Collect a certificate and the actual endorsements before a sub mobilizes, log every policy expiration date in one place, chase renewals 30 days out, and tie payment approval to current coverage. That is the whole system. The hard part is running it every week on every job.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
To track subcontractor insurance certificates, keep one log with a row per sub and per policy (general liability, auto, umbrella, workers comp), record the carrier, policy number, limits, and expiration date from each certificate of insurance, attach the endorsements your subcontract requires, and review the log on a fixed schedule. A sub with an expired or missing policy does not start work and does not get paid until the gap is fixed.
Most general contractors already collect certificates. Where they fall down is the follow-up. A certificate is accurate on the day it is issued and starts aging the next morning. Policies renew, get cancelled for nonpayment, or change carriers mid-job, and nobody tells the GC unless the GC asks.
Why the certificate alone is not proof of coverage
The standard ACORD 25 certificate says so in capital letters at the top: it is issued as a matter of information only and confers no rights upon the certificate holder, and it does not amend, extend, or alter the coverage afforded by the policies. The same form warns that if the certificate holder is an additional insured, the policy must be endorsed, and a statement on the certificate does not replace that endorsement.
Some states put this into law. New York Insurance Law section 502 says a certificate of insurance shall not amend, extend, or alter the coverage provided by the policy and shall not confer rights beyond those expressly provided by the policy. So the tracking system needs two layers: the certificate for quick facts and dates, and the endorsements for the rights you actually bargained for. See additional insured endorsements explained for what those forms do.
How to set up a COI tracking system in 7 steps
1. Write the requirements once, per contract type
Pull the insurance exhibit from your owner contracts and build a standard requirement set for subcontracts: coverage types, minimum limits, additional insured forms, waiver of subrogation, primary and noncontributory wording, and how many years completed operations coverage must stay in place. Public owners often add their own items. A New York state construction authority's sample package, for example, asks for proof of 30 days notice of cancellation in its favor. Make sure your subcontract carries every owner requirement down, or you are holding a risk nobody insured. The flow-down clauses guide covers how.
2. Collect documents before the subcontract is signed
Ask the sub's broker, not the sub, for the certificate and the endorsement pages. Brokers issue certificates every day and respond faster. Request the policy numbers and edition dates of the endorsements so you can compare them to the contract language.
3. Log every policy as its own row
One sub usually has four or five policies, often with different carriers and different renewal dates. A single expiration date per sub hides the auto policy that lapses two months before the GL policy. Use a subcontractor COI tracking template or software, but give each policy its own line.
4. Check the certificate against the requirements
Read it line by line. Is the named insured the same legal entity that signed the subcontract? Are the additional insured and waiver boxes marked, and are the endorsements attached? Do the limits meet the minimums? Is the description of operations broad enough to cover the project? Record any shortfall as an open item with an owner and a due date.
5. Set reminders at 30 days and on expiration day
Send a renewal request to the broker 30 days before any policy expires, and a second notice a week out. On the expiration date, if no renewal certificate is in, the sub's status flips to noncompliant. The 30-day lead time is a common internal practice, not a legal rule. Pick a number and stick to it.
6. Tie compliance to site access and payment
The tracker only matters if it controls something. Two controls work: the superintendent does not let a noncompliant sub onto the site, and accounts payable does not release a payment to a sub flagged as expired. Write both into the subcontract so it is a contract term, not a surprise.
7. Keep the records after closeout
Claims for completed work can show up years later. Archive each job's certificates and endorsements with the project file so you can prove who was insured on what dates. The document retention guide covers how long to hold project records.
Worked example: a 14-sub tenant improvement
Say a GC runs a $480,000 office tenant improvement with 14 subcontractors over five months. The project coordinator builds the log during buyout. Each sub averages four policies, so the log has 56 rows. Here is what three of them look like in month two.
