How do subcontractors stop slow pay from general contractors?
Remove every reason the GC has to hold your pay app, then escalate on a fixed schedule using the contract, prompt payment law, and lien or bond rights. Slow pay usually stops when it gets inconvenient.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
You stop slow pay from a general contractor in three moves: negotiate payment terms that put a clock on the GC, submit pay applications that leave no excuse to hold them, and escalate on a fixed schedule when payment is late, using prompt payment laws and your lien or bond rights as the backstop. Being nicer, or calling more often, rarely changes anything on its own. A process does.
Most slow pay is not malice. It is a GC managing its own cash with your money, a pay app stuck because one waiver is missing, or a pay-when-paid clause the owner is taking advantage of. Each cause has a different fix.
Why general contractors pay subs late
Figure out which problem you have before you pick a tool:
Paperwork holds. Missing lien waivers, a certificate of insurance that expired, certified payroll not received, or a pay app that does not match the schedule of values.
Owner holds. The owner has not paid the GC, and the subcontract ties your payment to theirs.
Disputed work. The GC is quietly holding money for a back-charge or punch item it never put in writing.
Cash management. The GC has been paid and is floating its payables. This is the one that needs real pressure.
Step 1: Fix the subcontract before you sign it
The cheapest time to stop slow pay is during negotiation. Ask for:
A fixed number of days for payment after the GC receives owner payment, and an outside date even if the owner pays late.
Pay-when-paid language instead of pay-if-paid, so owner nonpayment delays you rather than cancels your right.
Written notice of any withholding, with the amount and reason, within a set number of days.
Interest on late payments and the right to stop work after a stated notice period.
Retainage no higher than what the owner holds from the GC, with release tied to your scope where possible.
On federal jobs some of this is already required. The FAR prompt payment clause for construction requires the prime to pay subs no later than 7 days after it receives payment from the government, to give the sub written notice when it withholds (with a copy to the contracting officer), and to include an interest penalty clause for late payments. Read pay-if-paid vs pay-when-paid clauses explained before you sign anything private.
Step 2: Submit a pay app the GC cannot reject
A GC that wants to pay late looks for a reason. Do not give it one.
Bill on the GC's cutoff date every month, in its format.
Match line items to the approved schedule of values, and attach backup for stored materials and approved change orders.
Include the conditional waiver for this period and unconditional waivers for payments already received.
Keep your COI, safety documents, and any certified payroll current, so compliance is never the hold.
Get the pay app acknowledged in writing (email reply or portal timestamp). That date starts your clock.
Step 3: Escalate on a schedule, not on a mood
Decide in advance what happens on which day. A sample ladder:
Example escalation ladder for a late subcontractor pay app
Days past due
Action
Who
1 to 5
Friendly check-in to the GC's project manager, ask if anything is missing
Office manager
7 to 10
Written past-due notice citing the contract payment clause
Office manager
15
Ask the GC in writing whether the owner has paid for your work
Owner or PM
20 to 30
Formal demand citing prompt payment interest and next steps
Owner
Before lien deadline
Notice of intent to lien or bond claim notice, then file if unpaid
Owner, often with counsel
Write the ladder down so the office runs it the same way on every job.
Step 4: Use prompt payment law and interest
Most states have prompt payment laws that set deadlines for GCs to pay subs once they are paid, and many add interest when they do not. Rules vary by state and by public versus private work. Look yours up on the prompt payment laws by state hub and quote the statute in your demand letter. A letter that names the section and the interest rate gets read differently than one that just says "please pay."
Step 5: Keep lien and bond rights alive the whole time
Your leverage is only as good as your deadlines. Send preliminary notices at the start of every job, track your last furnishing date, and know your lien or bond claim window. If the ladder runs out, file the mechanics lien or make the payment bond claim before the deadline, not after.
Step 6: Slow down on slow payers
When a GC pays late every month, adjust. Options include stopping work where the contract allows it after proper notice, asking for a joint check agreement for your biggest material buys, pricing the carrying cost into the next bid, or declining their bids.
