Voice Clone Fraud in
Construction

Why Construction Is a Prime Target for Voice Clone Fraud

Construction is a cash-flow-intensive industry with a structural exposure to fraud that most other sectors do not share. A single commercial project involves dozens of vendors, subcontractors, material suppliers, and inspection bodies — each expecting payments on tight timelines. Project managers routinely authorize changes verbally, accounting departments process payments under schedule pressure, and new contact relationships are formed on nearly every project.

This environment is exactly what voice clone criminals look for. Business Email Compromise (BEC) has long targeted construction — the FBI IC3's 2024 Annual Report documented $2.77 billion in BEC losses across all sectors, with construction consistently ranked as a high-exposure vertical due to its large wire volumes and fast payment cadence. Now, criminals have added AI voice cloning to the attack chain. Instead of relying on a spoofed email alone, they follow it up with a live phone call — using a cloned voice of the project manager, GC, or owner — to confirm the fraudulent instruction verbally. Many smaller construction firms also face the same structural weaknesses as other small businesses targeted by voice clone fraud, where a single employee with payment access is the only line of defense.

The effect is devastating. An accounting department that might have paused on a suspicious email will often override their hesitation when they hear their project manager's voice confirming the same instruction. Voice is the trust layer that email lacks — and criminals know it.

How the Attack Actually Works: A Construction Scenario

Here is how a typical voice clone construction fraud unfolds, based on documented attack patterns reported to the FBI:

Phase 1 — Reconnaissance. The attacker researches the target firm. They identify who the project manager is (LinkedIn, the company website, a project announcement press release), who handles accounting, and what projects are currently active. They find audio of the PM from a community meeting recording, a YouTube project walkthrough, or even a voicemail greeting. Just three seconds of audio is sufficient for modern voice cloning tools to produce a workable clone — and three seconds is a typical voicemail introduction.

Phase 2 — Email setup. The attacker sends a spoofed email — appearing to come from the PM or GC — to the accounting department, noting that a subcontractor has changed their banking details and the next payment should go to a new account. This email creates the "paper trail" the attacker will reference on the voice call.

Phase 3 — The voice call. The attacker calls the accounting department using a spoofed caller ID matching the PM's number. Using real-time voice conversion, they speak in the cloned PM voice, confirming the email: "Hey, just wanted to make sure you got my email about the new banking details for [Subcontractor]. We need that payment to clear before Friday or we lose the crew." The voice is the PM's. The number is the PM's. The accounting team processes the payment.

Phase 4 — Discovery. The real PM contacts the subcontractor about payment. The subcontractor confirms they never received it. By then, the funds have cleared to an account controlled by the attacker.

Change Order Fraud: The Construction-Specific Attack Vector

Change orders are a uniquely vulnerable part of construction workflows. On active job sites, verbal change order approvals happen constantly — a PM calls the foreman, an owner calls the PM, a GC calls the subcontractor. The expectation that significant changes will be verbally discussed before paperwork follows is deeply embedded in construction culture.

Criminals exploit this by using a cloned voice to verbally "approve" a fraudulent change order, then following up with fabricated paperwork. The sequence looks legitimate: the accounting team received a call from the PM approving the change, and now here is the invoice. Without a system to verify that the PM's voice was real — not a synthetic clone — there is no reliable point of detection in the existing workflow.

Vishing (voice phishing) attacks surged 442% between the first and second half of 2024, according to Security Magazine, and deepfake vishing specifically rose 1,633% in Q1 2025 alone, per Keepnet Labs. Change order fraud using voice cloning is not a theoretical risk — it is an active, documented attack pattern.

Supplier Impersonation: The Banking Detail Redirect

The second major attack pattern targeting construction is supplier impersonation. A criminal calls the accounts payable department posing as a known material supplier or subcontractor — using a cloned voice if they have audio, or simply using urgency and social engineering if they do not. The request: "We've changed our banking details. Can you update before you process next week's payment?"

This attack works because accounts payable staff field exactly this type of call legitimately, regularly. Suppliers do change banks. The request is routine. Without a verification protocol requiring callback to a known number from a verified directory (not the number that just called you), the change is made and the next payment is redirected.

When a real-time voice clone is used, the caller sounds exactly like the supplier contact the AP team has spoken with for years. Suspicion is essentially zero.

Prevention Protocol for Construction Firms

Five controls stop the vast majority of voice clone construction fraud. They require no technology beyond what most construction firms already have — except for the last one, which is Vicall.

What to Do If Your Firm Is Attacked

Speed is everything. Wire fraud recovery drops dramatically after the first 24 hours. If you discover a fraudulent wire has been sent:

1. Immediately contact your sending bank — request a wire recall. Give them the full transaction details. Every minute matters.
2. Contact the receiving bank with the full account details the funds were sent to and request a hold.
3. File a report at ic3.gov (FBI IC3) — if the wire was $50,000 or more and within 72 hours, this activates the Financial Fraud Kill Chain (FFKC), which has a 66% success rate at freezing funds. The FBI FFKC froze $561.6 million in 2024. Most construction owners have never heard of this process — it is the single most important action after a fraud event.
4. Contact your nearest FBI field office directly and reference your IC3 report number.
5. File an FTC report at reportfraud.ftc.gov.
6. Preserve all evidence — call recordings, email threads, voicemails, bank statements, and any communication related to the fraud. Do not delete anything.

How Vicall Works for Construction Companies

Construction firms operate across multiple locations and device types — mobile phones on job sites, desk phones in the main office, and sometimes analog lines in older buildings. Vicall is designed to cover all of these:

• Mobile phones (job sites and office staff): Install the Vicall app on the smartphones used by accounting, project management, and anyone with payment authority. Vicall runs entirely on-device — no internet connection required for detection, no audio is sent to the cloud.
• Analog office lines: Vicall's on-premises Mac mini deployment connects to your main office phone line and provides the same real-time synthetic-voice detection for calls coming in on traditional phone systems. No new hardware replacement required — Vicall works alongside your existing phones.
• Any phone: Because Vicall detects the voice in the audio stream of the call, it works regardless of what phone system or carrier is being used on either end.

When accounting receives a call from the project manager's number and Vicall shows SYNTHETIC DETECTED, the call ends. The wire instruction never gets acted upon. The attack fails.