Cybersecurity for contractors and home service businesses

Contractors run their businesses from trucks and job sites. Estimates, photos, invoices, supplier orders and customer messages all live on a phone, and money moves on the strength of an email.

That's exactly what criminals target. This guide covers the security basics for builders, remodelers, plumbers, electricians, landscapers, roofers and other home service businesses.

Why are contractors a target?

Contractors handle large payments: customer deposits, progress payments and supplier invoices. Those payments are often arranged by email or text, between people who rarely meet.

That makes contractors a natural target for business email compromise, where a criminal impersonates you, a supplier or a customer to redirect a payment. The FBI's Internet Crime Complaint Center says this scam targets everyone from small local businesses to large companies.

Your next step: write down who in your business can send or approve payments, and how they confirm a request is real.

How do I stop fake invoices and deposit fraud?

Most payment fraud works because a single email is enough to move money. Add one more step and the scam usually fails.

• Confirm any change to bank details by phone, using a number you already have. Never use the number in the email asking for the change.
• Tell customers in your contract and first email that you'll never change payment details by email, and that they should call you before paying a new account.
• Look closely at the sender's address on payment emails. Lookalike domains swap one letter, like rn for m, or add a word.
• Turn on two-step sign-in (MFA) for every email account, so a stolen password isn't enough to read your conversations.

If money does go to the wrong account, call your bank immediately and ask for a recall, then report it at ic3.gov. The FBI says time is critical.

How do I protect phones and tablets in the field?

Phones get dropped, left on job sites and borrowed. The FTC recommends protecting devices with strong passwords and not leaving them unattended.

• Use a screen lock with a PIN or fingerprint on every phone and tablet that has business email or apps.
• Turn on automatic updates for the phone and its apps.
• Turn on Find My (iPhone) or Find My Device (Android), so you can locate or erase a lost phone.
• Keep business apps signed in with each person's own account, not the owner's.

CISA notes that modern smartphones encrypt their storage, but Windows and Mac laptops must be set up to encrypt their drives. If you have an office laptop with customer files on it, turn on BitLocker or FileVault.

How do I manage crew and subcontractor access?

Job management, scheduling and estimating apps often end up with one shared login. That works until someone leaves on bad terms.

• Give each employee and regular subcontractor their own login, with access matched to what they do.
• Remove access the same day someone leaves, including email, job software, supplier portals and shared photo folders.
• Turn on two-step sign-in for the owner and office accounts on every platform.
• Keep the master login for your bank, payroll and domain registrar with the owner only.

How do I protect my website, reviews and email?

Your website and online listings are how new customers find and trust you. Your email domain is how they know an invoice is really from you.

• Use HTTPS on every page, especially quote and contact forms, with a certificate that renews automatically.
• Turn on two-step sign-in for your website builder, domain registrar and business listing accounts.
• Publish SPF, DKIM and DMARC records so criminals can't easily send invoices that appear to come from your domain. Our free DMARC record generator builds a safe starting record, and our guide to stopping email spoofing explains the full process.

How do I back up estimates, photos and contracts?

Job photos, signed contracts and change orders protect you in a dispute. Keep them in a cloud service like Google Drive, OneDrive or Dropbox rather than on one phone, and make sure the account has two-step sign-in. The FTC recommends backing up important files regularly.

What's on a contractor cybersecurity checklist?

For general small business steps like Wi-Fi and passwords, see the small business cybersecurity checklist.

What should you do next?

Start with the steps that protect your payments.

1. Run the free website security scan to see whether your domain is protected against spoofing.
2. Add a line to your contracts and invoices saying you'll never change payment details by email.
3. Turn on two-step sign-in for every email account in your business.
4. If DMARC is missing, create a record with the DMARC record generator.