Worked example: a $380,000 electrical subcontract
Say an electrical sub bills $54,000 in April on a $380,000 subcontract. The contract says the GC pays within 10 days of receiving owner payment. On day 25 nothing has arrived.
The office manager checks the GC's portal and sees the pay app was approved but flagged for a missing conditional waiver. She uploads it the same day. On day 32, still unpaid, the owner of the electrical company emails the GC's PM asking whether the owner has paid the April draw. The PM confirms the owner paid on day 20. That changes the conversation: the GC has had the money for 12 days, past the 10-day term. A demand letter goes out that day citing the subcontract and the state prompt payment interest provision. Payment arrives on day 37.
Two things fixed it: a paperwork hole was closed fast, and the question "has the owner paid?" turned a vague delay into a specific breach.
Mistakes that keep slow pay going
Signing pay-if-paid language without reading it.
Billing late or off-format, which resets the GC's approval cycle.
Handing over unconditional waivers before the money clears.
Escalating by phone only, so there is no paper trail.
Letting lien and bond deadlines pass while waiting on promises.
Starting new work for a GC that is 60 days behind on the last job.
Smart Business Automator tracks every pay app, waiver, and payment by job and by GC, and flags invoices as they age, so the escalation ladder runs on time. See construction accounts receivable automation.
Frequently asked questions
Can a general contractor hold my payment because the owner has not paid?+
It depends on the subcontract and your state. A pay-if-paid clause may shift that risk to you, while pay-when-paid usually only delays payment for a reasonable time. Some states limit or refuse to enforce pay-if-paid clauses.
Can I stop work if the GC does not pay?+
Only if the contract or your state's law allows it, and usually only after written notice. Stopping without that right can put you in breach, so read the clause and give notice exactly as it requires.
How much interest can I charge a slow-paying GC?+
Whatever your contract states, or what your state's prompt payment law sets if it applies. On federal jobs, the prime's interest obligation to subs uses the rate set by the Treasury.
Should I sign a lien waiver before I get paid?+
Sign conditional waivers, which take effect only when payment clears. Hold unconditional waivers until the funds are in your account.
A Texas steel erector lost $870,000 in two electronic payments after a dual email and telephone fraud attack. Cyber insurance covered only $250,000. BEC losses hit $2.77 billion in 2024 with construction as the #1 target. This episode breaks down the attack and 6 prevention steps.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
You know, usually when we think about a massive financial heist, there is this expectation of physical force. Right, like a movie. Exactly, like you imagine the ski masks and, you know, a screeching getaway car. The adrenaline. Yeah, the adrenaline of someone just vaulting over a bank counter and demanding the cash. It's dramatic. It's loud. And... crucially, it's immediately obvious to everyone in the room that a crime is taking place, right? The alarms are ringing. But then you step into the world of modern commercial construction and accounts payable, and suddenly that... That screeching getaway car is just, it's a quiet office. Yeah. A cup of coffee, a mouse click. We're looking at a landscape of financial theft that is just terrifyingly silent.