Example COI log rows (illustrative)
Sub
Policy
Expires
AI and waiver endorsements
Status
Drywall sub
General liability
Aug 31
Ongoing and completed ops attached
Compliant
Drywall sub
Commercial auto
Jun 15
Not required
Renewal requested May 16
Electrical sub
Workers comp
Jul 1
Waiver of subrogation missing
Open item, broker emailed
Flooring sub
Umbrella
Expired May 30
Follow form
Hold site access and payment
On June 2 the flooring sub submits a $22,000 pay application. Because the umbrella expired May 30, the payment sits in the approval queue with a compliance hold. The broker sends a renewal certificate on June 4, the coordinator updates the row, and the hold clears the same day. Without the log, that sub would have worked and been paid for a week with a required policy lapsed.
Mistakes to avoid
Accepting a certificate without endorsements. The ACORD form itself says the certificate does not create additional insured status.
Tracking one date per sub. Each policy expires on its own schedule.
Letting the project manager own it alone. PMs are busy. Give the log to one coordinator across all jobs.
Ignoring the named insured. A certificate for a sister company or a dba that did not sign the subcontract is not the coverage you need.
Forgetting lower tiers. If your sub hires a sub-subcontractor, require the sub to collect and track that tier too, and spot check it.
Throwing records away at closeout. Completed operations claims arrive after the job is done.
Smart Business Automator keeps subcontractor records, document expiration dates, and payment approvals in the same place, and its document data extraction can read dates and limits off an uploaded certificate. See subcontractor compliance automation.
Frequently asked questions
How often should I check subcontractor insurance certificates?+
Review the whole log at least monthly and check expirations weekly on active jobs. Also check before releasing any payment, since that is your strongest leverage to get a renewal certificate.
Is a certificate of insurance enough to prove I am an additional insured?+
No. The standard ACORD 25 form states that the policy must be endorsed for the holder to be an additional insured and that a statement on the certificate does not replace the endorsement. Ask for the endorsement pages.
Who should request the certificate, the sub or its broker?+
Request it from the broker or agent listed as producer on the certificate. They issue certificates directly, can confirm the endorsements, and usually respond faster than the sub's office.
What should I do when a subcontractor's policy expires mid-job?+
Follow what your subcontract says. A common approach is to stop site access and hold payments until a renewal certificate arrives. Document the notice you sent and the date coverage was restored.
How long should I keep subcontractor certificates after a job ends?+
Keep them with the project file at least as long as claims can be brought for that work, which depends on your state's statute of limitations and repose and on your contract. Ask your broker and attorney for a firm number.
A Texas steel erector lost $870,000 in two electronic payments after a dual email and telephone fraud attack. Cyber insurance covered only $250,000. BEC losses hit $2.77 billion in 2024 with construction as the #1 target. This episode breaks down the attack and 6 prevention steps.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
You know, usually when we think about a massive financial heist, there is this expectation of physical force. Right, like a movie. Exactly, like you imagine the ski masks and, you know, a screeching getaway car. The adrenaline. Yeah, the adrenaline of someone just vaulting over a bank counter and demanding the cash. It's dramatic. It's loud. And... crucially, it's immediately obvious to everyone in the room that a crime is taking place, right? The alarms are ringing. But then you step into the world of modern commercial construction and accounts payable, and suddenly that... That screeching getaway car is just, it's a quiet office. Yeah. A cup of coffee, a mouse click. We're looking at a landscape of financial theft that is just terrifyingly silent.
