Holdback is money withheld from a construction payment until a condition is met, usually completion of the work. In the U.S. it often means the same thing as retainage; in Canada it is a statutory requirement.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
Holdback is any amount an owner, lender, or general contractor keeps back from a payment that is otherwise due, as security that the work gets finished or that a problem gets fixed. In most U.S. contracts the word is used interchangeably with retainage or retention. But holdback also shows up in two other places contractors run into: lender holdbacks on construction loans, and the mandatory holdback built into Canadian provincial lien laws.
Three kinds of holdback
Type
Who holds it
What releases it
Contract holdback (retainage)
Owner from the GC, GC from subs
Substantial or final completion, closeout documents, lien waivers
Specific-item holdback
Owner or GC
Correction of a listed defect or delivery of a missing document
Lender holdback
Construction lender
Inspection showing the work is done, or a later loan milestone
The specific-item kind is the one that causes the most arguments. An owner pays the pay app but holds $8,000 "for the storefront punch items." Nothing in the contract set that number. Some contracts allow a holdback tied to the value of incomplete or defective work, often with a multiplier, and some do not. If yours is silent, the holdback is a negotiation, not a right.
How a holdback plays out on a job
Say a concrete sub bills $64,000 on a parking structure. The subcontract carries 10 percent retainage, so the GC holds $6,400. The owner's inspector also flags a cracked ramp section, and the GC holds another $5,000 against that repair. The sub gets paid $52,600. Once the repair is done and accepted, the $5,000 should be released on the next pay cycle, while the $6,400 rides until the project closes out.
Track the two separately. Lumped together, they look like one big short pay, and the sub ends up arguing about money that was never in dispute. A clean pay application shows retainage on its own line and lists any item holdbacks with the reason.
Holdback in Canada
Canadian provinces use "holdback" as a legal term. In Ontario, the Construction Act requires each payer up the chain to retain 10 percent of payments to the party below it, and that money is available to lien claimants. Liens there must generally be preserved within 60 days of the earlier of the last day work was done and certain completion events, according to a 2024 Siskinds LLP overview of the Act. U.S. contractors bidding Canadian work should read the provincial statute; it is not optional the way U.S. contract retainage is.
Common mistakes
Accepting an item holdback with no dollar figure or deadline attached.
Not billing the release. Held money rarely comes back without its own invoice.
Letting a holdback dispute push you past a mechanics lien deadline.
Holding more from subs than the owner holds from you, which strains the sub's cash flow for no reason.
In most U.S. contracts, yes. Holdback, retainage, and retention all describe money withheld from progress payments until completion. Holdback can also mean a narrower amount held against a specific defect, or a lender's withheld loan funds.
Can an owner hold back money for punch list items?+
Only if the contract allows it, and usually only in an amount tied to the value of the incomplete or defective work. Check the payment and completion sections of your contract.
What is a lender holdback?+
It is loan money a construction lender keeps back until an inspector confirms work is complete or a milestone is reached. It affects when the owner has money to pay the contractor.
How much is the holdback in Ontario?+
Ontario's Construction Act requires 10 percent of the value of services or materials supplied to be held at each tier. Confirm current rules and release timing in the statute before relying on them.
A Texas steel erector lost $870,000 in two electronic payments after a dual email and telephone fraud attack. Cyber insurance covered only $250,000. BEC losses hit $2.77 billion in 2024 with construction as the #1 target. This episode breaks down the attack and 6 prevention steps.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
You know, usually when we think about a massive financial heist, there is this expectation of physical force. Right, like a movie. Exactly, like you imagine the ski masks and, you know, a screeching getaway car. The adrenaline. Yeah, the adrenaline of someone just vaulting over a bank counter and demanding the cash. It's dramatic. It's loud. And... crucially, it's immediately obvious to everyone in the room that a crime is taking place, right? The alarms are ringing. But then you step into the world of modern commercial construction and accounts payable, and suddenly that... That screeching getaway car is just, it's a quiet office. Yeah. A cup of coffee, a mouse click. We're looking at a landscape of financial theft that is just terrifyingly silent.
