you already make.
You do not need to become a security expert. You need one written step that verifies who you are paying before the money moves. Document it, run it every time, and the single-digit trick stops working on you.
Questions builders are asking
What is business email compromise? It is a scam where a criminal impersonates a vendor, employee, or executive over email to redirect a payment to their own account. The FBI logged $3.05 billion in reported losses from it in 2025 (FBI IC3, ic3.gov).
How do I verify a vendor's bank change? Call the vendor on a number you already had on file, not the number in the message, and confirm the change by voice before you update anything. Treat every banking change as unverified until that call happens.
Can AI really clone a voice from a short clip? Yes. Current voice tools can mimic a person from a brief sample, which is why a familiar voice on the phone is no longer proof of identity. Confirm the request through a second channel.
Do I need expensive security software for this? No. The protection is a written verification step and a second approver, not a new tool. The process is what stops the loss, and you can run it on paper today.
Grant Fuellenbach is the founder of GO First Consulting, where he helps residential builders systemize their operations and protect their margins. Read more or book a consult at gofirstconsulting.com.