How Contractors Get Stolen From, and the Controls That Stop It
Organizations with fewer than 100 employees lose a median of $141,000 when an employee commits fraud, and the typical scheme runs 12 months before anyone catches it, according to the Association of Certified Fraud Examiners’ 2024 Report to the Nations. In construction, the median loss climbs to $250,000 per case. From keeping the books for contractors and reviewing them as a CPA, we’ve found the companies most exposed are the ones that trust their office the most, usually because one person has handled the money for years without anyone checking behind them.
That’s the uncomfortable part of the ACFE data. Small businesses experience every major fraud scheme at a higher rate than larger organizations, yet they’re far less likely to have basic controls in place. Only 39% of small organizations reported regular management review, compared with 79% of larger ones, and only 17% used surprise audits. The theft rarely requires anyone to be clever. It only requires nobody looking.
How the theft actually happens
The ACFE breaks occupational fraud into schemes, and for small organizations the most common ones line up closely with how contracting companies run day to day.
Billing schemes showed up in 31% of small business cases. In a contracting company this usually looks like a fake vendor set up in the accounting system, inflated supplier invoices with the difference split with someone on the outside, or payments for materials that never arrived on any job.
Check and payment tampering appeared in 23% of small business cases, compared with just 9% at larger organizations. This is the office manager who writes checks, records them, and reconciles the bank account, which means they can change a payee or a dollar amount and then hide it in the same books they control.
Expense reimbursement and card misuse came up in 20% of cases. For contractors that means fuel cards used on personal vehicles, supply house accounts charged for side jobs, and company cards with no receipt requirement.
Skimming showed up in 19% of small business cases. Any trade that collects payment in the field is exposed here, since a technician who takes a check or cash on a service call and never turns in the ticket leaves no trace in the books at all.
Payroll schemes appeared in 14% of cases. Padded hours, ghost employees who still get a direct deposit after they quit, and pay rate changes nobody approved are all easier when one person enters time and runs payroll.
Material theft doesn’t show up as its own category in the ACFE study, but every contractor knows it. Copper, wire, fittings, and tools walk off jobsites and out of the shop, often to supply side work on weekends.
Why contractors are an easy target
Contracting companies tend to concentrate financial control in one trusted person, usually an office manager or bookkeeper who has been there for years. That person often opens the mail, enters bills, cuts checks, runs payroll, and reconciles the bank, and the owner signs off because they’re running crews and bidding work. It’s the exact setup the ACFE data says produces the most fraud, and it also produces the longest-running schemes, because the person committing the theft is the same person who would otherwise catch it.
Job costing makes the problem worse when it isn’t done well. If materials aren’t tagged to jobs, nobody can see that a project used 40% more wire than the estimate, and a theft that would stand out in a job cost report disappears into a blended materials line.
The controls that actually work
None of these require a big team or expensive software. They require splitting a few duties and having someone outside the daily process look at the numbers regularly.
Split the duties around cash. The person who enters bills and cuts checks shouldn’t be the person who reconciles the bank account. When that isn’t possible with a small office, the owner or an outside accountant should review the reconciliation every month, along with the bank statement itself.
Look at the bank activity yourself. Owners who log into the bank and scan the transactions once a week catch more fraud than any formal policy. Check images, payees, and unfamiliar ACH transfers are the first things to look at.
Lock down the vendor list. New vendors and changes to vendor bank details should require a second approval. Fake vendors and redirected payments both start with an edit to the vendor list that nobody else saw.
Use positive pay. Most banks offer positive pay, which matches every check presented against the list of checks you actually issued and flags anything that doesn’t match. It’s inexpensive and stops altered and forged checks cold.
Control cards and supply accounts. Set limits on fuel and company cards, require a receipt and job number for every purchase, and review supply house statements against jobs each month.
Separate payroll entry from payroll approval. Someone other than the person entering time should review the payroll register before it runs, especially new hires, terminations, and rate changes.
Close the field payment gap. Require every field payment to tie to an invoice in the system, and reconcile collected payments against completed work orders. A gap between jobs completed and payments deposited is often the first sign of skimming.
Use job costing as an early warning. When materials and labor are tagged to jobs, a project running well over estimate on materials is visible within the month. Our post on job costing in QuickBooks covers how to set that up.
Require time off. Mandatory vacation sounds old-fashioned, but only 10% of small organizations use it according to the ACFE. Many schemes surface the first week someone else has to cover the job.
What it costs to not have a second set of eyes
The ACFE estimates the average organization loses 5% of revenue to fraud. For a $3 million contractor, that would be $150,000 a year. Even a fraction of that is more than most companies would spend on proper financial oversight, and the real cost is usually bigger, since schemes tend to run a full year or more before they’re caught and the money is rarely recovered.
The fix for most contractors is structural more than technological.
When the books are kept by someone outside the company and reviewed by a CPA every month, the person handling day-to-day money is no longer the only person who sees the numbers.
That alone removes most of the opportunity. Our post on bookkeeping for contractors covers what a proper monthly process looks like.
At Prophet Accounting, we work with home service contractors and construction subcontractors across Port St. Lucie, the Treasure Coast, and nationwide.
Every set of books we keep is reconciled monthly and reviewed by a CPA, which gives owners an independent check on where the money is going without adding headcount.
Schedule a consultation at prophetaccounting.com/contractors, or for bonded and prevailing wage subs at prophetaccounting.com/construction, or give us a call at (772) 380-2871.
