Progress billing means the contractor invoices for the share of work completed each period, usually monthly, measured against an approved schedule of values, with retainage held back until the job is finished.
Review invoices, committed costs, and cash timing together before making project decisions. AI-generated illustration.
Progress billing is how most construction contracts get paid: instead of one invoice at the end, the contractor bills each period (almost always monthly) for the work completed since the last bill. The amount is measured against a schedule of values, reviewed by the owner or architect, reduced by retainage, and paid within a deadline set by the contract or a prompt payment law. The money then flows down to subs and suppliers, who bill the same way one tier below.
It exists because contractors cannot finance a $2 million building for a year and wait. Owners accept it because they only pay for work they can see, and they keep retainage as security.
The monthly progress billing cycle, step by step
Before the first bill: get the schedule of values approved. Every later billing is measured against it. See how to build a schedule of values.
Collect sub pay apps by the cutoff. A general contractor typically sets a date for subs to submit their own pay apps so they can be rolled into the owner billing.
Walk the job and agree on percent complete. The PM and superintendent check each line against the field. On many jobs the owner's rep or architect walks it too, often with a "pencil draft" before the formal submission.
Prepare the pay application. On AIA jobs that is the G702 and G703. Bill work in place plus approved stored materials, add approved change orders, and apply retainage.
Attach the backup. Lien waivers, updated schedule, certified payroll on public work, stored material invoices, and anything else the contract lists.
Owner or architect review and certification. On AIA contracts the architect certifies the amount due and may certify less than requested with an explanation.
Payment, then payment down the chain. Once paid, the GC pays subs under the subcontract terms and any statute.
Ways to measure progress
Common progress billing methods
Method
How the amount is set
Where it is common
Percent complete
Each SOV line billed at its percent complete times scheduled value
Commercial lump sum work, AIA contracts
Milestone
Fixed amounts when defined stages are reached
Residential, design-build, lender draw schedules
Unit price
Measured quantities times the bid unit price
Civil, paving, utilities, DOT work
Cost plus or T&M
Actual costs incurred plus fee or markup, with backup
Service work, fast-track, owner-managed jobs
Residential remodelers often use milestone billing because homeowners understand "cabinets set" better than "62 percent on line 14." See how to set residential payment schedules for that version.
What the law says about progress payments
On federal fixed-price construction, FAR 52.232-5 has the government make progress payments monthly as the work proceeds, based on estimates of work completed and approved by the contracting officer. Each request must include an itemized breakdown by work element, the amount for each sub's work, and a signed certification that subs and suppliers have been paid from prior payments. FAR 52.232-27 then makes progress payments due 14 days after the designated billing office receives a proper payment request, with interest on late payment.
States have their own prompt payment rules, and they differ for public and private work. California's Civil Code section 8800, for example, requires a private owner to pay an undisputed progress payment within 30 days after a demand made under the contract unless the parties agreed otherwise in writing, with a penalty of 2 percent per month on amounts wrongfully withheld. Check your state on the prompt payment and retainage laws by state pages.
Worked example: three months on a $480,000 job
As an illustration, take a $480,000 tenant improvement with 10 percent retainage and no change orders yet.
Example progress billing over three months
Month
Work completed this period
Total completed to date
Retainage held to date
Payment due this month
1
$60,000
$60,000
$6,000
$54,000
2
$110,000
$170,000
$17,000
$99,000
3
$95,000
$265,000
$26,500
$85,500
After three months the contractor has earned $265,000, received or is due $238,500, and has $26,500 in retainage waiting for closeout. The payment due each month is total earned to date less retainage, minus everything certified before. Calculating it cumulatively, rather than month by month, means a correction in month two automatically carries into month three.
How progress billing works for subcontractors
Subs bill the general contractor the same way, one step earlier. The GC's cutoff is the sub's real deadline, and the sub's percent complete has to fit inside what the GC is billing the owner for that trade line. If the GC bills the owner 40 percent on drywall and the drywall sub bills 55 percent, one of them is getting cut.
