EMAIL SECURITY FOR CONSTRUCTION FIRMS AND ARCHITECTSStage payments,
paid to the real supplier.
Long supply chains, frequent high-value payments and payment instructions sent by email are why the National Crime Agency singles out construction for invoice fraud.
Good afternoon Alex,
Please note our bank details have changed following a move to a new bank. Please use our new bank account for the payment of valuation 6note 1 on the Brook Street job, and update your records for all future payments.
Note 1: New bank details, timed for a big payment
Account name: Hartwell Scaffolding Ltd Sort code: 11-22-33 Account number: 12345678
We need the payment to reach the new account by Friday to avoid the account going on holdnote 2. Our phones are being moved to a new systemnote 3 this week, so please confirm by email.
Note 2: Pressure to pay quickly
Note 3: A reason not to ring them
Kind regards, Accounts Department Hartwell Scaffolding Ltd
Very high riskJatzo's result for this fictional email
What moved the score
- Payment change with a warning sign+28
- DMARC failure reported+22
- Supplier payment details changed+16
and 4 more
Invoice and mandate fraud, as UK Finance recorded it.
- £41.3 millionlost to invoice and mandate fraud in 2025
- 2,305cases recorded in the year
- 68%of the losses came from business accounts
Criminals intercept emails or take over an email account, then pose as a supplier, a solicitor or a builder with new bank details. UK Finance, Annual Fraud Report 2026, June 2026 (opens in a new tab)
Report Fraud's analysis for 2024/25 found construction and manufacturing were the two sectors most affected by invoice fraud. National Crime Agency and National Federation of Builders, March 2026 (opens in a new tab)
What construction firms and architects worry about.
And what Jatzo does about each, in the inbox your team already uses.
A stage payment sent to a criminal
Criminals intercept or impersonate a subcontractor or supplier, and time new bank details for a large payment, when everybody wants it out of the door.
What Jatzo does
The check flags a change of bank details with a warning sign beside it, such as replies going elsewhere or a push to stop using the old account, before anybody pays.
Every planTenders and drawings that are not what they say
A firm opens attachments and links from people it has never dealt with every week. Only one of them has to carry something harmful.
What Jatzo does
The check looks inside attachments for macros, hidden scripts and risky archives, and checks links against Google Web Risk, before anybody opens them.
Every planStaff who are on site, not at a desk
The email asking for payment is often read on a phone between jobs, with the least time to think about it.
What Jatzo does
The Check button works in Outlook on a phone too, and says plainly which checks it could not run there. A High risk result also goes to your finance lead.
Business and Business Pro
How it unfolds for construction firms and architects.
Emails intercepted
Criminals intercept a supplier's emails, or impersonate the supplier, and learn who is due to be paid.
A valuation is agreed
A stage of the work is valued and a large payment to the subcontractor or supplier falls due.
- Check it here
New details arrive
A convincing email or invoice says the bank details have changed, with pressure to pay quickly.
The stage payment goes
Unless somebody rings the supplier on a number used before, the payment goes to the criminal.
The gold mark is where Jatzo's check fits: somebody has the email open and nothing has been paid yet.
The check before you pay.
Six steps, every time. Print it, put it by whoever pays the invoices, and agree that nobody skips it because somebody senior is in a hurry.
Download the one-page checklist (PDF)Never change a subcontractor's or supplier's bank details because of an email or letter alone.
Ring them on a number you have used before, not one on the invoice or the email.
Check the invoice matches the order, the valuation and the work done before it is approved.
A second person, not the one who received the request, approves the change.
For a first payment to new details, send a small amount and have the supplier confirm receipt by phone.
If money has gone, ring your bank's fraud line at once, then report to Report Fraud on 0300 123 2040 or reportfraud.police.uk (Police Scotland on 101 in Scotland).
What the firm gets.
It does not replace the call. It makes sure somebody makes it. Jatzo adds a check beside the message in Outlook and Gmail, at the moment somebody decides whether to pay, reply or click, and your existing email protection stays as it is.
Every invoice against confirmed bank details
Separate licence, from £129 a yearInvoice Fraud Checker, a separate Windows program, compares the bank details on each subcontractor's or supplier's invoice with the ones you confirmed, and says Stop when they differ. About the Invoice Fraud Checker
Check before the stage payment
Every planAnybody in the office unsure about a supplier's new bank details presses Check in Outlook or Gmail and sees a score out of 100 with the reasons.
Your finance lead hears at once
Business and Business ProWhen anybody checks a message scoring High risk or above, an email goes to addresses you choose at your own domain, such as your finance lead's.
Training for site and office alike
Business ProBusiness Pro includes every Training Centre course for everyone in the team, Invoice and payment fraud among them, with a record of who completed it.
Addresses made to look like yours
Business ProDomain Watch, on Business Pro, looks for new web addresses registered to look like your firm's, which a criminal could use to send your customers new bank details.
Which plan fits: an example
For construction firms and architects with 15 people, we suggest Business Pro: £180 a month, or £1,800 a year paid annually.
That is £12 a person a month.
Training for site and office staff, and Domain Watch for addresses that copy yours, are on Business Pro, which starts at five seats.
Business Pro includes the threat report, so you know what is being aimed at the firm and whether it is getting worse: every email your team checked that came back Suspicious or above, by kind of attack, the last 30 days against the 30 before, naming nobody. At the start of each month a report goes by email to the addresses you choose, saying what was checked and what is still waiting.
- The Check button in Outlook, including on a phone, and in Gmail, for everybody in the team.
- Staff do nothing. Whoever looks after your email adds it once, for everybody.
- Nothing to replace. Your email, and the protection it already has, stay as they are.
- Jatzo keeps the score and the findings for up to 90 days, never the email or its attachments.
- Pay monthly, or a year in advance for ten months' price.
The Invoice Fraud Checker is a separate licence, from £129 a year. About the Invoice Fraud Checker
What your sector's own bodies say.
Each point is linked to where it was published, with its date.
Check for changes to invoice or bank details, be wary of pressure to pay urgently, and verify by calling the genuine supplier on a number you have used before. Never transfer money until you are satisfied the details are correct.
Report Fraud replaced Action Fraud in December 2025. The number, 0300 123 2040, did not change. GOV.UK, Report Fraud: new service from City of London Police, December 2025 (opens in a new tab)
Questions construction firms and architects ask.
Our site staff rarely use email. Who needs a seat?
Only the people who check email in the team, usually the office, accounts and whoever approves payments. Business starts at two seats and Business Pro at five, and more can be added later.
Does Jatzo check the bank details on an invoice?
The Check button looks for warning signs in the email, such as a request to pay a new account, but does not know which bank details are right for each supplier. Invoice Fraud Checker, a separate Windows program, compares each invoice with the details you confirmed.
Does it replace ringing the supplier?
No. Ring the supplier on a number you have used before, as the National Crime Agency advises. Jatzo helps whoever reads the email notice that it needs that call, before the stage payment goes.
Will our IT company need to do anything?
A little, once. Whoever looks after your email proves your domain with one DNS record. For Microsoft 365 they then upload one file in the admin centre, which needs the Exchange Administrator or Global Administrator role, and Microsoft takes 24 to 72 hours to add the button. For Google Workspace they install Jatzo for the domain. Staff do nothing.
Check the next email that makes you pause.
For other businesses: Law firms; accountants; estate and letting agents; manufacturers, wholesalers and distributors; recruitment agencies; marketing and digital agencies; healthcare practices; insurance brokers and charities.