Construction AP Fraud Prevention: Implement Checks & Balances for Payment Authorization
- Cost Construction Accounting
- 2 days ago
- 6 min read
A mid-size electrical contractor in Los Angeles processed a $63,000 progress payment to their longtime drywall sub last month. The email requesting a banking change looked legitimate, same signature, correct project references, even the usual typo. The money vanished. The real sub never got paid. The project stalled.
Construction companies lose an average of $250,000 per fraud incident well above other industries. With decentralized job sites, high-value subcontractor payments, and complex change orders, your AP process has vulnerabilities you can't afford to ignore.
Unlike budget overruns you can manage, fraud losses are gone forever along with your profit margin, bonding capacity, and reputation. This guide shows you exactly how to implement fraud-proof payment controls that protect millions without slowing down operations.
AP Fraud Schemes Hitting Construction Right Now
Business Email Compromise (BEC)
Fraudsters spoof emails from legitimate vendors requesting "updated" banking information. The LA story above? That's BEC. It accounts for over 40% of construction AP fraud. Red flags include email addresses one character off, urgent payment requests, and banking changes via email instead of your standard vendor process.
Ghost Vendors
An employee creates fake vendors and submits invoices for work never performed. Real example: A Orab PM created five ghost subs over two years, billing for "site cleanup" and "traffic control." Total loss: $340,000 before discovery.
Change Order Collusion
Your employee and a sub collude to inflate change orders, then split the excess. A legitimate $15,000 change order inflated to $22,000 looks reasonable when you're managing dozens of changes across multiple projects.
Duplicate Payments
The same invoice gets paid twice through different submission methods. On a $5 million project with 200 invoices, just 2-3 duplicate payments of $25,000-$50,000 each can erase your entire profit margin.
AI-Generated Fake Invoices
Fraudsters research your projects through public permits, then submit professional invoices for plausible services. In 2026, AI generates invoices that perfectly match legitimate vendor formats including correct tax IDs and invoice numbering. Manual review can't spot them anymore.
4 Control That Make Fraud Nearly Impossible
1. Segregation of Duties
No single person should control the entire payment lifecycle. Separate these functions across different people: invoice receipt, verification against contracts, payment approval, payment execution, and bank reconciliation.
For smaller firms without five people, implement compensating controls like owner review of payments over $10,000, mandatory vacation policies, and quarterly rotation of who reconciles statements.
Why it works: A single person can commit fraud. Two people colluding is exponentially harder. Three or more? Nearly impossible without obvious evidence.
2. Multi-Level Authorization
Create tiered approvals based on risk. Payments under $5,000 require project manager confirmation. $5,000-$50,000 adds AP manager validation. $50,000-$500,000 needs controller or CFO review. Over $500,000 requires executive approval. All change orders need additional approval regardless of amount because they're prime fraud targets.
3. Enhanced 3-Way Match Plus Construction Verifications
Match purchase order or contract against receiving report or site inspection and vendor invoice. Then add construction-specific verifications: lien waiver validation, retainage calculations (typically 5-10%), change order documentation, certified payroll compliance for prevailing wage work, and site photos confirming completion dates.
4. Complete Digital Audit Trail
Document everything with timestamps and approver IDs. Your AP system should automatically log who approved what, when, and why standard controls were bypassed. This creates accountability that prevents fraud because employees know their actions are permanently recorded and reviewable.
Your 5-Step Fraud Prevention Implementation
Step 1: Lock Down Your Vendor Master File
Require W-9 forms with verified EIN/TIN numbers, current business licenses, proof of insurance, three professional references, and banking information verified by phone using a number you look up independently never trust contact info from emails requesting banking changes.
Critical control: Only controller or AP manager can add vendors or change information. All changes require dual approval. Every banking change triggers automatic notification to owner or executive.
Flag high-risk vendors: new subs without track records, out-of-state vendors requiring wire transfers, and any vendor whose billing pattern changes suddenly.
