Cybersecurity for Small Contractors

Construction companies move big payments, share drawings and bids, and run payroll for crews, often with no IT department. That makes them attractive targets for fake invoices, payroll diversion and ransomware. A small number of habits stop most attacks, and they don’t require an IT budget.

• Contractors
• Small businesses
• Office staff

The biggest threats

• Invoice and payment fraud: a criminal hacks or spoofs a supplier’s or customer’s email and sends “new bank details.” Contractors have lost entire progress payments this way. See Phishing.
• Payroll diversion. See Payroll Scams.
• Ransomware locking estimates, schedules and accounting. See Ransomware.
• Stolen laptops, tablets and phones from trucks and job trailers.

Top 10 checklist

• Turn on two-factor authentication for email, banking, payroll, accounting and cloud storage
• Verify every change to bank or payment details by phone, using a number you already have, never one in the email
• Require two people to approve large payments or new payees
• Use a password manager and unique passwords. See Password Managers
• Turn on automatic updates for all computers, phones and routers
• Back up business files, with one copy offline or with version history, and test restores
• Lock all devices with a PIN, and turn on remote locate and wipe
• Give each person their own login; don’t share accounts
• Remove access the same day someone leaves the company
• Train everyone, including field staff, to spot and report scams

Shared jobsite devices

• Tablets and laptops in job trailers should have screen locks, updates and only the apps the crew needs.
• Sign out of email and accounts at the end of the day.
• Don’t save passwords in browsers on shared devices.
• Track devices so you know if one goes missing.

Simple incident plan

1. Who staff should call first if they clicked something or see something odd
2. Your bank’s fraud line (to stop a payment fast)
3. Your IT provider or a trusted technician
4. Your insurance company (ask whether you have cyber coverage)
5. Reporting to the FBI at ic3.gov

Keep it on paper too, in case computers are down. See Reporting Scams.

Free help

CISA offers free guidance and services for small businesses, and the Small Business Administration has cybersecurity resources. Some industry associations offer training too.

Last updated: October 2, 2026