It is the absolute definition of an invisible disaster. I mean, by the time you realize the vault is empty, the thieves are already a ghost in the machine. Wow. And the money is sitting in an offshore account somewhere. Well, welcome to this deep dive aimed directly at all you scaling legends out there. You know, the construction business owners, the general contractors, project managers, and really just the insanely curious. learners who are looking to protect their livelihoods. Definitely. Today, we are pulling from a fascinating stack of sources. We have a recent, really comprehensive piece of DataSmart Business Automator's Market Intelligence Report, alongside some highly revealing federal court documents. That's a lot to get through. It is. But our mission is to unpack the terrifying mechanics of business email compromise,
or BEC, and payment fraud. We're going to examine a specific devastating case study of an $870 ,000 loss in Texas. Just a massive hit. Yeah. We'll break down why your traditional safety nets are completely failing and exactly how to armor your business against this today. It's a critical conversation for anyone moving capital right now. I mean, the rules of engagement have completely shifted. They really have. The very trust that built the construction industry. is now the exact weapon being used to dismantle it. OK, let's unpack this because I want to start with the inciting incident. You know, the nightmare scenario. Walk us through. So it's December 19th, 2023. We are looking at a Texas steel erector named Perry and Perry, a real company doing real
work, building real infrastructure. Right. And on this random Tuesday in December, their office manager sits down and sends two electronic payments in a matter of minutes total. $870 ,000. Wow. And they fully believed, like completely believed they were paying their fabricator, a company called Alamo Structural Steel. But they weren't. No, they weren't. They were paying a criminal. The money just vanished. What's fascinating here is, and, you know, I use fascinating in the darkest possible sense of the word. This was not a typo. Right. It wasn't a glitch in their accounting software or anything like that. It was a highly calculated, surgically precise interception. This type of crime preys entirely on the routine day -to -day operations of the business. And
we have to talk about the mechanics of how this actually happened, because this is where, honestly, my stomach just dropped reading the background on this case. Because the office manager at Perry & Perry didn't just blindly wire almost a million dollars because of a random suspicious email. They actually tried to do the right thing. They followed their instincts. Yeah. They received an email from someone claiming to be the CFO of Alamo Structural Steel, requesting a change in their banking routing details for this massive payment. And the office manager saw that, paused, and decided to verify it over the phone. Which, you know, is the standard operating procedure we've all been taught for decades. If you see a change, you call to verify. But they made one critical error, just one tiny misstep that cost
the business $870 ,000. They called the phone number located inside the scam email. I mean, that is like asking the FOTS to verify if he is the officially assigned security guard for the hen hats. You are literally calling the criminal to ask if the criminal is legitimate. You're hitting on the absolute core vulnerability of human habit here. When they made that call, the scammer on the other end Calmed and confidently posed as the CFO of Alamo Structural Steel. Just played the part perfectly. Exactly. They confirmed the banking changes. They sounded professional. And here's the kicker. They knew the exact context of the payment, the project name, the invoice numbers. Which is terrifying. It is. And that
level of context is what we really need to dissect. Because these criminals are not just sending out thousands of blind, generic emails, hoping a random contractor bites. they're already inside the house. Wait, I want to clarify the mechanics of that, because how are they inside the house without the company's IT department noticing a massive breach? Like, do they just guess a password and start firing off messages? No, no, it's much more insidious than that. If we look at Smart Business Automator's market intelligence report, we see that 50 % of these BEC incidents compromise more than one mailbox. Half of them. Right. The attackers don't just hack an account and immediately send a fake invoice. They lurk. Lurk. So they're just, what? They're just watching. Yeah, think of it like a burglar breaking into your house, but instead of stealing your TV, they quietly climb into your attic and just live
there for two months. Oh, man. They don't make a sound. Every day, they read your mail before you even get home. They learn your schedule. They learn who your friends are. They learn how you speak. That is so creepy. In a digital sense, these criminals... compromise an email account, maybe through like a clever phishing link an employee clicked weeks ago, and then they set up hidden email forwarding rules. Oh, so the actual user has no idea. If I'm the CFO, I'm just typing away, totally unaware that every single email containing the word invoice or wire transfer is being silently blind copied to a server in Eastern Europe. Precisely. They sit silently in the system, absorbing everything. They learn the tone of voice your vendors use. They learn the exact billing cycles, the project milestones, and specific names of the foreman