It is the absolute definition of an invisible disaster. I mean, by the time you realize the vault is empty, the thieves are already a ghost in the machine. Wow. And the money is sitting in an offshore account somewhere. Well, welcome to this deep dive aimed directly at all you scaling legends out there. You know, the construction business owners, the general contractors, project managers, and really just the insanely curious. learners who are looking to protect their livelihoods. Definitely. Today, we are pulling from a fascinating stack of sources. We have a recent, really comprehensive piece of DataSmart Business Automator's Market Intelligence Report, alongside some highly revealing federal court documents. That's a lot to get through. It is. But our mission is to unpack the terrifying mechanics of business email compromise,
or BEC, and payment fraud. We're going to examine a specific devastating case study of an $870 ,000 loss in Texas. Just a massive hit. Yeah. We'll break down why your traditional safety nets are completely failing and exactly how to armor your business against this today. It's a critical conversation for anyone moving capital right now. I mean, the rules of engagement have completely shifted. They really have. The very trust that built the construction industry. is now the exact weapon being used to dismantle it. OK, let's unpack this because I want to start with the inciting incident. You know, the nightmare scenario. Walk us through. So it's December 19th, 2023. We are looking at a Texas steel erector named Perry and Perry, a real company doing real
work, building real infrastructure. Right. And on this random Tuesday in December, their office manager sits down and sends two electronic payments in a matter of minutes total. $870 ,000. Wow. And they fully believed, like completely believed they were paying their fabricator, a company called Alamo Structural Steel. But they weren't. No, they weren't. They were paying a criminal. The money just vanished. What's fascinating here is, and, you know, I use fascinating in the darkest possible sense of the word. This was not a typo. Right. It wasn't a glitch in their accounting software or anything like that. It was a highly calculated, surgically precise interception. This type of crime preys entirely on the routine day -to -day operations of the business. And
we have to talk about the mechanics of how this actually happened, because this is where, honestly, my stomach just dropped reading the background on this case. Because the office manager at Perry & Perry didn't just blindly wire almost a million dollars because of a random suspicious email. They actually tried to do the right thing. They followed their instincts. Yeah. They received an email from someone claiming to be the CFO of Alamo Structural Steel, requesting a change in their banking routing details for this massive payment. And the office manager saw that, paused, and decided to verify it over the phone. Which, you know, is the standard operating procedure we've all been taught for decades. If you see a change, you call to verify. But they made one critical error, just one tiny misstep that cost
the business $870 ,000. They called the phone number located inside the scam email. I mean, that is like asking the FOTS to verify if he is the officially assigned security guard for the hen hats. You are literally calling the criminal to ask if the criminal is legitimate. You're hitting on the absolute core vulnerability of human habit here. When they made that call, the scammer on the other end Calmed and confidently posed as the CFO of Alamo Structural Steel. Just played the part perfectly. Exactly. They confirmed the banking changes. They sounded professional. And here's the kicker. They knew the exact context of the payment, the project name, the invoice numbers. Which is terrifying. It is. And that
level of context is what we really need to dissect. Because these criminals are not just sending out thousands of blind, generic emails, hoping a random contractor bites. they're already inside the house. Wait, I want to clarify the mechanics of that, because how are they inside the house without the company's IT department noticing a massive breach? Like, do they just guess a password and start firing off messages? No, no, it's much more insidious than that. If we look at Smart Business Automator's market intelligence report, we see that 50 % of these BEC incidents compromise more than one mailbox. Half of them. Right. The attackers don't just hack an account and immediately send a fake invoice. They lurk. Lurk. So they're just, what? They're just watching. Yeah, think of it like a burglar breaking into your house, but instead of stealing your TV, they quietly climb into your attic and just live
there for two months. Oh, man. They don't make a sound. Every day, they read your mail before you even get home. They learn your schedule. They learn who your friends are. They learn how you speak. That is so creepy. In a digital sense, these criminals... compromise an email account, maybe through like a clever phishing link an employee clicked weeks ago, and then they set up hidden email forwarding rules. Oh, so the actual user has no idea. If I'm the CFO, I'm just typing away, totally unaware that every single email containing the word invoice or wire transfer is being silently blind copied to a server in Eastern Europe. Precisely. They sit silently in the system, absorbing everything. They learn the tone of voice your vendors use. They learn the exact billing cycles, the project milestones, and specific names of the foreman
