A request to change bank details is ordinary on a construction job, which is what makes funds transfer fraud work here. Nothing gets broken into and no system gets breached.
of construction executives had at least one cybersecurity incident in the past twelve months.
0%
of construction firms meet the criteria for high technology maturity.
176
ransomware incidents were posted against construction organizations in a single quarter this year.
$141K
average loss to funds transfer fraud, the most common cyber insurance claim of all.
Incident and maturity figures from Wipfli, The State of Technology in the Construction Industry 2026, published July 2026, which surveyed 308 construction executives. Incident count from Dragos, Industrial Ransomware Analysis, second quarter 2026, counting victims posted publicly by ransomware groups. Fraud loss from the Coalition 2026 Cyber Claims Report, which covers claims across all industries. Checked September 2026.
The platforms you run on
Your platforms, and the site
The platform answers below come from Procore's and Autodesk's own published terms and announcements, because these are the questions an owner asks and a guess is worse than no answer.
Procore
You own the project data. Getting it out has a deadline
Procore's subscription agreement says customer data remains owned exclusively by the customer. The part worth writing down comes after the contract ends: Procore makes the data available read only for thirty days after termination, and after that has no obligation to keep it and may delete it. Thirty days is not long to extract years of submittals, RFIs and photographs. It is also not something to find out about during an exit.
Getting it out is an admin job, and the clock is short
The route most firms will use is Project Archive, which came out of beta in July 2026 and was called Data Extracts 2.0 before that. It runs inside the platform and needs admin permission to export. There is also the older Procore Extracts desktop tool, and the API for anyone pulling into a warehouse. None of these is a button an office manager finds on a Friday, so an exit wants planning and someone with the right permissions lined up first.
Where the files sit is a question you will be asked
Procore runs on Amazon Web Services and offers file storage zones in sixteen locations, with data replicated across at least three data centers in a zone. Worth being precise: those are file storage zones, and Procore has said it is still developing full in region infrastructure, starting with Europe. If a client asks where project data resides, that is the accurate answer.
The certifications, current as of this year
ISO 27001 in its 2022 revision, SOC 1 Type 2 and SOC 2 Type 2. Procore for Government reached FedRAMP Moderate in January 2026, which applies to that edition and not to the commercial platform. If you are answering an owner's security questionnaire, those are the ones to cite, with the government caveat stated.
Autodesk and the site
Autodesk Construction Cloud is called Forma now
As of 24 March 2026, Autodesk Construction Cloud joined the Autodesk Forma brand. Autodesk Build became Forma Build, Autodesk Docs became Forma Data Management, and BIM Collaborate Pro became Forma Design Collaboration. Autodesk states there are no changes to licensing, user provisioning, workflows or automations. It is a rename, and anyone telling you it is a migration is selling something.
BIM 360 is not being retired, whatever you have heard
Autodesk's position is that there are no current plans to retire the BIM 360 platform, though it will get no new features. What is going away are the legacy modules. BIM 360 Glue was retired on 31 July 2026. Those are different statements and they get conflated constantly, usually by somebody quoting a deadline to move you onto something.
Connectivity at the trailer is a design decision
Fixed wireless over cellular has become the practical answer for most sites, and it goes in without a technician visit, which matters when the site office moves. Satellite is the fallback where there is no cellular worth having, usually through a reseller. The workload decides it. Uploading drawings and photographs is a different problem from running cameras and sensors continuously.
AI arrived through tools you already bought
Sixty one percent of contractors surveyed by the Associated General Contractors and Sage now use AI or plan to increase what they spend on it, up from 44% the year before. It is going into office and administrative work at 45%, estimating at 23%, and design or preconstruction at 20%. Most of it arrived inside software the firm was already paying for, without anyone deciding to adopt it. A short written rule about what may be put into these tools is worth having before a subcontractor asks how their pricing is being handled. There is an acceptable use policy template for that.
The site is where devices get lost
Trailers get broken into and tablets get left in trucks. Full disk encryption on every laptop turns that into a hardware replacement instead of a notification. Anything that leaves the office wants encryption on, checked, and the recovery key held somewhere reachable.
Sources: Procore Subscription and Services Agreement; Procore infrastructure and trust pages; Procore support documentation on data storage and extracts; Autodesk, Autodesk Forma March 2026 construction releases; Autodesk, BIM 360 end of life clarification; Associated General Contractors of America and Sage, 2026 Construction Hiring and Business Outlook, which surveyed 951 respondents in November and December 2025. Checked September 2026.