It is the absolute definition of an invisible disaster. I mean, by the time you realize the vault is empty, the thieves are already a ghost in the machine. Wow. And the money is sitting in an offshore account somewhere. Well, welcome to this deep dive aimed directly at all you scaling legends out there. You know, the construction business owners, the general contractors, project managers, and really just the insanely curious. learners who are looking to protect their livelihoods. Definitely. Today, we are pulling from a fascinating stack of sources. We have a recent, really comprehensive piece of DataSmart Business Automator's Market Intelligence Report, alongside some highly revealing federal court documents. That's a lot to get through. It is. But our mission is to unpack the terrifying mechanics of business email compromise,
or BEC, and payment fraud. We're going to examine a specific devastating case study of an $870 ,000 loss in Texas. Just a massive hit. Yeah. We'll break down why your traditional safety nets are completely failing and exactly how to armor your business against this today. It's a critical conversation for anyone moving capital right now. I mean, the rules of engagement have completely shifted. They really have. The very trust that built the construction industry. is now the exact weapon being used to dismantle it. OK, let's unpack this because I want to start with the inciting incident. You know, the nightmare scenario. Walk us through. So it's December 19th, 2023. We are looking at a Texas steel erector named Perry and Perry, a real company doing real
work, building real infrastructure. Right. And on this random Tuesday in December, their office manager sits down and sends two electronic payments in a matter of minutes total. $870 ,000. Wow. And they fully believed, like completely believed they were paying their fabricator, a company called Alamo Structural Steel. But they weren't. No, they weren't. They were paying a criminal. The money just vanished. What's fascinating here is, and, you know, I use fascinating in the darkest possible sense of the word. This was not a typo. Right. It wasn't a glitch in their accounting software or anything like that. It was a highly calculated, surgically precise interception. This type of crime preys entirely on the routine day -to -day operations of the business. And
we have to talk about the mechanics of how this actually happened, because this is where, honestly, my stomach just dropped reading the background on this case. Because the office manager at Perry & Perry didn't just blindly wire almost a million dollars because of a random suspicious email. They actually tried to do the right thing. They followed their instincts. Yeah. They received an email from someone claiming to be the CFO of Alamo Structural Steel, requesting a change in their banking routing details for this massive payment. And the office manager saw that, paused, and decided to verify it over the phone. Which, you know, is the standard operating procedure we've all been taught for decades. If you see a change, you call to verify. But they made one critical error, just one tiny misstep that cost
the business $870 ,000. They called the phone number located inside the scam email. I mean, that is like asking the FOTS to verify if he is the officially assigned security guard for the hen hats. You are literally calling the criminal to ask if the criminal is legitimate. You're hitting on the absolute core vulnerability of human habit here. When they made that call, the scammer on the other end Calmed and confidently posed as the CFO of Alamo Structural Steel. Just played the part perfectly. Exactly. They confirmed the banking changes. They sounded professional. And here's the kicker. They knew the exact context of the payment, the project name, the invoice numbers. Which is terrifying. It is. And that
level of context is what we really need to dissect. Because these criminals are not just sending out thousands of blind, generic emails, hoping a random contractor bites. they're already inside the house. Wait, I want to clarify the mechanics of that, because how are they inside the house without the company's IT department noticing a massive breach? Like, do they just guess a password and start firing off messages? No, no, it's much more insidious than that. If we look at Smart Business Automator's market intelligence report, we see that 50 % of these BEC incidents compromise more than one mailbox. Half of them. Right. The attackers don't just hack an account and immediately send a fake invoice. They lurk. Lurk. So they're just, what? They're just watching. Yeah, think of it like a burglar breaking into your house, but instead of stealing your TV, they quietly climb into your attic and just live
there for two months. Oh, man. They don't make a sound. Every day, they read your mail before you even get home. They learn your schedule. They learn who your friends are. They learn how you speak. That is so creepy. In a digital sense, these criminals... compromise an email account, maybe through like a clever phishing link an employee clicked weeks ago, and then they set up hidden email forwarding rules. Oh, so the actual user has no idea. If I'm the CFO, I'm just typing away, totally unaware that every single email containing the word invoice or wire transfer is being silently blind copied to a server in Eastern Europe. Precisely. They sit silently in the system, absorbing everything. They learn the tone of voice your vendors use. They learn the exact billing cycles, the project milestones, and specific names of the foreman
