{
 "slug": "construction-loan-draw-scam-criminals-intercept-general",
 "topic_id": "TOPIC-046",
 "cluster": "Real Estate, Title & Escrow",
 "tier": "Tier B",
 "title": "Construction draws: large, repeated, and authorised by PDF",
 "summary": "A construction loan pays out in instalments against signed forms circulated by email. The forms are PDFs, the amounts are six figures, and the process repeats monthly for a year.",
 "lede": "Residential closing fraud gets the attention because a family loses their savings. Construction lending has the same mechanics, larger amounts, and a dozen opportunities per project instead of one.",
 "date": "2024-12-09",
 "category": "Vertical",
 "author_id": "constance-ibe-whitmore",
 "tags": [
  "construction lending",
  "draw requests",
  "AIA forms",
  "commercial fraud",
  "wire fraud",
  "payment authorization"
 ],
 "image_title": "Construction Draw Authorised By PDF",
 "schema": "Article",
 "key_takeaways": [
  "The draw process is repetitive and predictable, which gives an attacker many attempts and a learned template to imitate.",
  "Standard draw forms are PDFs with handwritten or image signatures, circulated by email, with no cryptographic integrity.",
  "Binding the disbursement instruction to a signature from the contractor's enrolled device moves the authorisation off email."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Why this is worse than a single closing"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Where the draw package is intercepted",
   "caption": "The attacker sits on the weakest mailbox in the chain, not the largest party.",
   "nodes": [
    {
     "label": "Contractor prepares the application",
     "note": "signed, scanned"
    },
    {
     "label": "Architect or inspector certifies",
     "note": "email",
     "bad": true
    },
    {
     "label": "Lender's administrator receives it",
     "note": "PDF",
     "bad": true
    },
    {
     "label": "Disbursement to the account in the package",
     "note": "",
     "bad": true
    }
   ]
  },
  {
   "type": "table",
   "head": [
    "Factor",
    "Residential closing",
    "Construction draw"
   ],
   "rows": [
    [
     "Frequency",
     "Once",
     "Monthly for 12–24 months"
    ],
    [
     "Amount",
     "Typically six figures",
     "Often six to seven figures per draw"
    ],
    [
     "Parties",
     "4–5",
     "Lender, GC, subs, inspector, title, architect"
    ],
    [
     "Predictability",
     "One known date",
     "A known schedule the attacker can learn"
    ],
    [
     "Familiarity",
     "Buyer has no baseline",
     "Everyone is familiar — which breeds routine"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The last row cuts both ways. Familiarity means the parties would notice a wildly wrong request, and it also means the process is handled quickly and without much scrutiny, because it happens every month."
  },
  {
   "type": "h2",
   "text": "Where the intercept happens"
  },
  {
   "type": "p",
   "html": "The draw package moves through several hands, and the attack usually sits on the weakest mailbox rather than the largest party."
  },
  {
   "type": "ol",
   "items": [
    "The general contractor prepares the application and continuation sheet, signed and scanned.",
    "It goes to the architect or inspector for certification.",
    "It reaches the lender's construction loan administrator.",
    "The lender approves and disburses, often to accounts specified in the package.",
    "Subcontractors are paid from the proceeds."
   ]
  },
  {
   "type": "p",
   "html": "Small subcontractors and independent inspectors frequently have the least mail security in the chain, and their compromise is enough. A modified continuation sheet or a substituted disbursement account propagates through a process that treats the PDF as authoritative."
  },
  {
   "type": "h2",
   "text": "What the PDF does and does not prove"
  },
  {
   "type": "p",
   "html": "A standard draw form carries an image of a signature and often a notarisation. It is a document, and documents circulated by email have no integrity."
  },
  {
   "type": "ul",
   "items": [
    "The signature image can be lifted from any previous draw",
    "Amounts and account details are editable text in most PDFs",
    "A notary block attests to the signing of a paper original, not to the file that arrived",
    "Nothing binds the form to the specific disbursement that results"
   ]
  },
  {
   "type": "p",
   "html": "The last point matters most. Even a genuinely signed form does not specify, in a tamper-evident way, which account receives the money."