on the job site. So they have the whole playbook. Exactly. They wait for the perfect moment of vulnerability, usually right when a large, legitimate payment is due. And they seamlessly insert themselves into the email chain. So when that office manager called the number in the email, the person answering didn't have to guess. They already had the entire script. Here's where it gets really interesting and honestly a bit overhauling. Because my first instinct is to say, OK, well, if the emails are perfectly written without those obvious typos and they know our billing cycles and the phone calls sound exactly like the real person, are we just completely outmatched by robots? It's a fair question. Like how is a busy accounts payable clerk supposed to spot this? It is a highly valid question because we are looking at a massive technology driven escalation. The
deception in the Perry & Perry case is just the tip of the spear. We are in the middle of a full -blown AI epidemic. Since artificial intelligence tools went mainstream, there has been a 1 ,760 % increase in business email compromise attacks. 1 ,760%. I mean, that's not a shred. That's a tidal wave. And the composition of that wave is shifting rapidly. Right now, 40 % of all BEC emails are entirely AI -generated. Wow. You remember how phishing emails used to be somewhat easy to spot? Bad grammar, weird spelling, awkward formatting. Yeah, the classic, dear sir or madam, kindly send funds emails. The ones that felt like they were run through a bad translation app three times. Right, well, AI wiped that defense out overnight. Large language models can now
ingest months of a compromised inbox's history and generate flawless, context -aware corporate emails in seconds. Unbelievable. They perfectly mimic the specific cadence, the industry jargon, even the specific sign -off the real CFO uses. But, and this is the scary part, the escalation goes far beyond text. AI voice cloning means that phone verification is no longer a reliable single line of defense. I really want to dig into that because it sounds like science fiction. Explain how that works practically. Like how easy is it for a criminal to clone the voice of a trusted vendor? It takes seconds, literally seconds. If a criminal has a three second audio clip of your fabricator's voice. maybe from a company voicemail greeting, a webinar they hosted, or just a quick video they posted on LinkedIn
from a job site, they can feed that into an AI audio synthesizer. From just three seconds. That's all it takes. The software isolates the timbre, the pitch, the unique vocal patterns. So when your office manager calls to verify a payment routing change, the criminal types responses into a keyboard, and the software speaks those words in real time. It sounds absolutely identical to the trusted vendor. That is deeply unsettling. You're talking to a machine, essentially, that sounds exactly like your friend Bob, who you have done business with for 10 years, who you play golf with. And Bob is telling you to send the money to a new routing number. And you do it because it's Bob. Now, if we connect this to the bigger picture, we have to ask, why is the construction industry bearing the absolute brunt of this technological assault? Smart Business
Automator's Market Intelligence Report reveals the sheer scale of the epidemic. There were 2 .5 $7 billion lost across 21 ,442 incidents in 2024. 2 .7 billion. Yes. This represents 73 % of all cyber incidents. And the financial stakes are only accelerating. The average wire transfer stolen jumped to $24 ,586 in January 2025 alone. That is a 46 % increase from just the prior month. So why construction? I mean, obviously the dollar amounts are high and you're paying for tons of steel, concrete, massive labor forces. Is it just the size of the price? The capital volume is a huge magnet, yes. But it's really about the operational culture and the complexity of
the supply chain. Okay. Construction offices are incredibly busy, chaotic, fast -paced environments. You have multiple tiers of subcontractors constantly shifting project timelines, weather delays, and really high pressure deadlines. Right. If a supplier calls and says, we need this payment routed to our new materials account today or we can't ship the structural steel, the instinct of any good project manager is to push it through to keep the project on schedule. You don't want to be the reason the whole site shuts down. Add to that the fact that construction is fundamentally a relationship -driven industry. It runs on handshakes, familiar voices, and trust. Criminals understand the psychology of that. They weaponize the chaos and they weaponize the trust. They know that in a busy trailer on a Tuesday morning, speed
usually overrides security. But this is where my brain goes to the safety net. If the technology is stacked against us and the criminals have AI perfectly cloning voices and they're lurking in our inboxes reading our mail, sure. Surely this is exactly what insurance is for. You'd think. I mean, you buy a massive cyber insurance policy, assuming it covers cyber theft. It is literally in the name. You would think so. But this brings us to perhaps the most dangerous illusion in the entire commercial business landscape today. Let's go back to our Texas case study and look at the legal mechanics of what happened next. Perry and Perry realized they lost $870 ,000. They did what any rational business would do. They filed a claim with their cyber insurance provider, Cowbell Cyber Inc. Let me guess, the
insurance adjuster showed up, opened a massive binder, and found a loophole. It wasn't even a loophole. It was a completely standard, plainly written clause in the contract. Cowbell paid out $250 ,000 and flatly denied the remaining loss. Oh, wow. Perry and Perry was outraged. So they took him to court. They sued. And on March 9th, 2026, Judge Scheidlauer ruled in the Waco federal court. What was the legal argument? Like, why did the judge rule against the contractor who was clearly the victim of a massive cybercrime? The judge ruled entirely in favor of the insurance company because of a fundamental legal distinction between a hack. and social engineering. Okay, what's the difference? The court looked at the facts. Did a hacker forcefully breach Perry and Perry's bank account and steal the funds? No.
