Major Construction, Major Risk: How Associations Can Prevent Fraud and Cybercrime
By: Andrew Vera
Vice President, Association Banking, American Momentum Bank
Condominium and homeowners associations across the region are undertaking major construction and capital improvement projects. Whether driven by aging infrastructure, deferred maintenance, life-safety upgrades or long-term asset planning, these projects often involve significant financial outlays, multiple vendors and compressed timelines.
While these investments are critical for resident safety and long-term structural health, they also create an environment that fraudsters find especially attractive. Associations that are planning, bidding, or actively managing major construction projects face elevated financial and cybersecurity risks due to the volume, urgency and complexity of the transactions involved.
When millions of dollars begin moving quickly between associations, contractors, engineers, management companies and financial institutions, criminals take notice.
Why construction periods invite fraud
Criminals are opportunistic. They look for moments when organizations are stretched thin, making frequent payments and coordinating with multiple vendors. Major construction projects often involve all of those factors at once.
During construction phases, associations may process unusually large wire transfers, ACH payments and checks. Boards and community association managers are communicating rapidly with engineers, general contractors, inspectors and attorneys. Timelines can be tight, and pressure to keep projects moving is high.
That combination creates ideal conditions for business email compromise, payment diversion schemes and check or ACH fraud. A single fraudulent email or altered set of payment instructions can result in six- or seven-figure losses if safeguards are not firmly in place.
Common fraud and cybercrime risks
One of the most common threats associations face during construction is business email compromise. In these schemes, criminals impersonate trusted vendors or professionals, sending emails that appear legitimate and request changes to payment instructions or urgent transfers. The messages may reference real projects, invoices or deadlines, making them difficult to spot without proper verification procedures. They may also include invoices that look legitimate but have fraudulent routing and account numbers in the payment information.
Check fraud and ACH fraud also increase during high-payment periods. Fraudsters may intercept checks, alter payee information, or use stolen banking credentials to initiate unauthorized electronic transfers.
The hidden risk of process breakdowns
Not all fraud stems from sophisticated cybercrime. Sometimes the risk comes from internal process gaps that emerge when workloads increase.
Associations managing large-scale repairs may temporarily loosen controls to keep projects on schedule. Approval thresholds may be bypassed. Verification steps may be skipped. Board members or community association management (CAM) staff may rely on email instructions without confirming changes through another channel.
It’s important to keep in mind that even well-intentioned shortcuts can expose associations to significant losses.
Practical steps to reduce risk
The good news is that most construction-related fraud is avoidable with strong controls, awareness and collaboration among boards, management companies and banking partners.
First, associations should implement strict verification protocols for any changes to payment instructions. No vendor banking changes should ever be accepted via email alone. A call-back to a known, verified phone number should be mandatory before processing updates. Similarly, every invoice received via email should require a phone call to the vendor to verbally confirm not just the invoice amount but, more importantly, that the payment routing and account numbers are correct.
Second, maintain a clear separation of duties. No single individual should have the authority to initiate and approve large transactions. Dual controls and layered approvals add friction for criminals while protecting associations.
Third, invest in ongoing training. Board members and CAM staff should receive regular education on how to identify phishing emails, spoofed domains and social engineering tactics. Fraud prevention is most effective when everyone involved understands that urgency and familiarity are often used as weapons.
Fourth, work closely with your bank. Many financial institutions, including American Momentum Bank, offer tools such as transaction alerts, automated fraud detection tools like Positive Pay, call-back verification and customizable approval thresholds. These services create additional checkpoints before funds leave the association’s accounts.
Finally, consider cyber insurance coverage. Cyber insurance can help offset financial losses related to fraud, data breaches and cyber incidents, but coverage varies widely. Associations should review policies carefully to understand what is covered and where gaps may exist.
Staying vigilant throughout the project lifecycle
Major construction projects are critical milestones for community associations, but they also represent periods of heightened financial risk. Protecting association funds should be viewed as an essential part of project management, alongside contractor oversight and budgeting.
Strong internal controls, informed decision-makers and trusted banking relationships can significantly reduce risk. Fraudsters thrive in moments of transition and urgency. Associations that slow down, verify and communicate clearly are far less likely to become their next target.
Andrew Vera is Vice President, Business Development, Association Banking at American Momentum Bank. He can be reached at avera@americanmomentum.bank and (435) 841-2799.
