Construction draws: large, repeated, and authorised by PDF
Residential closing fraud gets the attention because a family loses their savings. Construction lending has the same mechanics, larger amounts, and a dozen opportunities per project instead of one.
Why are construction draws a bigger target than closings?
Same mechanics, larger amounts, and a dozen opportunities per project on a schedule an attacker can learn. A closing happens once; a construction loan pays out monthly for a year or more against signed PDFs circulated by email through a chain that includes small subcontractors.
- The draw process is repetitive and predictable, which gives an attacker many attempts and a learned template to imitate.
- Standard draw forms are PDFs with handwritten or image signatures, circulated by email, with no cryptographic integrity.
- Binding the disbursement instruction to a signature from the contractor's enrolled device moves the authorisation off email.
Part of Title, escrow and closing wires
Why this is worse than a single closing
| Factor | Residential closing | Construction draw |
|---|---|---|
| Frequency | Once | Monthly for 12–24 months |
| Amount | Typically six figures | Often six to seven figures per draw |
| Parties | 4–5 | Lender, GC, subs, inspector, title, architect |
| Predictability | One known date | A known schedule the attacker can learn |
| Familiarity | Buyer has no baseline | Everyone is familiar — which breeds routine |
The last row cuts both ways. Familiarity means the parties would notice a wildly wrong request, and it also means the process is handled quickly and without much scrutiny, because it happens every month.
Where the intercept happens
The draw package moves through several hands, and the attack usually sits on the weakest mailbox rather than the largest party.
- The general contractor prepares the application and continuation sheet, signed and scanned.
- It goes to the architect or inspector for certification.
- It reaches the lender's construction loan administrator.
- The lender approves and disburses, often to accounts specified in the package.
- Subcontractors are paid from the proceeds.
Small subcontractors and independent inspectors frequently have the least mail security in the chain, and their compromise is enough. A modified continuation sheet or a substituted disbursement account propagates through a process that treats the PDF as authoritative.
What the PDF does and does not prove
A standard draw form carries an image of a signature and often a notarisation. It is a document, and documents circulated by email have no integrity.
- The signature image can be lifted from any previous draw
- Amounts and account details are editable text in most PDFs
- A notary block attests to the signing of a paper original, not to the file that arrived
- Nothing binds the form to the specific disbursement that results
The last point matters most. Even a genuinely signed form does not specify, in a tamper-evident way, which account receives the money.
Binding the disbursement
Draw request — authorisation required
Project: Riverside Mixed-Use, Phase 2
Loan: CL-2026-0447
Draw number: 7 of 18
Period: 2026-03-01 to 2026-03-31
This draw: $650,000.00
Completed to date: $4,180,000 of $9,200,000 (45.4%)
Retainage held: $418,000
Disburse to: Meridian Construction LLC
Account: ****9023 Routing: 021000021
(unchanged from draws 1–6)
[Touch ID] Authorising this draw to this account.
→ signed by the GC's principal, countersigned by the lenderThe parenthetical on the account line does real work. A change in banking details between draws is the single highest-signal event in this process, and surfacing it at the point of authorisation costs nothing.
Who signs what
Three signatures, each answering a different question, and each from a different party's device.
| Signer | Attests |
|---|---|
| General contractor's principal | This is our request, for this amount, to this account |
| Architect or inspector | Work to this percentage has been observed |
| Lender's authorised officer | Disbursement of this amount from this facility is authorised |
An attacker would need to compromise the authenticator of each, not the mailbox of any. That is a categorically different attack.
Deploying without disrupting the schedule
Construction draws are time-sensitive — delays cascade into subcontractor payment problems and work stoppages. A control that adds days will be abandoned.
- Start with the disbursement account only. Signing one statement about where money goes is a five-minute addition and covers the highest-value field.
- Keep the existing forms. They serve architectural and lien purposes and should not be replaced.
- Flag banking changes prominently and require an extra signature when details differ from the previous draw.
- Extend to certification signatures once the disbursement step is routine.
The point of starting narrow is adoption. A contractor will tolerate one extra step per month; a rebuilt draw process will be resisted by everyone on the project.
Why the PDF proves less than it appears
| Element | Establishes |
|---|---|
| Signature image | Nothing — liftable from any prior draw |
| Notary block | The signing of a paper original, not the file that arrived |
| Amounts and percentages | Editable text in most PDFs |
| Disbursement account | Nothing — and it is the field that matters |
Objections and honest limits
“The forms serve architectural and lien purposes.” They do, and nothing here replaces them. The change is one signature on the disbursement account, alongside the existing package.
“Draws are time-sensitive.” They are, which is why the control has to add minutes rather than days. Starting with the account field only is what makes it adoptable.
A draw control that survives the schedule
- Start with the disbursement account only. Five minutes a month, covering the highest-value field.
- Keep the existing forms unchanged. They serve purposes this does not touch.
- Flag banking changes between draws prominently. The single highest-signal event in the process.
- Extend to certification signatures later. Once the first step is routine.
Terms used here
- Draw request
- A periodic request for a portion of construction loan funds, against work completed.
- Continuation sheet
- The schedule of values showing work completed by line item.
- Retainage
- Funds withheld until completion, and a figure worth rendering at approval.
Frequently asked questions
Why are construction draws a bigger target than closings? Same mechanics, larger amounts, and a dozen or more opportunities per project on a schedule an attacker can learn.
Doesn't a notarised form prevent forgery? The notary attests to a paper signing. It says nothing about the PDF that arrived by email, whose amounts and account fields remain editable.
Who needs to sign? At minimum the contractor's principal, for the disbursement account and amount. Certification and lender authorisation signatures can follow once that step is routine.
Won't this slow the draw schedule? Only if it replaces the whole process. Starting with a single signature on the disbursement account adds minutes and covers the field attackers change.
Why are draws attractive? Monthly six- or seven-figure payments on a predictable schedule, through a chain that includes parties with weak mail security.
Does a notary block help? It attests to a paper signing. It says nothing about the PDF that arrived, whose amounts and account fields remain editable.
What should be signed first? The disbursement account. It is the field attackers change and it takes minutes a month.
Where this fits in Manav
Manav renders the wire or payoff details from a statement the issuer countersigned, has the payer sign on their own device, and puts a verifiable receipt on the file for the agency, the lender and the insurer.
Sources and further reading
- AIA Contract Documents — payment application forms G702/G703
- FBI IC3 2025 Internet Crime Report
- Lender operational guidance on draw certification and retainage.
- ALTA — wire fraud prevention resources