on the job site. So they have the whole playbook. Exactly. They wait for the perfect moment of vulnerability, usually right when a large, legitimate payment is due. And they seamlessly insert themselves into the email chain. So when that office manager called the number in the email, the person answering didn't have to guess. They already had the entire script. Here's where it gets really interesting and honestly a bit overhauling. Because my first instinct is to say, OK, well, if the emails are perfectly written without those obvious typos and they know our billing cycles and the phone calls sound exactly like the real person, are we just completely outmatched by robots? It's a fair question. Like how is a busy accounts payable clerk supposed to spot this? It is a highly valid question because we are looking at a massive technology driven escalation. The
deception in the Perry & Perry case is just the tip of the spear. We are in the middle of a full -blown AI epidemic. Since artificial intelligence tools went mainstream, there has been a 1 ,760 % increase in business email compromise attacks. 1 ,760%. I mean, that's not a shred. That's a tidal wave. And the composition of that wave is shifting rapidly. Right now, 40 % of all BEC emails are entirely AI -generated. Wow. You remember how phishing emails used to be somewhat easy to spot? Bad grammar, weird spelling, awkward formatting. Yeah, the classic, dear sir or madam, kindly send funds emails. The ones that felt like they were run through a bad translation app three times. Right, well, AI wiped that defense out overnight. Large language models can now
ingest months of a compromised inbox's history and generate flawless, context -aware corporate emails in seconds. Unbelievable. They perfectly mimic the specific cadence, the industry jargon, even the specific sign -off the real CFO uses. But, and this is the scary part, the escalation goes far beyond text. AI voice cloning means that phone verification is no longer a reliable single line of defense. I really want to dig into that because it sounds like science fiction. Explain how that works practically. Like how easy is it for a criminal to clone the voice of a trusted vendor? It takes seconds, literally seconds. If a criminal has a three second audio clip of your fabricator's voice. maybe from a company voicemail greeting, a webinar they hosted, or just a quick video they posted on LinkedIn
from a job site, they can feed that into an AI audio synthesizer. From just three seconds. That's all it takes. The software isolates the timbre, the pitch, the unique vocal patterns. So when your office manager calls to verify a payment routing change, the criminal types responses into a keyboard, and the software speaks those words in real time. It sounds absolutely identical to the trusted vendor. That is deeply unsettling. You're talking to a machine, essentially, that sounds exactly like your friend Bob, who you have done business with for 10 years, who you play golf with. And Bob is telling you to send the money to a new routing number. And you do it because it's Bob. Now, if we connect this to the bigger picture, we have to ask, why is the construction industry bearing the absolute brunt of this technological assault? Smart Business
Automator's Market Intelligence Report reveals the sheer scale of the epidemic. There were 2 .5 $7 billion lost across 21 ,442 incidents in 2024. 2 .7 billion. Yes. This represents 73 % of all cyber incidents. And the financial stakes are only accelerating. The average wire transfer stolen jumped to $24 ,586 in January 2025 alone. That is a 46 % increase from just the prior month. So why construction? I mean, obviously the dollar amounts are high and you're paying for tons of steel, concrete, massive labor forces. Is it just the size of the price? The capital volume is a huge magnet, yes. But it's really about the operational culture and the complexity of
the supply chain. Okay. Construction offices are incredibly busy, chaotic, fast -paced environments. You have multiple tiers of subcontractors constantly shifting project timelines, weather delays, and really high pressure deadlines. Right. If a supplier calls and says, we need this payment routed to our new materials account today or we can't ship the structural steel, the instinct of any good project manager is to push it through to keep the project on schedule. You don't want to be the reason the whole site shuts down. Add to that the fact that construction is fundamentally a relationship -driven industry. It runs on handshakes, familiar voices, and trust. Criminals understand the psychology of that. They weaponize the chaos and they weaponize the trust. They know that in a busy trailer on a Tuesday morning, speed
usually overrides security. But this is where my brain goes to the safety net. If the technology is stacked against us and the criminals have AI perfectly cloning voices and they're lurking in our inboxes reading our mail, sure. Surely this is exactly what insurance is for. You'd think. I mean, you buy a massive cyber insurance policy, assuming it covers cyber theft. It is literally in the name. You would think so. But this brings us to perhaps the most dangerous illusion in the entire commercial business landscape today. Let's go back to our Texas case study and look at the legal mechanics of what happened next. Perry and Perry realized they lost $870 ,000. They did what any rational business would do. They filed a claim with their cyber insurance provider, Cowbell Cyber Inc. Let me guess, the
insurance adjuster showed up, opened a massive binder, and found a loophole. It wasn't even a loophole. It was a completely standard, plainly written clause in the contract. Cowbell paid out $250 ,000 and flatly denied the remaining loss. Oh, wow. Perry and Perry was outraged. So they took him to court. They sued. And on March 9th, 2026, Judge Scheidlauer ruled in the Waco federal court. What was the legal argument? Like, why did the judge rule against the contractor who was clearly the victim of a massive cybercrime? The judge ruled entirely in favor of the insurance company because of a fundamental legal distinction between a hack. and social engineering. Okay, what's the difference? The court looked at the facts. Did a hacker forcefully breach Perry and Perry's bank account and steal the funds? No.