Payment timing for subs depends on the subcontract and the law. On federal construction, 31 U.S.C. 3905 and FAR 52.232-27 require the prime to pay subs for satisfactory performance within 7 days after receiving payment from the government, to give written notice of any amount withheld with the reason, and to flow the same clause down to lower tiers. Private subcontracts often tie payment to the GC being paid, which is a different question. See pay-if-paid vs pay-when-paid clauses explained.
Overbilling and underbilling
Progress billing is an estimate, so it rarely matches cost exactly. Bill ahead of the work and you are overbilling: the cash is nice, but you owe the work and your WIP schedule shows a liability. Bill behind and you are underbilling, financing the owner's job with your own money. Bonding companies read both closely. Compare billed to earned on every job every month. See overbilling and underbilling explained with examples.
Mistakes to avoid
Missing the cutoff. On most jobs, a pay app that misses the owner's date waits a full month.
Billing unsigned change orders. It gets the whole application returned.
Percent complete that the field does not support. It erodes trust and invites line-by-line review every month after.
Forgetting backup. Lien waivers and certified payroll are the most common reasons a correct pay app still sits.
Not billing stored material. If the contract allows it and you have the documents, a switchgear delivery in month four is cash in month four.
Usually monthly, on a cutoff date set by the contract. Some residential and small commercial jobs bill at milestones instead, and federal fixed-price jobs pay monthly or more often if the contracting officer allows.
Is progress billing the same as a progress payment?+
They are two sides of one transaction. The contractor sends a progress billing (pay application), and the owner makes a progress payment once it is approved.
What happens if the owner disputes part of a pay app?+
The owner or architect typically certifies the undisputed amount and explains the rest. Some state laws limit how much can be withheld for a dispute. California, for example, caps it at 150 percent of the disputed amount on private work.
Can I bill for materials not yet installed?+
Often yes, as stored materials, if the contract allows it and you provide the required documentation. On federal work, off-site materials count only if the contract specifically authorizes them and the contractor shows title.
A Texas steel erector lost $870,000 in two electronic payments after a dual email and telephone fraud attack. Cyber insurance covered only $250,000. BEC losses hit $2.77 billion in 2024 with construction as the #1 target. This episode breaks down the attack and 6 prevention steps.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
You know, usually when we think about a massive financial heist, there is this expectation of physical force. Right, like a movie. Exactly, like you imagine the ski masks and, you know, a screeching getaway car. The adrenaline. Yeah, the adrenaline of someone just vaulting over a bank counter and demanding the cash. It's dramatic. It's loud. And... crucially, it's immediately obvious to everyone in the room that a crime is taking place, right? The alarms are ringing. But then you step into the world of modern commercial construction and accounts payable, and suddenly that... That screeching getaway car is just, it's a quiet office. Yeah. A cup of coffee, a mouse click. We're looking at a landscape of financial theft that is just terrifyingly silent.
It is the absolute definition of an invisible disaster. I mean, by the time you realize the vault is empty, the thieves are already a ghost in the machine. Wow. And the money is sitting in an offshore account somewhere. Well, welcome to this deep dive aimed directly at all you scaling legends out there. You know, the construction business owners, the general contractors, project managers, and really just the insanely curious. learners who are looking to protect their livelihoods. Definitely. Today, we are pulling from a fascinating stack of sources. We have a recent, really comprehensive piece of DataSmart Business Automator's Market Intelligence Report, alongside some highly revealing federal court documents. That's a lot to get through. It is. But our mission is to unpack the terrifying mechanics of business email compromise,
or BEC, and payment fraud. We're going to examine a specific devastating case study of an $870 ,000 loss in Texas. Just a massive hit. Yeah. We'll break down why your traditional safety nets are completely failing and exactly how to armor your business against this today. It's a critical conversation for anyone moving capital right now. I mean, the rules of engagement have completely shifted. They really have. The very trust that built the construction industry. is now the exact weapon being used to dismantle it. OK, let's unpack this because I want to start with the inciting incident. You know, the nightmare scenario. Walk us through. So it's December 19th, 2023. We are looking at a Texas steel erector named Perry and Perry, a real company doing real