  },
  {
   "type": "h2",
   "text": "Binding the disbursement"
  },
  {
   "type": "code",
   "text": "  Draw request — authorisation required\n\n  Project:      Riverside Mixed-Use, Phase 2\n  Loan:         CL-2026-0447\n  Draw number:  7 of 18\n  Period:       2026-03-01 to 2026-03-31\n\n  This draw:    $650,000.00\n  Completed to date: $4,180,000 of $9,200,000 (45.4%)\n  Retainage held: $418,000\n\n  Disburse to:  Meridian Construction LLC\n  Account:      ****9023   Routing: 021000021\n                (unchanged from draws 1–6)\n\n  [Touch ID] Authorising this draw to this account.\n\n→ signed by the GC's principal, countersigned by the lender"
  },
  {
   "type": "p",
   "html": "The parenthetical on the account line does real work. A change in banking details between draws is the single highest-signal event in this process, and surfacing it at the point of authorisation costs nothing."
  },
  {
   "type": "h2",
   "text": "Who signs what"
  },
  {
   "type": "p",
   "html": "Three signatures, each answering a different question, and each from a different party's device."
  },
  {
   "type": "table",
   "head": [
    "Signer",
    "Attests"
   ],
   "rows": [
    [
     "General contractor's principal",
     "This is our request, for this amount, to this account"
    ],
    [
     "Architect or inspector",
     "Work to this percentage has been observed"
    ],
    [
     "Lender's authorised officer",
     "Disbursement of this amount from this facility is authorised"
    ]
   ]
  },
  {
   "type": "p",
   "html": "An attacker would need to compromise the authenticator of each, not the mailbox of any. That is a categorically different attack."
  },
  {
   "type": "h2",
   "text": "Deploying without disrupting the schedule"
  },
  {
   "type": "p",
   "html": "Construction draws are time-sensitive — delays cascade into subcontractor payment problems and work stoppages. A control that adds days will be abandoned."
  },
  {
   "type": "ol",
   "items": [
    "Start with the disbursement account only. Signing one statement about where money goes is a five-minute addition and covers the highest-value field.",
    "Keep the existing forms. They serve architectural and lien purposes and should not be replaced.",
    "Flag banking changes prominently and require an extra signature when details differ from the previous draw.",
    "Extend to certification signatures once the disbursement step is routine."
   ]
  },
  {
   "type": "p",
   "html": "The point of starting narrow is adoption. A contractor will tolerate one extra step per month; a rebuilt draw process will be resisted by everyone on the project."
  },
  {
   "type": "h2",
   "text": "Why the PDF proves less than it appears"
  },
  {
   "type": "table",
   "caption": "What a standard payment application establishes",
   "head": [
    "Element",
    "Establishes"
   ],
   "rows": [
    [
     "Signature image",
     "Nothing — liftable from any prior draw"
    ],
    [
     "Notary block",
     "The signing of a paper original, not the file that arrived"
    ],
    [
     "Amounts and percentages",
     "Editable text in most PDFs"
    ],
    [
     "<strong style=\"font-weight:600\">Disbursement account</strong>",
     "<strong style=\"font-weight:600\">Nothing — and it is the field that matters</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The forms serve architectural and lien purposes.”</strong> They do, and nothing here replaces them. The change is one signature on the disbursement account, alongside the existing package."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Draws are time-sensitive.”</strong> They are, which is why the control has to add minutes rather than days. Starting with the account field only is what makes it adoptable."
  }
 ],
 "faq": [
  {
   "q": "Why are construction draws a bigger target than closings?",
   "a": "Same mechanics, larger amounts, and a dozen or more opportunities per project on a schedule an attacker can learn."