on the job site. So they have the whole playbook. Exactly. They wait for the perfect moment of vulnerability, usually right when a large, legitimate payment is due. And they seamlessly insert themselves into the email chain. So when that office manager called the number in the email, the person answering didn't have to guess. They already had the entire script. Here's where it gets really interesting and honestly a bit overhauling. Because my first instinct is to say, OK, well, if the emails are perfectly written without those obvious typos and they know our billing cycles and the phone calls sound exactly like the real person, are we just completely outmatched by robots? It's a fair question. Like how is a busy accounts payable clerk supposed to spot this? It is a highly valid question because we are looking at a massive technology driven escalation. The
deception in the Perry & Perry case is just the tip of the spear. We are in the middle of a full -blown AI epidemic. Since artificial intelligence tools went mainstream, there has been a 1 ,760 % increase in business email compromise attacks. 1 ,760%. I mean, that's not a shred. That's a tidal wave. And the composition of that wave is shifting rapidly. Right now, 40 % of all BEC emails are entirely AI -generated. Wow. You remember how phishing emails used to be somewhat easy to spot? Bad grammar, weird spelling, awkward formatting. Yeah, the classic, dear sir or madam, kindly send funds emails. The ones that felt like they were run through a bad translation app three times. Right, well, AI wiped that defense out overnight. Large language models can now
ingest months of a compromised inbox's history and generate flawless, context -aware corporate emails in seconds. Unbelievable. They perfectly mimic the specific cadence, the industry jargon, even the specific sign -off the real CFO uses. But, and this is the scary part, the escalation goes far beyond text. AI voice cloning means that phone verification is no longer a reliable single line of defense. I really want to dig into that because it sounds like science fiction. Explain how that works practically. Like how easy is it for a criminal to clone the voice of a trusted vendor? It takes seconds, literally seconds. If a criminal has a three second audio clip of your fabricator's voice. maybe from a company voicemail greeting, a webinar they hosted, or just a quick video they posted on LinkedIn
from a job site, they can feed that into an AI audio synthesizer. From just three seconds. That's all it takes. The software isolates the timbre, the pitch, the unique vocal patterns. So when your office manager calls to verify a payment routing change, the criminal types responses into a keyboard, and the software speaks those words in real time. It sounds absolutely identical to the trusted vendor. That is deeply unsettling. You're talking to a machine, essentially, that sounds exactly like your friend Bob, who you have done business with for 10 years, who you play golf with. And Bob is telling you to send the money to a new routing number. And you do it because it's Bob. Now, if we connect this to the bigger picture, we have to ask, why is the construction industry bearing the absolute brunt of this technological assault? Smart Business
Automator's Market Intelligence Report reveals the sheer scale of the epidemic. There were 2 .5 $7 billion lost across 21 ,442 incidents in 2024. 2 .7 billion. Yes. This represents 73 % of all cyber incidents. And the financial stakes are only accelerating. The average wire transfer stolen jumped to $24 ,586 in January 2025 alone. That is a 46 % increase from just the prior month. So why construction? I mean, obviously the dollar amounts are high and you're paying for tons of steel, concrete, massive labor forces. Is it just the size of the price? The capital volume is a huge magnet, yes. But it's really about the operational culture and the complexity of
the supply chain. Okay. Construction offices are incredibly busy, chaotic, fast -paced environments. You have multiple tiers of subcontractors constantly shifting project timelines, weather delays, and really high pressure deadlines. Right. If a supplier calls and says, we need this payment routed to our new materials account today or we can't ship the structural steel, the instinct of any good project manager is to push it through to keep the project on schedule. You don't want to be the reason the whole site shuts down. Add to that the fact that construction is fundamentally a relationship -driven industry. It runs on handshakes, familiar voices, and trust. Criminals understand the psychology of that. They weaponize the chaos and they weaponize the trust. They know that in a busy trailer on a Tuesday morning, speed
usually overrides security. But this is where my brain goes to the safety net. If the technology is stacked against us and the criminals have AI perfectly cloning voices and they're lurking in our inboxes reading our mail, sure. Surely this is exactly what insurance is for. You'd think. I mean, you buy a massive cyber insurance policy, assuming it covers cyber theft. It is literally in the name. You would think so. But this brings us to perhaps the most dangerous illusion in the entire commercial business landscape today. Let's go back to our Texas case study and look at the legal mechanics of what happened next. Perry and Perry realized they lost $870 ,000. They did what any rational business would do. They filed a claim with their cyber insurance provider, Cowbell Cyber Inc. Let me guess, the
insurance adjuster showed up, opened a massive binder, and found a loophole. It wasn't even a loophole. It was a completely standard, plainly written clause in the contract. Cowbell paid out $250 ,000 and flatly denied the remaining loss. Oh, wow. Perry and Perry was outraged. So they took him to court. They sued. And on March 9th, 2026, Judge Scheidlauer ruled in the Waco federal court. What was the legal argument? Like, why did the judge rule against the contractor who was clearly the victim of a massive cybercrime? The judge ruled entirely in favor of the insurance company because of a fundamental legal distinction between a hack. and social engineering. Okay, what's the difference? The court looked at the facts. Did a hacker forcefully breach Perry and Perry's bank account and steal the funds? No.
