Cyber security for builders: protecting your business data and payment details

You already know the physical risks on a job: falls, electrical hazards, unsecured loads. The risk that can empty your business bank account and hand your client list to a competitor sits in the office, in the email account that holds your quotes, contracts, invoices and bank details. Cyber security for builders is not about becoming an IT expert. It is about recognising that your business data is an asset worth protecting, and putting basic controls around it.

The Australian Signals Directorate runs a small business cyber security hub because small businesses are targeted precisely because they are small. They rarely have an IT department, they often rely on one person to handle accounts, and they hold information that a criminal can sell, ransom or use to commit fraud. For a builder, that information is specific: pricing, client lists, contract terms, employee bank details for payroll, and the bank account you use to pay subbies.

This article deals with the risk to your own data and payment details. Payment redirection scams — where a criminal impersonates a supplier and asks you to pay a different account — are a related but separate problem. Here we are looking at what happens when someone gets into your systems, what they take, and what you do about it.

What a cyber criminal actually wants from a building business

It helps to think like the attacker. A builder’s email account is valuable because it is a hub. It contains quotes you have sent to clients, contracts you have signed, invoices from subbies, remittance advices, and often bank account details for employees and suppliers. If a criminal gets access to that mailbox, they can read a thread about a progress claim and know exactly when money is about to move.

The Australian Signals Directorate’s Australian Cyber Security Centre describes business email compromise as a type of attack where a criminal gains access to a legitimate email account, or spoofs one, and uses it to trick people into paying money or handing over information. The attacker does not need to break into your accounting software if they can send an email from your address asking your bookkeeper to update a bank account.

For a builder, the consequences go beyond the immediate loss. If your email is compromised, a client’s contract terms or a competitor’s quote can be read. If payroll records are taken, your employees’ personal information is exposed, and you have to manage that. If your accounting software is accessed, a criminal can create false invoices or change payment details on existing ones.

The specific data you hold that creates the most risk

Not all data is equal. Some of it is a nuisance if it leaks; some of it is a direct route to money. The following categories are the ones to prioritise.

• Bank account details for your business, your employees and your regular subbies. A criminal who can change these in your system or in a client’s system can redirect a payment.
• Contracts and variations that contain pricing, payment terms and scope. These are commercially sensitive and can be used to undercut you or to dispute a claim.
• Client and contact lists that represent years of relationship building. Losing them to a competitor is a slow-burn commercial injury.
• Payroll and tax records including tax file numbers and superannuation details. These carry privacy obligations and are valuable for identity fraud.
• Email threads that show how you negotiate, who you deal with, and when you are under pressure. This is the context a criminal needs to craft a believable request.

If you use cloud accounting software, project management tools or a shared drive, that data is spread across several services. Each one is a door into your business. The question is not whether any single door is perfectly secure, but whether you would notice if someone walked through it.

How business email compromise works on a building site

The ASD’s guidance on business email compromise explains the common pattern: the attacker either compromises an account or spoofs a trusted one, then sends a plausible request. It might be an email that appears to come from your foreman asking for a bank detail change, or from a client asking you to resend an invoice because the original was lost. The request looks routine because it mimics the way you already work.

On a building site, the tell is often in the timing. Cyber criminals watch for busy periods: end of month, just before a progress claim is due, or the week before Christmas when everyone is trying to get paid. They know that a request that arrives when you are under pressure is more likely to be actioned without a second look.

The mechanism is not sophisticated. It relies on the fact that most people trust an email that appears to come from a known address. Once trust is established, the attacker asks for a small change: a new bank account, a copy of a contract, a login to a shared portal. Each small step builds toward a payment or a data theft.

Multi-factor authentication and the controls that actually stop an attack

Most account takeovers are stopped by controls that are simple to turn on. The ASD’s small business cyber security hub recommends a handful of essential measures. For a builder, the highest-value ones are these.

Multi-factor authentication. MFA adds a second step to logging in, usually a code from an app or a hardware key. It means that a stolen password alone is not enough. Turn it on for email, accounting software, and any cloud service that holds contracts or payroll. If you use a shared login for the office, stop; each person should have their own account with MFA.

Strong, unique passwords. Reusing the same password across your email, your accounting software and your supplier portal means one breach exposes all three. Use a password manager to generate and store unique passwords. It is not perfect, but it removes the easy path.

Access control. When a staff member or subbie leaves, remove their access the same day. Review who has administrator rights on your email and accounting systems. The fewer people who can change bank details or export data, the smaller the exposure.

Backups. Keep a backup of critical data offline or in a separate cloud account. Ransomware attacks encrypt your files and demand payment; a tested backup means you can restore and keep working. Test that a restore actually works, not just that the backup job ran.

Payment verification. Build a rule into your accounts process: any change to bank details, for any payee, is confirmed by phone with a known contact. Use a number you already have, not one supplied in the email requesting the change. This is the control that sits between cyber security and fraud prevention, and it is the one that saves money in the moment.

