Cases in which a payment was redirected to the wrong account, involving builders, contractors, trades and the people who pay them. Each one is dated and linked to its source.
These are cases published by courts, police and regulators that we have read at source. Not every fraud is made public.
In June 2026 the Bedford Area School District in Pennsylvania sent a $1.65 million payment meant for the builder renovating its high school to a thief, after an email that appeared to come from the builder changed its payment address. The district recovered the full amount, state police said in August 2026.
Police in College Station, Texas say a Florida homeowner wired $50,038 in July 2025 to someone writing as her building company, from an address and domain that were slight variations of the company's own. The arrest was reported on 1 July 2026.
an email address and domain that were slight variations of the legitimate company’s email and website
In March 2026 the Town of Surfside Beach, South Carolina, paid about $545,000 meant for its utility contractor into a fraudster's account. The contractor said the email thread behind the payment used an address with an extra letter in the company's name. State police and the FBI are investigating.
In January 2026 Valencia County, New Mexico lost $2.02 million to someone posing as a member of the construction firm building its new hospital. The county's statement calls it an email phishing scheme and does not say how the email was faked.
In December 2025 the Warren County Treasurer's Office in New York sent two payments totalling about $3.3 million to an account set up by someone posing as a materials supplier. The sheriff said in January 2026 that basic safeguards could have prevented it. About $1.2 million was recovered.
In December 2025 the Pine Bluff School District in Arkansas wired $3.2 million against what it took for an invoice from a vendor on the construction of its new high school. The district said in April 2026 that one of its own staff mailboxes had been compromised and false wiring instructions added to the real thread.
A district email employee account had been compromised, and, while a legitimate invoice had been received, fraudulent wiring instructions were later introduced in the same email thread through a phishing scheme designed to closely mimic authentic communications.
A lawsuit filed in British Columbia in May 2026 says a property developer wired $1,341,478 meant for its general contractor to a fraudster in April 2026, after messages sent from a look-alike domain. Part of the money was frozen at the bank. That is a claim, not a finding.
An Ontario court decision from April 2026 covers the Town of Mississippi Mills, which paid $201,285 it owed its sewer contractor into a fraudster's account, after emails from someone posing as the contractor's project manager. The decision says discrepancies in the email addresses had been noted.
Although some discrepancies in the email addresses had been noted, the municipality then received assurances from what now appear to be other fraudulent email addresses.
Australian Federal Police said in October 2025 that scammers posing as a construction company, with detailed knowledge of its dealings with a Queensland organisation, caused losses of more than $1 million. Some of the money was recovered.
The scammers impersonated a legitimate construction company and appeared to have detailed knowledge of its relationship with the organisation, indicating that extensive research had been carried out.
Australian Federal Police said in October 2025 that a Tasmanian homeowner lost $120,000 after criminals, writing from an address that closely mimicked her renovation builder, said its bank details had changed and sent a new invoice. The money was not recovered.
Using a spoofed email address that closely mimicked the legitimate business, the criminals claimed the company had updated its banking details and sent a new invoice.
In October 2025 West Shore RCMP in British Columbia said a local construction company's computer system was compromised and fraudulent invoices were sent to its clients. Police asked anyone paying an invoice to check it with the business at a number they already know.
The West Shore RCMP is currently investigating a report involving a local construction company whose computer system was compromised, resulting in fraudulent invoices being sent to clients in October 2025.
A BC tribunal decision in September 2025 covers a gravel contractor whose email was hacked. The fraudster told its trucking customer to send payment to a different e-transfer address, and the customer did. The tribunal ordered the customer to pay the contractor what was still owed.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
The FBI's Internet Crime Complaint Center recorded 24,768 complaints of business email fraud in 2025, with $3.05 billion in reported losses. It does not break the figure down by how the email was faked.
Reported losses, as the publisher states them. They describe what was reported, not what will happen to your firm.
Your SPF and DMARC records, in plain words: whether a message that fakes your address is refused or delivered.
How we check itRegistered domains made from your firm’s name. We tell you which deserve a second look, with the public record behind each, and ask: is it yours?
How we check itAddresses at your domain in monitored breach databases. A reused password can open a real mailbox, and a real conversation with a client.
How we check itAn outside check cannot see inside a mailbox or a bank. Where a source does not state the way in, we do not guess it.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.