work, building real infrastructure. Right. And on this random Tuesday in December, their office manager sits down and sends two electronic payments in a matter of minutes total. $870 ,000. Wow. And they fully believed, like completely believed they were paying their fabricator, a company called Alamo Structural Steel. But they weren't. No, they weren't. They were paying a criminal. The money just vanished. What's fascinating here is, and, you know, I use fascinating in the darkest possible sense of the word. This was not a typo. Right. It wasn't a glitch in their accounting software or anything like that. It was a highly calculated, surgically precise interception. This type of crime preys entirely on the routine day -to -day operations of the business. And
we have to talk about the mechanics of how this actually happened, because this is where, honestly, my stomach just dropped reading the background on this case. Because the office manager at Perry & Perry didn't just blindly wire almost a million dollars because of a random suspicious email. They actually tried to do the right thing. They followed their instincts. Yeah. They received an email from someone claiming to be the CFO of Alamo Structural Steel, requesting a change in their banking routing details for this massive payment. And the office manager saw that, paused, and decided to verify it over the phone. Which, you know, is the standard operating procedure we've all been taught for decades. If you see a change, you call to verify. But they made one critical error, just one tiny misstep that cost
the business $870 ,000. They called the phone number located inside the scam email. I mean, that is like asking the FOTS to verify if he is the officially assigned security guard for the hen hats. You are literally calling the criminal to ask if the criminal is legitimate. You're hitting on the absolute core vulnerability of human habit here. When they made that call, the scammer on the other end Calmed and confidently posed as the CFO of Alamo Structural Steel. Just played the part perfectly. Exactly. They confirmed the banking changes. They sounded professional. And here's the kicker. They knew the exact context of the payment, the project name, the invoice numbers. Which is terrifying. It is. And that
level of context is what we really need to dissect. Because these criminals are not just sending out thousands of blind, generic emails, hoping a random contractor bites. they're already inside the house. Wait, I want to clarify the mechanics of that, because how are they inside the house without the company's IT department noticing a massive breach? Like, do they just guess a password and start firing off messages? No, no, it's much more insidious than that. If we look at Smart Business Automator's market intelligence report, we see that 50 % of these BEC incidents compromise more than one mailbox. Half of them. Right. The attackers don't just hack an account and immediately send a fake invoice. They lurk. Lurk. So they're just, what? They're just watching. Yeah, think of it like a burglar breaking into your house, but instead of stealing your TV, they quietly climb into your attic and just live
there for two months. Oh, man. They don't make a sound. Every day, they read your mail before you even get home. They learn your schedule. They learn who your friends are. They learn how you speak. That is so creepy. In a digital sense, these criminals... compromise an email account, maybe through like a clever phishing link an employee clicked weeks ago, and then they set up hidden email forwarding rules. Oh, so the actual user has no idea. If I'm the CFO, I'm just typing away, totally unaware that every single email containing the word invoice or wire transfer is being silently blind copied to a server in Eastern Europe. Precisely. They sit silently in the system, absorbing everything. They learn the tone of voice your vendors use. They learn the exact billing cycles, the project milestones, and specific names of the foreman
on the job site. So they have the whole playbook. Exactly. They wait for the perfect moment of vulnerability, usually right when a large, legitimate payment is due. And they seamlessly insert themselves into the email chain. So when that office manager called the number in the email, the person answering didn't have to guess. They already had the entire script. Here's where it gets really interesting and honestly a bit overhauling. Because my first instinct is to say, OK, well, if the emails are perfectly written without those obvious typos and they know our billing cycles and the phone calls sound exactly like the real person, are we just completely outmatched by robots? It's a fair question. Like how is a busy accounts payable clerk supposed to spot this? It is a highly valid question because we are looking at a massive technology driven escalation. The