What to do when you suspect a breach

If you think an account has been compromised, speed matters. The first step is to contain the problem: change the password on the affected account, turn on or reset MFA, and sign out active sessions. If you have an IT provider, call them. If you do not, work through the account settings yourself and check for forwarding rules or unfamiliar devices.

Next, contact your bank immediately if there is any chance money has moved or bank details have been changed. The sooner the bank knows, the better the chance of stopping a payment. Then report the incident to the Australian Signals Directorate’s ReportCyber service. Reporting creates a record and gives you access to guidance. It also helps authorities see patterns of attacks on small businesses.

If personal information has been exposed, such as employee payroll details, you may have obligations under privacy law. Check the current requirements with the Office of the Australian Information Commissioner. If client contracts have been accessed, tell the affected clients. They will find out eventually, and being upfront protects the relationship.

Finally, review what happened. Was it a weak password, a missed MFA prompt, or a staff member who was tricked? The answer tells you which control to strengthen. A breach you learn from is a cost; a breach you ignore is a repeat.

Cyber security and the Security of Payment deadlines

The Security of Payment laws in NSW set out strict timeframes for serving payment claims and responding to them. If your email is compromised, you might not see a payment claim that arrives, or a response might be sent from your account without your knowledge. Missing a deadline can mean losing the right to claim or to dispute a claim.

The NSW Government’s guidance on security of payment for construction contractors explains the importance of serving and responding to claims within the required periods. From a cyber security perspective, this means your email and document systems need to be reliable. If you rely on a single mailbox to receive claims, and that mailbox is compromised, you have a single point of failure for your cash flow.

Consider keeping a separate email address for formal notices, or using a project management platform where claims are logged and timestamped. That does not remove the cyber risk, but it gives you a second channel to verify that a claim was received or a response was sent. For more on how progress claims work in NSW, see our article on progress claims and security of payment in NSW.

Worked example: a builder in western Sydney

A small building company in western Sydney runs two projects and employs a part-time bookkeeper. The owner uses one email address for everything: quotes, contracts, supplier correspondence and bank notifications. The bookkeeper uses the same accounting software login as the owner, because it was easier to set up that way.

One Tuesday, the owner receives an email that appears to come from a regular subbie. The subbie says his bank account has changed and asks for future payments to go to the new account. The email looks normal; it even references a recent conversation about a variation. The owner forwards it to the bookkeeper and asks her to update the details. Two days later, a progress payment of a substantial amount goes to the new account. The subbie calls a week later asking why he has not been paid.

The money is gone. The bank cannot recover it because it was transferred to an account that was closed immediately. The builder has to pay the subbie again to keep him on site, and the project margin takes a hit. The investigation reveals that the subbie’s email account had been compromised, and the attacker had been reading the thread for weeks, waiting for a payment to be scheduled.

What would have stopped it? A phone call to the subbie using the number already stored in the builder’s phone. MFA on the subbie’s email would have made the initial compromise harder, but the builder cannot control that. The builder can control the verification step. The builder can also separate the accounting login so the bookkeeper has her own credentials, and can turn on MFA for the accounting software. None of these steps are technical; they are process changes.

For more on the commercial side of payment risk, see our article on early warning signs of builder insolvency.

Building cyber security into your office routine

Cyber security is not a one-off project. It is a set of habits, like checking scaffolding before a pour. The ASD’s small business hub suggests regular reviews, and the specifics matter less than the consistency. A monthly check of who has access, a quarterly reminder about payment verification, and an annual review of your backups will cover most of the risk for a small building business.

If you are not sure where to start, start with MFA on your email and your accounting software. That single step blocks the most common attack path. Then add the payment verification rule. Then review access. Each step reduces the chance that a criminal can turn your own business data against you.

For builders in NSW, CPD is a chance to keep these business systems current. Our guide to how NSW builder CPD works explains the requirements, and our course catalogue includes modules on business and technology. If you want to understand how automation can reduce manual handling of invoices and claims, see our article on automation for the small builder office.

Where to get authoritative guidance

The Australian Signals Directorate’s small business cyber security hub is the best starting point for practical, Australian-specific advice. It covers the essentials without jargon and is updated as threats change. The business email compromise page explains the specific threat in more detail. ReportCyber is where you go when something has happened.

Your bank and your insurer may also have requirements or support. Some business insurance policies cover cyber incidents; check what yours covers before you need it. Your accountant or bookkeeper can help you set up payment verification processes that fit your existing workflow.

No single control makes you immune. The goal is to make your business a harder target than the next one, and to have a plan for when something goes wrong. That is not a technical exercise; it is a business discipline, and it sits alongside the other disciplines you already apply on site.

Questions builders ask

• Business
• Contracts
• Cyber security
• Data

Published 16 July 2026. General information for builders, not legal, financial or engineering advice for a specific job. Check current requirements with the relevant regulator or standard before relying on them.