Step 2: Centralize and Validate Every Invoice
Send all invoices to dedicated AP email or portal. Never allow field staff to process locally. Perform immediate validation: Does vendor exist in master file? Is there an active contract? Is the project in progress? Check for conditional lien waivers for progress payments, certified payroll if prevailing wage job, and correct retainage calculations.
Step 3: Build Multi-Checkpoint Approval Workflow
Field Verification: Project manager confirms work completion using site photos, daily logs, and personal inspection. For materials, verify against signed delivery tickets and physical site inventory.
Contract Compliance: AP staff matches invoices to contracts, approved change orders, and payment schedules. Verify pricing matches contract rates exactly.
Financial Authorization: Controller or CFO reviews budget impact, cash flow timing, and any system alerts flagging unusual patterns.
Any bypass of standard procedure requires written justification and one approval level higher than normal.
Step 4: Secure Payment Execution
The person who prepares payments cannot execute them. This single control stops most internal fraud. Use ACH with positive pay verification as first choice, banks flag payments to new vendors automatically. For wire transfers, require dual authorization and verify payee details before releasing. Avoid paper checks whenever possible, they're easiest to tamper with.
Step 5: Post-Payment Monitoring
Conduct monthly bank reconciliations by someone independent of payment processing. Run weekly automated reports detecting duplicate invoices, payments to new or modified vendors, unusual payment concentrations, and payments bypassing standard workflows. Quarterly, analyze which vendors have highest exception rates and which project managers request rush payments most frequently.
Technology That Detects What Humans Can't
Construction-specific AP platforms like Procore, Sage 100 Construction, Autodesk Construction Cloud, and Bill.com automate three-way matching, track lien waivers electronically, enable mobile approvals, and manage retainage calculations automatically.
AI-powered features continuously monitor payment patterns and flag anomalies: duplicate invoice detection across numbers, amounts, and dates; unusual billing pattern alerts when vendor behavior deviates from norms; real-time fraud risk scoring; and continuous learning from your approval patterns to catch deviations.
ROI: One prevented $250,000 fraud incident pays for 5-10 years of software subscriptions. Most firms see positive ROI within 12 months from combined fraud prevention and efficiency gains.
The Weekly Monitoring System
Weekly (30-45 minutes): Review all payments over $25,000, new vendors or banking changes, invoices bypassing standard workflow, and positive pay exceptions.
Monthly (2-3 hours): Complete bank reconciliation, vendor verification calls on random sample, review vendor concentration, and analyze exception patterns.
Quarterly (half day): Deep dive on which vendors have highest control exceptions, which PMs request rush approvals most, and which projects generate most change orders.
Annually (full day): Fraud awareness training for everyone touching payments, update fraud response procedures, and test segregation of duties controls.
Build fraud-aware culture: Anonymous reporting channels where employees can flag suspicious activity. Most fraud gets discovered through employee tips, not automated controls. Leadership must consistently reinforce that fraud prevention is non-negotiable even when it temporarily slows payments.
Stop Fraud Before It Stops Your Business
The four principles that make fraud nearly impossible: segregation of duties, multi-level authorization, enhanced 3-way match with construction verifications, and complete digital audit trails. Your five-step implementation: lock down vendor master, centralize invoice intake, build approval checkpoints, secure payment execution, and monitor continuously.
Technology amplifies human controls. Construction-specific AP platforms with AI-powered fraud detection catch patterns manual reviews miss. Continuous monitoring through weekly reviews, monthly reconciliations, quarterly deep dives, and annual assessments keeps controls effective as fraud tactics evolve.
Your Payment Process Is Either Fraud-Proof or Profit-Draining
At Construction Cost Accounting, we help construction owners, general contractors, and subcontractors implement fraud-proof AP systems that protect profits without slowing down operations.
Our clients typically discover 3-7 critical fraud vulnerabilities they didn't know existed and close them before losing a single dollar.
Your payment process shouldn't keep you up at night wondering if the next invoice is legitimate or if that wire transfer went to the right account.
The next fraud attempt is already in your inbox. Are your controls ready? Schedule Your Free AP Fraud Assessment
No obligation. No sales pressure. Just expert guidance on protecting your payments and profits.
Comments