Where the money goes missing
The fraud is aimed at your payments
Construction is close to an ideal target. Payments are large, they arrive on a schedule anyone can guess, the subcontractor chain is long, and banking details do change mid-job. A request to update remittance details does not look strange here.
76%
Nearly everyone gets attempted
Three quarters of United States organizations experienced attempted or actual payments fraud in 2025. Wire transfers were hit at 25%, ACH debits at 30%, and checks, which construction still runs on, at 58%.
74%
And the way in is email
Business email compromise reached about three in four organizations in the same year. It rarely involves breaking anything. Somebody reads the thread, waits for a payment application, then sends a polite note about new banking details.
17%
Almost nobody has tooling on it
Only 17% of organizations use AI or automated tools against payments fraud, so the control that works is still procedural: a call back on a number you already had, never the one in the email.
The controls are unglamorous. Multifactor on email stops the mailbox being read in the first place, and a call back to a number you already held stops everything that follows from it. None of it is expensive, and it is the same short list your cyber insurance application asks about.
Figures from the 2026 Association for Financial Professionals Payments Fraud and Control Survey, published April 2026, which surveyed 465 treasury practitioners at United States organizations across all industries. Checked September 2026.
The work itself
What we run for construction firms
The same managed service as every other client, built to follow the work out to the site and back.
Connectivity that moves with the trailer
Specified against the work the site actually does, installed without waiting on a carrier appointment, and moved when the site moves.
Payment fraud controls that fit the job
Multifactor on email, a verification step for any banking detail change, and training that repeats. Cheap, unglamorous, and the thing standing between you and a redirected progress payment.
Encryption on everything that leaves
Laptops and tablets encrypted, monitored so it stays on, and the recovery keys held where you can reach them. A stolen device becomes a hardware line item instead of a notification.
You own it, and the thirty day read only window after termination is the part that catches people out. The useful move is to stop treating this as an exit question. Ask your Procore administrator to run a full extract now, in a quiet week with no deadline attached, then look at what comes out and in what shape. Firms are regularly surprised: drawing sets that come back without their markups, photographs that arrive with nothing tying them to the item they documented. Far better to learn that this month than inside a thirty day window with a handover deadline on top. Running it once a year also leaves you an offline record of closed projects, which is exactly what a client or an attorney asks for four years later.
Is Autodesk Construction Cloud going away?
No, it was renamed, and the practical effect lands on your paperwork more than on your projects. Autodesk folded the products into the Forma brand in March 2026 and says licensing, provisioning and existing workflows carry across unchanged. What it does reach is everything with the old names written into it: subcontractor onboarding guides and the specification language telling a trade partner where to send submittals. Documents like that go stale quietly, and we usually find them the first time somebody new tries to follow the instructions and cannot find the product being named.
Do we have to meet cybersecurity requirements to win work?
Increasingly, yes, and it depends who the owner is. For Department of Defense work the CMMC rule took effect on 10 November 2025 and flows down to subcontractors who handle federal contract information or controlled unclassified information, which the Associated General Contractors maps to different levels depending on what you touch. For private owners the requirements arrive as contract exhibits and prequalification questionnaires, and there is no industry standard form yet, so each one is read on its own terms.
How worried should we be about payment fraud?
Enough to change how you handle banking detail changes. The FBI recorded just over three billion dollars in business email compromise losses in 2025 across nearly twenty five thousand complaints, and it does not publish an industry breakdown, so there is no construction specific number to quote. What is specific to construction is that every one of those conditions is normal here rather than exceptional. That is the pattern the fraud is built around.
What connectivity works on a jobsite?
For most sites, fixed wireless over cellular. It installs without a technician, which matters when the trailer moves, and it has the headroom for drawings and video calls. Where cellular will not carry the site, satellite is the remaining option and normally comes through a reseller. The right answer depends on what the site has to do, and running cameras and sensors continuously is a different requirement from getting the superintendent onto Procore.
We are a subcontractor with forty people. Does any of this apply?
The parts that cost you money do. Payment fraud does not care how big you are, and encryption on the devices that ride around in trucks is cheap. The security questionnaires arrive with or without somebody to answer them, and losing a bid because nobody could complete one is a real way to lose work. The rest can wait.
Who checks a banking detail change?
If the answer is whoever opened the email, start there.