deception in the Perry & Perry case is just the tip of the spear. We are in the middle of a full -blown AI epidemic. Since artificial intelligence tools went mainstream, there has been a 1 ,760 % increase in business email compromise attacks. 1 ,760%. I mean, that's not a shred. That's a tidal wave. And the composition of that wave is shifting rapidly. Right now, 40 % of all BEC emails are entirely AI -generated. Wow. You remember how phishing emails used to be somewhat easy to spot? Bad grammar, weird spelling, awkward formatting. Yeah, the classic, dear sir or madam, kindly send funds emails. The ones that felt like they were run through a bad translation app three times. Right, well, AI wiped that defense out overnight. Large language models can now
ingest months of a compromised inbox's history and generate flawless, context -aware corporate emails in seconds. Unbelievable. They perfectly mimic the specific cadence, the industry jargon, even the specific sign -off the real CFO uses. But, and this is the scary part, the escalation goes far beyond text. AI voice cloning means that phone verification is no longer a reliable single line of defense. I really want to dig into that because it sounds like science fiction. Explain how that works practically. Like how easy is it for a criminal to clone the voice of a trusted vendor? It takes seconds, literally seconds. If a criminal has a three second audio clip of your fabricator's voice. maybe from a company voicemail greeting, a webinar they hosted, or just a quick video they posted on LinkedIn
from a job site, they can feed that into an AI audio synthesizer. From just three seconds. That's all it takes. The software isolates the timbre, the pitch, the unique vocal patterns. So when your office manager calls to verify a payment routing change, the criminal types responses into a keyboard, and the software speaks those words in real time. It sounds absolutely identical to the trusted vendor. That is deeply unsettling. You're talking to a machine, essentially, that sounds exactly like your friend Bob, who you have done business with for 10 years, who you play golf with. And Bob is telling you to send the money to a new routing number. And you do it because it's Bob. Now, if we connect this to the bigger picture, we have to ask, why is the construction industry bearing the absolute brunt of this technological assault? Smart Business
Automator's Market Intelligence Report reveals the sheer scale of the epidemic. There were 2 .5 $7 billion lost across 21 ,442 incidents in 2024. 2 .7 billion. Yes. This represents 73 % of all cyber incidents. And the financial stakes are only accelerating. The average wire transfer stolen jumped to $24 ,586 in January 2025 alone. That is a 46 % increase from just the prior month. So why construction? I mean, obviously the dollar amounts are high and you're paying for tons of steel, concrete, massive labor forces. Is it just the size of the price? The capital volume is a huge magnet, yes. But it's really about the operational culture and the complexity of
the supply chain. Okay. Construction offices are incredibly busy, chaotic, fast -paced environments. You have multiple tiers of subcontractors constantly shifting project timelines, weather delays, and really high pressure deadlines. Right. If a supplier calls and says, we need this payment routed to our new materials account today or we can't ship the structural steel, the instinct of any good project manager is to push it through to keep the project on schedule. You don't want to be the reason the whole site shuts down. Add to that the fact that construction is fundamentally a relationship -driven industry. It runs on handshakes, familiar voices, and trust. Criminals understand the psychology of that. They weaponize the chaos and they weaponize the trust. They know that in a busy trailer on a Tuesday morning, speed
usually overrides security. But this is where my brain goes to the safety net. If the technology is stacked against us and the criminals have AI perfectly cloning voices and they're lurking in our inboxes reading our mail, sure. Surely this is exactly what insurance is for. You'd think. I mean, you buy a massive cyber insurance policy, assuming it covers cyber theft. It is literally in the name. You would think so. But this brings us to perhaps the most dangerous illusion in the entire commercial business landscape today. Let's go back to our Texas case study and look at the legal mechanics of what happened next. Perry and Perry realized they lost $870 ,000. They did what any rational business would do. They filed a claim with their cyber insurance provider, Cowbell Cyber Inc. Let me guess, the
insurance adjuster showed up, opened a massive binder, and found a loophole. It wasn't even a loophole. It was a completely standard, plainly written clause in the contract. Cowbell paid out $250 ,000 and flatly denied the remaining loss. Oh, wow. Perry and Perry was outraged. So they took him to court. They sued. And on March 9th, 2026, Judge Scheidlauer ruled in the Waco federal court. What was the legal argument? Like, why did the judge rule against the contractor who was clearly the victim of a massive cybercrime? The judge ruled entirely in favor of the insurance company because of a fundamental legal distinction between a hack. and social engineering. Okay, what's the difference? The court looked at the facts. Did a hacker forcefully breach Perry and Perry's bank account and steal the funds? No.
