In early 2024, an employee at engineering firm Arup's Hong Kong office joined a video call with what appeared to be the company's chief financial officer and several senior colleagues. The CFO instructed the employee to transfer £20 million. The employee complied. Every person on that call was a deepfake.
That is not science fiction. It happened. And construction firms are among the most vulnerable targets for this kind of attack.
Why Construction Is a Soft Target
75% Of security professionals blame AI for rising cybercrime
£1bn+ Lost to phishing attacks annually in the UK (Gallagher/NCSC)
£20m Stolen from Arup via a single deepfake video call
Construction operates on trust. A site manager trusts instructions from the project director. A QS trusts payment instructions from the commercial lead. That trust-based culture is exactly what social engineers exploit.
The National Cyber Security Centre reported a 30% increase in phishing attacks targeting UK businesses in 2025. According to IBM X-Force, threat actors are pursuing bigger, broader campaigns than ever.
“With very few prompts, an AI model can write a phishing message meant just for me. That is terrifying.”
— Stephanie Carruthers, IBM X-Force
The Construction-Specific Risk
An Egress report found that 71% of AI-powered deepfake detectors fail to identify sophisticated fakes.
Payment redirection fraud. Variation order fraud. Supply chain compromise. AI-generated correspondence from a fake supplier confirming delivery schedules and quality certificates.
What the Industry Needs to Do
Two-factor verification on all payment changes. Call-back protocols using pre-agreed phone numbers. Multi-person authorisation for transactions above a threshold.
Sources: Industrial Cyber, Social Engineering in OT Sector (2025). IBM X-Force, Generative AI and Social Engineering (2025). EC-Council, Social Engineering Attacks (2026). NCSC, UK Cyber Threat Assessment. Egress, AI Deepfake Detection Report.
Building AI Competence in the Built Environment
The Responsible with AI programme helps construction professionals understand AI-enabled threats and develop practical defenses.
Explore the Programme → Responsible with AI