  },
  {
   "q": "Doesn't a notarised form prevent forgery?",
   "a": "The notary attests to a paper signing. It says nothing about the PDF that arrived by email, whose amounts and account fields remain editable."
  },
  {
   "q": "Who needs to sign?",
   "a": "At minimum the contractor's principal, for the disbursement account and amount. Certification and lender authorisation signatures can follow once that step is routine."
  },
  {
   "q": "Won't this slow the draw schedule?",
   "a": "Only if it replaces the whole process. Starting with a single signature on the disbursement account adds minutes and covers the field attackers change."
  },
  {
   "q": "Why are draws attractive?",
   "a": "Monthly six- or seven-figure payments on a predictable schedule, through a chain that includes parties with weak mail security."
  },
  {
   "q": "Does a notary block help?",
   "a": "It attests to a paper signing. It says nothing about the PDF that arrived, whose amounts and account fields remain editable."
  },
  {
   "q": "What should be signed first?",
   "a": "The disbursement account. It is the field attackers change and it takes minutes a month."
  }
 ],
 "sources": [
  {
   "t": "AIA Contract Documents — payment application forms G702/G703",
   "u": "https://www.aiacontracts.com/"
  },
  {
   "t": "FBI IC3 2025 Internet Crime Report",
   "u": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
  },
  {
   "t": "Lender operational guidance on draw certification and retainage."
  },
  {
   "t": "ALTA — wire fraud prevention resources",
   "u": "https://www.alta.org/business-tools/wire-fraud.cfm"
  }
 ],
 "related": [
  {
   "slug": "real-estate-wire-fraud-title-escrow-payoff-diversion",
   "title": "Why closing wires remain the easiest large theft",
   "category": "Vertical"
  },
  {
   "slug": "commercial-lease-deposit-scam-cybercriminals-exploit-triple",
   "title": "The commercial lease deposit scam",
   "category": "Vertical"
  },
  {
   "slug": "cash-out-refinance-attack-fraudsters-spoof-mortgage",
   "title": "Spoofed mortgage payoff demands",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Construction%20Draw%20Authorised%20By%20PDF/1500_900/blog.jpg",
 "wordcount": 907,
 "url": "/blog/construction-loan-draw-scam-criminals-intercept-general.html",
 "reading_time": "4 min read",
 "meta_description": "A construction loan pays out against signed PDFs circulated by email. The amounts are six figures and the process repeats monthly for a year.",
 "hub": {
  "slug": "topics/title-and-escrow",
  "title": "Title, escrow and closing wires"
 },
 "answer": "Same mechanics, larger amounts, and a dozen opportunities per project on a schedule an attacker can learn. A closing happens once; a construction loan pays out monthly for a year or more against signed PDFs circulated by email through a chain that includes small subcontractors.",
 "answer_q": "Why are construction draws a bigger target than closings?",
 "glossary": [
  {
   "term": "Draw request",
   "def": "A periodic request for a portion of construction loan funds, against work completed."
  },
  {
   "term": "Continuation sheet",
   "def": "The schedule of values showing work completed by line item."
  },
  {
   "term": "Retainage",
   "def": "Funds withheld until completion, and a figure worth rendering at approval."
  }
 ],
 "checklist": {
  "title": "A draw control that survives the schedule",
  "id": "draw",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Start with the disbursement account only.",
    "text": "Five minutes a month, covering the highest-value field."
   },
   {
    "name": "Keep the existing forms unchanged.",
    "text": "They serve purposes this does not touch."
   },
   {
    "name": "Flag banking changes between draws prominently.",
    "text": "The single highest-signal event in the process."
   },
   {
    "name": "Extend to certification signatures later.",
    "text": "Once the first step is routine."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav renders the wire or payoff details from a statement the issuer countersigned, has the payer sign on their own device, and puts a verifiable receipt on the file for the agency, the lender and the insurer.",
  "href": "../docs.html",
  "label": "See wire confirmation"
 }
}