An authorized employee of Perry and Perry voluntarily logged into the banking portal, typed in the amount, and clicked send. Wow. They were tricked, yes, but they voluntarily parted with the funds. Ah. So because the office manager physically authorized the wire, the liability shifts away from a direct network breach. Exactly. In the insurance world, that is classified under social engineering fraud, not general cyber liability. And because of that classification, it fell under a specific sublimin in the policy. The contract clearly capped all social engineering losses at $250 ,000 for the entire policy period. This is so crucial. Think about the general liability policy sitting in your office right now. For everyone listening, you might think you have
a $5 million umbrella policy, but buried on page 47 of the fine print, the specific bucket of money dedicated to getting tricked into wiring funds to a criminal is capped at a tiny, tiny fraction of that total amount. It's like having a million dollar health insurance policy. But if you actually read the scale, schedule of benefits the absolute maximum they will pay for an emergency ambulance ride is 50 bucks right if you need that ambulance to save your life you are paying the difference out of pocket foreign In this case, the net loss for Perry & Perry wasn't just the remaining $620 ,000. It was $620 ,000 out of pocket, plus the exorbitant legal costs of fighting a multi -year federal lawsuit that they ultimately lost. That is a company -ending event for a huge percentage of midsize contractors.
That's payroll. That's operating capital. wiped out. It absolutely is. And this is the harsh reality. The average social engineering sublimit across the entire commercial insurance industry right now is exactly $250 ,000. If you are a general contractor processing over $1 million monthly in vendor payments, and you have never personally read the sublimits in your policy, you are walking a tightrope without a net completely blindfolded. So what does this all mean? We can't trust our emails because they are being monitored by lurkers. We can't trust the voices on the phone because of AI cloning. And we definitively cannot assume our insurance policy is going to ride in like the cavalry to save us when the worst happens. No, we can't. We need a hard hat for our accounts payable department. What do
we actually do today to build a defense? We have to completely shift our operational mindset. Since the technology can be perfectly faked. and the insurance safety nets are highly conditional, internal process is your only armor. Process, okay. A rigorous defense -in -depth strategy must replace blind trust. It's about layering your internal workflows, your banking tools, and your administrative training. We have six vital steps here. Okay, let's start with the internal workflows. Because I was looking through the source material, specifically the recommended protocols, and the concept of the two -person rule stood out to me. It sounds like the protocol on a nuclear submarine where two different officers have to turn their keys at the exact same time to launch. That's a perfect analogy. That's step two on our list. The two -person rule mandates that for any payment over a certain threshold,
say $10 ,000, one person initiates the payment in the accounting system and a completely different person verifies it via a separate communication channel. Okay. You physically break the chain so no single point of failure can authorize a massive wire. And crucially, and this is step one. If you are verifying a vendor banking change, you never use the contact info provided in the request. Right. Going back to the fox in the hen house, you don't call the number in the email. You pull up the original master subcontract agreement from your own filing cabinet, and you call the phone number listed on that original legal document. You verify with the source data you established before the project even began. Exactly. Now, alongside that two -person rule, step four is that you must implement a mandatory 48 -hour cooling period for any vendor banking change.
Now, I have to put... back on this one. Because I am putting myself in the shoes of a GC right now. Construction runs on razor -thin timelines. If my concrete supplier says, wire the funds to this new account right now or the trucks don't roll, I don't have 48 hours. I might not even have 48 minutes. I hear that all the time. Right. The project schedule dictates everything. If I halt a pour for two days, I am bleeding thousands of dollars in delays. Doesn't a 48 -hour hold completely sabotage the operation? That exact panic you were describing, that adrenaline. That is the primary weapon the criminal is using against you. Scammers will always manufacture a false sense of extreme urgency to bypass your logic. By instituting a rigid corporate policy, you take the pressure off the individual employee.