An authorized employee of Perry and Perry voluntarily logged into the banking portal, typed in the amount, and clicked send. Wow. They were tricked, yes, but they voluntarily parted with the funds. Ah. So because the office manager physically authorized the wire, the liability shifts away from a direct network breach. Exactly. In the insurance world, that is classified under social engineering fraud, not general cyber liability. And because of that classification, it fell under a specific sublimin in the policy. The contract clearly capped all social engineering losses at $250 ,000 for the entire policy period. This is so crucial. Think about the general liability policy sitting in your office right now. For everyone listening, you might think you have
a $5 million umbrella policy, but buried on page 47 of the fine print, the specific bucket of money dedicated to getting tricked into wiring funds to a criminal is capped at a tiny, tiny fraction of that total amount. It's like having a million dollar health insurance policy. But if you actually read the scale, schedule of benefits the absolute maximum they will pay for an emergency ambulance ride is 50 bucks right if you need that ambulance to save your life you are paying the difference out of pocket foreign In this case, the net loss for Perry & Perry wasn't just the remaining $620 ,000. It was $620 ,000 out of pocket, plus the exorbitant legal costs of fighting a multi -year federal lawsuit that they ultimately lost. That is a company -ending event for a huge percentage of midsize contractors.
That's payroll. That's operating capital. wiped out. It absolutely is. And this is the harsh reality. The average social engineering sublimit across the entire commercial insurance industry right now is exactly $250 ,000. If you are a general contractor processing over $1 million monthly in vendor payments, and you have never personally read the sublimits in your policy, you are walking a tightrope without a net completely blindfolded. So what does this all mean? We can't trust our emails because they are being monitored by lurkers. We can't trust the voices on the phone because of AI cloning. And we definitively cannot assume our insurance policy is going to ride in like the cavalry to save us when the worst happens. No, we can't. We need a hard hat for our accounts payable department. What do
we actually do today to build a defense? We have to completely shift our operational mindset. Since the technology can be perfectly faked. and the insurance safety nets are highly conditional, internal process is your only armor. Process, okay. A rigorous defense -in -depth strategy must replace blind trust. It's about layering your internal workflows, your banking tools, and your administrative training. We have six vital steps here. Okay, let's start with the internal workflows. Because I was looking through the source material, specifically the recommended protocols, and the concept of the two -person rule stood out to me. It sounds like the protocol on a nuclear submarine where two different officers have to turn their keys at the exact same time to launch. That's a perfect analogy. That's step two on our list. The two -person rule mandates that for any payment over a certain threshold,
say $10 ,000, one person initiates the payment in the accounting system and a completely different person verifies it via a separate communication channel. Okay. You physically break the chain so no single point of failure can authorize a massive wire. And crucially, and this is step one. If you are verifying a vendor banking change, you never use the contact info provided in the request. Right. Going back to the fox in the hen house, you don't call the number in the email. You pull up the original master subcontract agreement from your own filing cabinet, and you call the phone number listed on that original legal document. You verify with the source data you established before the project even began. Exactly. Now, alongside that two -person rule, step four is that you must implement a mandatory 48 -hour cooling period for any vendor banking change.
Now, I have to put... back on this one. Because I am putting myself in the shoes of a GC right now. Construction runs on razor -thin timelines. If my concrete supplier says, wire the funds to this new account right now or the trucks don't roll, I don't have 48 hours. I might not even have 48 minutes. I hear that all the time. Right. The project schedule dictates everything. If I halt a pour for two days, I am bleeding thousands of dollars in delays. Doesn't a 48 -hour hold completely sabotage the operation? That exact panic you were describing, that adrenaline. That is the primary weapon the criminal is using against you. Scammers will always manufacture a false sense of extreme urgency to bypass your logic. By instituting a rigid corporate policy, you take the pressure off the individual employee.