An authorized employee of Perry and Perry voluntarily logged into the banking portal, typed in the amount, and clicked send. Wow. They were tricked, yes, but they voluntarily parted with the funds. Ah. So because the office manager physically authorized the wire, the liability shifts away from a direct network breach. Exactly. In the insurance world, that is classified under social engineering fraud, not general cyber liability. And because of that classification, it fell under a specific sublimin in the policy. The contract clearly capped all social engineering losses at $250 ,000 for the entire policy period. This is so crucial. Think about the general liability policy sitting in your office right now. For everyone listening, you might think you have
a $5 million umbrella policy, but buried on page 47 of the fine print, the specific bucket of money dedicated to getting tricked into wiring funds to a criminal is capped at a tiny, tiny fraction of that total amount. It's like having a million dollar health insurance policy. But if you actually read the scale, schedule of benefits the absolute maximum they will pay for an emergency ambulance ride is 50 bucks right if you need that ambulance to save your life you are paying the difference out of pocket foreign In this case, the net loss for Perry & Perry wasn't just the remaining $620 ,000. It was $620 ,000 out of pocket, plus the exorbitant legal costs of fighting a multi -year federal lawsuit that they ultimately lost. That is a company -ending event for a huge percentage of midsize contractors.
That's payroll. That's operating capital. wiped out. It absolutely is. And this is the harsh reality. The average social engineering sublimit across the entire commercial insurance industry right now is exactly $250 ,000. If you are a general contractor processing over $1 million monthly in vendor payments, and you have never personally read the sublimits in your policy, you are walking a tightrope without a net completely blindfolded. So what does this all mean? We can't trust our emails because they are being monitored by lurkers. We can't trust the voices on the phone because of AI cloning. And we definitively cannot assume our insurance policy is going to ride in like the cavalry to save us when the worst happens. No, we can't. We need a hard hat for our accounts payable department. What do
we actually do today to build a defense? We have to completely shift our operational mindset. Since the technology can be perfectly faked. and the insurance safety nets are highly conditional, internal process is your only armor. Process, okay. A rigorous defense -in -depth strategy must replace blind trust. It's about layering your internal workflows, your banking tools, and your administrative training. We have six vital steps here. Okay, let's start with the internal workflows. Because I was looking through the source material, specifically the recommended protocols, and the concept of the two -person rule stood out to me. It sounds like the protocol on a nuclear submarine where two different officers have to turn their keys at the exact same time to launch. That's a perfect analogy. That's step two on our list. The two -person rule mandates that for any payment over a certain threshold,
say $10 ,000, one person initiates the payment in the accounting system and a completely different person verifies it via a separate communication channel. Okay. You physically break the chain so no single point of failure can authorize a massive wire. And crucially, and this is step one. If you are verifying a vendor banking change, you never use the contact info provided in the request. Right. Going back to the fox in the hen house, you don't call the number in the email. You pull up the original master subcontract agreement from your own filing cabinet, and you call the phone number listed on that original legal document. You verify with the source data you established before the project even began. Exactly. Now, alongside that two -person rule, step four is that you must implement a mandatory 48 -hour cooling period for any vendor banking change.
Now, I have to put... back on this one. Because I am putting myself in the shoes of a GC right now. Construction runs on razor -thin timelines. If my concrete supplier says, wire the funds to this new account right now or the trucks don't roll, I don't have 48 hours. I might not even have 48 minutes. I hear that all the time. Right. The project schedule dictates everything. If I halt a pour for two days, I am bleeding thousands of dollars in delays. Doesn't a 48 -hour hold completely sabotage the operation? That exact panic you were describing, that adrenaline. That is the primary weapon the criminal is using against you. Scammers will always manufacture a false sense of extreme urgency to bypass your logic. By instituting a rigid corporate policy, you take the pressure off the individual employee.