An authorized employee of Perry and Perry voluntarily logged into the banking portal, typed in the amount, and clicked send. Wow. They were tricked, yes, but they voluntarily parted with the funds. Ah. So because the office manager physically authorized the wire, the liability shifts away from a direct network breach. Exactly. In the insurance world, that is classified under social engineering fraud, not general cyber liability. And because of that classification, it fell under a specific sublimin in the policy. The contract clearly capped all social engineering losses at $250 ,000 for the entire policy period. This is so crucial. Think about the general liability policy sitting in your office right now. For everyone listening, you might think you have
a $5 million umbrella policy, but buried on page 47 of the fine print, the specific bucket of money dedicated to getting tricked into wiring funds to a criminal is capped at a tiny, tiny fraction of that total amount. It's like having a million dollar health insurance policy. But if you actually read the scale, schedule of benefits the absolute maximum they will pay for an emergency ambulance ride is 50 bucks right if you need that ambulance to save your life you are paying the difference out of pocket foreign In this case, the net loss for Perry & Perry wasn't just the remaining $620 ,000. It was $620 ,000 out of pocket, plus the exorbitant legal costs of fighting a multi -year federal lawsuit that they ultimately lost. That is a company -ending event for a huge percentage of midsize contractors.
That's payroll. That's operating capital. wiped out. It absolutely is. And this is the harsh reality. The average social engineering sublimit across the entire commercial insurance industry right now is exactly $250 ,000. If you are a general contractor processing over $1 million monthly in vendor payments, and you have never personally read the sublimits in your policy, you are walking a tightrope without a net completely blindfolded. So what does this all mean? We can't trust our emails because they are being monitored by lurkers. We can't trust the voices on the phone because of AI cloning. And we definitively cannot assume our insurance policy is going to ride in like the cavalry to save us when the worst happens. No, we can't. We need a hard hat for our accounts payable department. What do
we actually do today to build a defense? We have to completely shift our operational mindset. Since the technology can be perfectly faked. and the insurance safety nets are highly conditional, internal process is your only armor. Process, okay. A rigorous defense -in -depth strategy must replace blind trust. It's about layering your internal workflows, your banking tools, and your administrative training. We have six vital steps here. Okay, let's start with the internal workflows. Because I was looking through the source material, specifically the recommended protocols, and the concept of the two -person rule stood out to me. It sounds like the protocol on a nuclear submarine where two different officers have to turn their keys at the exact same time to launch. That's a perfect analogy. That's step two on our list. The two -person rule mandates that for any payment over a certain threshold,
say $10 ,000, one person initiates the payment in the accounting system and a completely different person verifies it via a separate communication channel. Okay. You physically break the chain so no single point of failure can authorize a massive wire. And crucially, and this is step one. If you are verifying a vendor banking change, you never use the contact info provided in the request. Right. Going back to the fox in the hen house, you don't call the number in the email. You pull up the original master subcontract agreement from your own filing cabinet, and you call the phone number listed on that original legal document. You verify with the source data you established before the project even began. Exactly. Now, alongside that two -person rule, step four is that you must implement a mandatory 48 -hour cooling period for any vendor banking change.
Now, I have to put... back on this one. Because I am putting myself in the shoes of a GC right now. Construction runs on razor -thin timelines. If my concrete supplier says, wire the funds to this new account right now or the trucks don't roll, I don't have 48 hours. I might not even have 48 minutes. I hear that all the time. Right. The project schedule dictates everything. If I halt a pour for two days, I am bleeding thousands of dollars in delays. Doesn't a 48 -hour hold completely sabotage the operation? That exact panic you were describing, that adrenaline. That is the primary weapon the criminal is using against you. Scammers will always manufacture a false sense of extreme urgency to bypass your logic. By instituting a rigid corporate policy, you take the pressure off the individual employee.