The AP clerk doesn't have to argue. They simply state, as a matter of strict corporate protocol, our system requires a 48 -hour authentication hold to process any routing number changes. We cannot override it. Ah, so it gives you an institutional shield, it breaks the attacker's momentum, and it gives your team the necessary time to breathe, verify the original documents, and realize they are being played. It completely neutralizes the emotional manipulation. Now, moving to step three, beyond internal workflows, we have to look at external banking tools. I was reading about this in the sources as well, specifically a tool called Positive Pay. If I understand this correctly, it essentially acts like a VIP bouncer for your corporate bank account. You send your bank a daily, highly specific guest list of the checks
and electronic payments you have actually approved, including the exact dollar amounts and the exact account numbers they're supposed to go to. Am I getting that right? You're spot on. If anyone tries to cash a check or pull a wire that does not match your VIP list down to the penny, the bank's automated system flags it. and refuses the transaction until you manually log in and review it. That's brilliant. So even if a criminal somehow gets an invoice pushed through the initial layers, the bank's automated bouncer stops it at the door. It is an incredibly powerful final layer of defense. But all of these workflows and tools require administrative vigilance, which brings us to step five. You have to conduct quarterly staff training specifically on BEC tactics. Right. And I don't mean a boring once a year compliance
slideshow that everyone sleeps through. Show them the Perry and Perry case. Play them an example of AI voice cloning. Your account's payable team needs to be treated like the frontline security personnel they actually are. Because they literally hold the keys to the vault. And as we established, step six, you also need to pull your cyber insurance policy today and review those sublimits. Do not wait for your annual renewal period. Go into your policy right now. Find the specific line item for social engineering fraud and look at the sublimit. If it's only $250 ,000 and you're moving millions, call your broker immediately to negotiate higher caps or purchase a sublimit. You know, all of these processes make complete sense, but fighting AI with manual phone calls and 48 -hour holds feels a bit exhausting. Like
bringing a clipboard to a drone fight. Can technology actually help us enforce these processes without grinding the business to a halt? Absolutely. You cannot fight automated attacks purely with manual labor. Human beings get tired, we get rushed, we make mistakes. This is where Smart Business Automator's Market Intelligence Report highlights that modern platforms designed specifically for the construction industry are stepping in to protect companies. Okay, how so? These systems automatically flag banking change requests and enforce the manual verification protocols. So the software itself acts as that mandatory pause button. It won't let you process the payment until the two -person verification is logged. Exactly. The software pushes real -time alerts on the newest BEC tactics, and it organizes your
vendor data securely so that your teams can scale their operations without drowning in administrative chaos. Which is huge. Because that chaos, you know, the messy paperwork on a desk, the rushed emails in the job site trailer, the disorganized vendor files, that fog of war is exactly where these criminals hide and where these catastrophic mistakes happen. Structure and process defeat chaos and deception. This has been incredibly eye -opening. To recap everything we've covered today, we are looking at a fundamental shift in the reality of the construction industry. We are no longer just building physical structures. We are defending digital fortresses. Very true. The days where you could rely purely on a familiar voice on the phone or assume your basic insurance policy would act as a safety net for cyber theft, those days are completely over. They are entirely
behind us. The threat is sophisticated, it is incredibly patient, and it is targeting your specific workflows. So, to everyone listening... Here is your direct call to action. Do not let this just be an interesting deep dive you passively listen to on your commute to the site. Take action today. Pull out that insurance binder and check your sublimits. Implement that two -person rule for your outgoing wires. And please, share this deep dive with your office manager, your AP team, your CFO. Let's protect the hard capital you work so tirelessly to build every day. Please subscribe, rate, review, share this with your colleagues, and visit smartbusinessautomator .com to get equipped. And, you know, this raises an important question, something we all really need to sit with. We've talked about how insurance
companies are fiercely denying these claims, arguing that employees voluntarily parted with the funds. If AI can perfectly spoof an executive's voice in email and the corporate insurance policy refuses to cover the multimillion dollar loss, how long until the courts start piercing the corporate veil? How long until they start holding the individual employees, the accounts payable clerks, the project managers who clicked send personally? financially liable for that missing money?
