The attacks that do real financial damage to AEC businesses are rarely sophisticated technical exploits. They are confidence tricks executed over email, aimed at the moments when money moves: valuations, stage payments, retentions and supplier invoices.
The classic pattern: invoice redirection
An attacker compromises or convincingly imitates a supplier, subcontractor or even the practice itself, then sends a plausible email announcing new bank details shortly before a genuine payment is due.
Because the projects, names and amounts are real, often gleaned from a compromised mailbox that the attacker has quietly read for weeks, the request looks routine. The money leaves and by the time anyone reconciles, it is gone.
Why AEC is targeted
Project-based industries make ideal targets: many counterparties, regular large payments, time pressure and email as the default channel for financial instructions. A live project generates exactly the context an attacker needs to sound legitimate.
Defences that actually work
Process beats technology for this threat: any change of bank details should be verified by phone on a known number, without exception, including when the request appears to come from your own directors.
Technical controls still matter: enforced multi-factor authentication, mailbox-rule monitoring and modern email filtering close off the account compromises that make the fraud convincing in the first place.
Finally, staff awareness training turns your team from the attack surface into the alarm system. People who have seen the playbook spot it.