The AP clerk doesn't have to argue. They simply state, as a matter of strict corporate protocol, our system requires a 48 -hour authentication hold to process any routing number changes. We cannot override it. Ah, so it gives you an institutional shield, it breaks the attacker's momentum, and it gives your team the necessary time to breathe, verify the original documents, and realize they are being played. It completely neutralizes the emotional manipulation. Now, moving to step three, beyond internal workflows, we have to look at external banking tools. I was reading about this in the sources as well, specifically a tool called Positive Pay. If I understand this correctly, it essentially acts like a VIP bouncer for your corporate bank account. You send your bank a daily, highly specific guest list of the checks
and electronic payments you have actually approved, including the exact dollar amounts and the exact account numbers they're supposed to go to. Am I getting that right? You're spot on. If anyone tries to cash a check or pull a wire that does not match your VIP list down to the penny, the bank's automated system flags it. and refuses the transaction until you manually log in and review it. That's brilliant. So even if a criminal somehow gets an invoice pushed through the initial layers, the bank's automated bouncer stops it at the door. It is an incredibly powerful final layer of defense. But all of these workflows and tools require administrative vigilance, which brings us to step five. You have to conduct quarterly staff training specifically on BEC tactics. Right. And I don't mean a boring once a year compliance
slideshow that everyone sleeps through. Show them the Perry and Perry case. Play them an example of AI voice cloning. Your account's payable team needs to be treated like the frontline security personnel they actually are. Because they literally hold the keys to the vault. And as we established, step six, you also need to pull your cyber insurance policy today and review those sublimits. Do not wait for your annual renewal period. Go into your policy right now. Find the specific line item for social engineering fraud and look at the sublimit. If it's only $250 ,000 and you're moving millions, call your broker immediately to negotiate higher caps or purchase a sublimit. You know, all of these processes make complete sense, but fighting AI with manual phone calls and 48 -hour holds feels a bit exhausting. Like
bringing a clipboard to a drone fight. Can technology actually help us enforce these processes without grinding the business to a halt? Absolutely. You cannot fight automated attacks purely with manual labor. Human beings get tired, we get rushed, we make mistakes. This is where Smart Business Automator's Market Intelligence Report highlights that modern platforms designed specifically for the construction industry are stepping in to protect companies. Okay, how so? These systems automatically flag banking change requests and enforce the manual verification protocols. So the software itself acts as that mandatory pause button. It won't let you process the payment until the two -person verification is logged. Exactly. The software pushes real -time alerts on the newest BEC tactics, and it organizes your
vendor data securely so that your teams can scale their operations without drowning in administrative chaos. Which is huge. Because that chaos, you know, the messy paperwork on a desk, the rushed emails in the job site trailer, the disorganized vendor files, that fog of war is exactly where these criminals hide and where these catastrophic mistakes happen. Structure and process defeat chaos and deception. This has been incredibly eye -opening. To recap everything we've covered today, we are looking at a fundamental shift in the reality of the construction industry. We are no longer just building physical structures. We are defending digital fortresses. Very true. The days where you could rely purely on a familiar voice on the phone or assume your basic insurance policy would act as a safety net for cyber theft, those days are completely over. They are entirely
behind us. The threat is sophisticated, it is incredibly patient, and it is targeting your specific workflows. So, to everyone listening... Here is your direct call to action. Do not let this just be an interesting deep dive you passively listen to on your commute to the site. Take action today. Pull out that insurance binder and check your sublimits. Implement that two -person rule for your outgoing wires. And please, share this deep dive with your office manager, your AP team, your CFO. Let's protect the hard capital you work so tirelessly to build every day. Please subscribe, rate, review, share this with your colleagues, and visit smartbusinessautomator .com to get equipped. And, you know, this raises an important question, something we all really need to sit with. We've talked about how insurance
companies are fiercely denying these claims, arguing that employees voluntarily parted with the funds. If AI can perfectly spoof an executive's voice in email and the corporate insurance policy refuses to cover the multimillion dollar loss, how long until the courts start piercing the corporate veil? How long until they start holding the individual employees, the accounts payable clerks, the project managers who clicked send personally? financially liable for that missing money?
