Pearland Construction Company Blocks $280,000 Wire Fraud Attempt

A Pearland construction company with $28 million in annual revenue nearly wired $280,000 to an attacker masquerading as a subcontractor. The fraud was caught — but only barely. What followed was a complete overhaul of their email security and payment verification procedures.

How the Attack Almost Worked

The attacker had compromised the actual email account of a subcontractor the company worked with regularly. Using the real email account, the attacker changed banking information for an upcoming $280,000 payment: “Please update our banking details for the upcoming draw — we changed banks last month.” The email came from a real account, referenced a real project and real people, and looked completely legitimate. The AP clerk was ready to update the banking information and initiate the wire.

What Stopped It

The company had implemented SpaceTown IT’s wire transfer verification procedure six months earlier after a competitor was defrauded. The procedure required: any banking information change must be confirmed via phone call to a phone number independently sourced (not from the email). The AP clerk called the subcontractor’s main office number — which confirmed no such request had been made. The subcontractor’s email had been compromised without their knowledge.

What SpaceTown IT Implemented

Following the near-miss, SpaceTown IT implemented a complete email security overhaul: advanced email security with impersonation detection, DMARC/DKIM/SPF enforcement for the company’s own domain, security awareness training for all AP and finance staff covering BEC attack patterns, documented wire transfer procedure requiring dual approval and out-of-band verification for all payments over $10,000, and dark web monitoring to alert if company email credentials appeared in breach databases.

Outcome

No incidents in 18 months following the security implementation. The AP team receives regular phishing simulations and has demonstrated 100% recognition of simulated BEC attacks in the last four quarterly tests.

Protect Your Houston Construction Business

SpaceTown IT provides email security and construction IT for Houston companies. Call (832) 304-9748.