The AP clerk doesn't have to argue. They simply state, as a matter of strict corporate protocol, our system requires a 48 -hour authentication hold to process any routing number changes. We cannot override it. Ah, so it gives you an institutional shield, it breaks the attacker's momentum, and it gives your team the necessary time to breathe, verify the original documents, and realize they are being played. It completely neutralizes the emotional manipulation. Now, moving to step three, beyond internal workflows, we have to look at external banking tools. I was reading about this in the sources as well, specifically a tool called Positive Pay. If I understand this correctly, it essentially acts like a VIP bouncer for your corporate bank account. You send your bank a daily, highly specific guest list of the checks
and electronic payments you have actually approved, including the exact dollar amounts and the exact account numbers they're supposed to go to. Am I getting that right? You're spot on. If anyone tries to cash a check or pull a wire that does not match your VIP list down to the penny, the bank's automated system flags it. and refuses the transaction until you manually log in and review it. That's brilliant. So even if a criminal somehow gets an invoice pushed through the initial layers, the bank's automated bouncer stops it at the door. It is an incredibly powerful final layer of defense. But all of these workflows and tools require administrative vigilance, which brings us to step five. You have to conduct quarterly staff training specifically on BEC tactics. Right. And I don't mean a boring once a year compliance
slideshow that everyone sleeps through. Show them the Perry and Perry case. Play them an example of AI voice cloning. Your account's payable team needs to be treated like the frontline security personnel they actually are. Because they literally hold the keys to the vault. And as we established, step six, you also need to pull your cyber insurance policy today and review those sublimits. Do not wait for your annual renewal period. Go into your policy right now. Find the specific line item for social engineering fraud and look at the sublimit. If it's only $250 ,000 and you're moving millions, call your broker immediately to negotiate higher caps or purchase a sublimit. You know, all of these processes make complete sense, but fighting AI with manual phone calls and 48 -hour holds feels a bit exhausting. Like
bringing a clipboard to a drone fight. Can technology actually help us enforce these processes without grinding the business to a halt? Absolutely. You cannot fight automated attacks purely with manual labor. Human beings get tired, we get rushed, we make mistakes. This is where Smart Business Automator's Market Intelligence Report highlights that modern platforms designed specifically for the construction industry are stepping in to protect companies. Okay, how so? These systems automatically flag banking change requests and enforce the manual verification protocols. So the software itself acts as that mandatory pause button. It won't let you process the payment until the two -person verification is logged. Exactly. The software pushes real -time alerts on the newest BEC tactics, and it organizes your
vendor data securely so that your teams can scale their operations without drowning in administrative chaos. Which is huge. Because that chaos, you know, the messy paperwork on a desk, the rushed emails in the job site trailer, the disorganized vendor files, that fog of war is exactly where these criminals hide and where these catastrophic mistakes happen. Structure and process defeat chaos and deception. This has been incredibly eye -opening. To recap everything we've covered today, we are looking at a fundamental shift in the reality of the construction industry. We are no longer just building physical structures. We are defending digital fortresses. Very true. The days where you could rely purely on a familiar voice on the phone or assume your basic insurance policy would act as a safety net for cyber theft, those days are completely over. They are entirely
behind us. The threat is sophisticated, it is incredibly patient, and it is targeting your specific workflows. So, to everyone listening... Here is your direct call to action. Do not let this just be an interesting deep dive you passively listen to on your commute to the site. Take action today. Pull out that insurance binder and check your sublimits. Implement that two -person rule for your outgoing wires. And please, share this deep dive with your office manager, your AP team, your CFO. Let's protect the hard capital you work so tirelessly to build every day. Please subscribe, rate, review, share this with your colleagues, and visit smartbusinessautomator .com to get equipped. And, you know, this raises an important question, something we all really need to sit with. We've talked about how insurance
companies are fiercely denying these claims, arguing that employees voluntarily parted with the funds. If AI can perfectly spoof an executive's voice in email and the corporate insurance policy refuses to cover the multimillion dollar loss, how long until the courts start piercing the corporate veil? How long until they start holding the individual employees, the accounts payable clerks, the project managers who clicked send personally? financially liable for that missing money?
