In short
- ✓Criminals hack builders' email accounts and send customers fake invoices with new bank details for deposits and stage payments.
- ✓Most work happens on phones and tablets on site, often with shared logins.
- ✓Main contractors and public sector clients increasingly ask subcontractors for Cyber Essentials.
Why builders, trades and construction firms are targeted
Builders, electricians, plumbers, roofers and other trades take large deposits and stage payments, usually agreed by email or text. If a criminal gets into your email, they can watch jobs progress and send your customer an invoice with their own bank details at exactly the right moment. The customer pays, and both of you lose.
Trades businesses run from phones, vans and site offices rather than a secure office network, so the basics often get missed. We help Surrey builders and trades lock down email and phones, protect customer payments and get Cyber Essentials when bigger clients ask for it.
The main risks
- Invoice and deposit fraud: hacked or spoofed emails sending customers fake bank details for deposits and stage payments.
- Fake supplier invoices and requests to change a supplier's bank details.
- HMRC and Construction Industry Scheme (CIS) themed phishing.
- Lost or stolen phones and tablets with email, banking and customer details on them.
- Shared passwords for email, accounting and supplier accounts across the team.
- Losing tenders or subcontract work for not having Cyber Essentials.
How we help builders, trades and construction firms
- Email Security & Phishing ProtectionDMARC and a payment call-back rule so customers can't be tricked by fake invoices in your name.
- Microsoft 365 & Google Workspace SecurityMulti-factor authentication and alerts on email, plus secure phones and tablets for site work.
- Cyber Essentials Certification SupportThe certificate main contractors and public sector clients often ask for, at a fixed price.
- Staff Cyber Awareness TrainingA short toolbox-talk style session on fake invoices, phishing texts and phone security.
- Cyber Incident ResponseFast help if a customer pays a fake invoice or your email is hacked.
Cyber security checklist for builders, trades and construction firms
- Turn on multi-factor authentication for email, banking and accounting software such as Xero or QuickBooks.
- Put a line on every quote and invoice: we will never change our bank details by email.
- Tell customers to phone you on a known number before paying a deposit or stage payment.
- Confirm any supplier bank detail change by phone before paying.
- Use a PIN or fingerprint on every work phone and tablet, and turn on remote wipe.
- Give each person their own login rather than sharing passwords.
- Set up SPF, DKIM and DMARC on your business email domain.
- Get Cyber Essentials before tendering for public sector or large contractor work.
Questions
How do I stop customers paying fake invoices in my name?
Protect your email with multi-factor authentication, set up DMARC so criminals can't spoof your domain, and tell customers in writing that you'll never change bank details by email and that they should phone you before paying.
Do builders need Cyber Essentials?
It isn't a legal requirement, but it's required for many central government contracts and increasingly asked for by main contractors and larger clients. It also covers the basics that stop most attacks.