The AP clerk doesn't have to argue. They simply state, as a matter of strict corporate protocol, our system requires a 48 -hour authentication hold to process any routing number changes. We cannot override it. Ah, so it gives you an institutional shield, it breaks the attacker's momentum, and it gives your team the necessary time to breathe, verify the original documents, and realize they are being played. It completely neutralizes the emotional manipulation. Now, moving to step three, beyond internal workflows, we have to look at external banking tools. I was reading about this in the sources as well, specifically a tool called Positive Pay. If I understand this correctly, it essentially acts like a VIP bouncer for your corporate bank account. You send your bank a daily, highly specific guest list of the checks
and electronic payments you have actually approved, including the exact dollar amounts and the exact account numbers they're supposed to go to. Am I getting that right? You're spot on. If anyone tries to cash a check or pull a wire that does not match your VIP list down to the penny, the bank's automated system flags it. and refuses the transaction until you manually log in and review it. That's brilliant. So even if a criminal somehow gets an invoice pushed through the initial layers, the bank's automated bouncer stops it at the door. It is an incredibly powerful final layer of defense. But all of these workflows and tools require administrative vigilance, which brings us to step five. You have to conduct quarterly staff training specifically on BEC tactics. Right. And I don't mean a boring once a year compliance
slideshow that everyone sleeps through. Show them the Perry and Perry case. Play them an example of AI voice cloning. Your account's payable team needs to be treated like the frontline security personnel they actually are. Because they literally hold the keys to the vault. And as we established, step six, you also need to pull your cyber insurance policy today and review those sublimits. Do not wait for your annual renewal period. Go into your policy right now. Find the specific line item for social engineering fraud and look at the sublimit. If it's only $250 ,000 and you're moving millions, call your broker immediately to negotiate higher caps or purchase a sublimit. You know, all of these processes make complete sense, but fighting AI with manual phone calls and 48 -hour holds feels a bit exhausting. Like
bringing a clipboard to a drone fight. Can technology actually help us enforce these processes without grinding the business to a halt? Absolutely. You cannot fight automated attacks purely with manual labor. Human beings get tired, we get rushed, we make mistakes. This is where Smart Business Automator's Market Intelligence Report highlights that modern platforms designed specifically for the construction industry are stepping in to protect companies. Okay, how so? These systems automatically flag banking change requests and enforce the manual verification protocols. So the software itself acts as that mandatory pause button. It won't let you process the payment until the two -person verification is logged. Exactly. The software pushes real -time alerts on the newest BEC tactics, and it organizes your
vendor data securely so that your teams can scale their operations without drowning in administrative chaos. Which is huge. Because that chaos, you know, the messy paperwork on a desk, the rushed emails in the job site trailer, the disorganized vendor files, that fog of war is exactly where these criminals hide and where these catastrophic mistakes happen. Structure and process defeat chaos and deception. This has been incredibly eye -opening. To recap everything we've covered today, we are looking at a fundamental shift in the reality of the construction industry. We are no longer just building physical structures. We are defending digital fortresses. Very true. The days where you could rely purely on a familiar voice on the phone or assume your basic insurance policy would act as a safety net for cyber theft, those days are completely over. They are entirely
behind us. The threat is sophisticated, it is incredibly patient, and it is targeting your specific workflows. So, to everyone listening... Here is your direct call to action. Do not let this just be an interesting deep dive you passively listen to on your commute to the site. Take action today. Pull out that insurance binder and check your sublimits. Implement that two -person rule for your outgoing wires. And please, share this deep dive with your office manager, your AP team, your CFO. Let's protect the hard capital you work so tirelessly to build every day. Please subscribe, rate, review, share this with your colleagues, and visit smartbusinessautomator .com to get equipped. And, you know, this raises an important question, something we all really need to sit with. We've talked about how insurance
companies are fiercely denying these claims, arguing that employees voluntarily parted with the funds. If AI can perfectly spoof an executive's voice in email and the corporate insurance policy refuses to cover the multimillion dollar loss, how long until the courts start piercing the corporate veil? How long until they start holding the individual employees, the accounts payable clerks, the project managers who clicked send personally? financially liable for that missing money?
