Your supplier emails to say their bank account has changed. Your managing director messages you on Teams asking for an urgent transfer before the end of the day. Both look genuine. Either one could cost your company hundreds of thousands of dollars.
These are business email compromise (BEC) scams, and they are growing in Singapore even as other scams decline. This article explains how they work, the requests that should make you stop, the checks every payment should pass, and what to do in the first hour if money has already left your account.
The Short Answer: Verify Before You Pay
Treat any request to change payment details, or to pay urgently outside your normal process, as unverified until someone confirms it by phone. Call a number you already hold in your own records, never the one in the email. Add a second approver before money moves. If you have already paid, call your bank immediately to request a recall, then report to the police.
What Is Business Email Compromise?
Business email compromise is a fraud where criminals impersonate a supplier, client, senior executive or colleague, usually through spoofed or hacked email, to trick someone into paying money into an account the criminals control. The Singapore Police Force (SPF) describes the common targets as payments to suppliers, vendors and clients, and requests that appear to come from senior management or staff.
Many cases involve no break-in to your systems at all. A lookalike email address and a believable story are enough, because the person who presses the transfer button could be you or your own employee.
Business Email Compromise in Singapore: The 2026 Numbers
SPF released its mid-year scam figures on 26 August 2026. Overall scam cases and losses fell, but BEC moved the other way.
| Measure | H1 2025 | H1 2026 | Change |
|---|---|---|---|
| BEC cases reported | 156 | 262 | +67.9% |
| BEC amount lost | S$19.5 million | S$57.3 million | +193.1% |
| All scam cases | 19,644 | 16,821 | -14.4% |
| All scam losses | S$500.2 million | S$410.6 million | -17.9% |
BEC ranked third among all scam types by amount lost in the first half of 2026, behind investment scams and government officials impersonation scams. By our calculation from SPF’s figures, the average BEC case cost roughly S$219,000, compared with roughly S$24,400 for the average scam case overall. That makes a typical BEC case about nine times costlier.
SPF also notes that about 80.8% of reported scams involved self-effected transfers, where victims were manipulated into paying rather than having their accounts taken over. In other words, the weak point is the decision to pay, not the bank’s security.
Seven Requests That Should Make You Stop
Finance teams see many legitimate changes and urgent requests. These seven patterns deserve extra checking every time.
| Request | What the scammer does | What to do |
|---|---|---|
| "We have changed our bank account" | Sends an email that looks like it is from a known supplier. SPF reports fake invoices that carry real company addresses, letterheads, signatures and even company stamps. | Call the supplier on a number from your records. Hold the payment until confirmed. |
| "Please pay this invoice today" | Creates time pressure so you skip normal checks. | Match the invoice to the purchase order and delivery. Urgency is a reason to slow down. |
| Executive asks for a confidential transfer | Impersonates a CEO or chairman by email, WhatsApp or Teams and says "do it now". | Call the executive on a known number. Do not confirm in the same chat. |
| "Skip the usual approval" | Asks you to bypass procedures or keep the request private. | No exceptions. Escalate to a second approver. |
| Gift card purchase | Posing as your boss, asks you to buy gift cards for staff or clients and send the codes. SPF reports these were mostly Razer Gold cards bought in person at physical stores. | Never buy gift cards on a chat or email instruction. Confirm face to face or by phone. |
| "Message me on my personal number" | Moves the conversation to WhatsApp so the scam continues outside company systems. | Treat as a red flag. Keep business instructions on official channels and verify. |
| Unexpected login page or attachment | Harvests email credentials to take over a real mailbox. | Do not enter credentials. Report to your IT provider. |
Three Real Singapore Cases
Case 1: Two swapped letters, USD 6.6 million (April 2026)
Staff at a Singapore commodity trading firm received an email that appeared to come from a legitimate supplier. The sender’s domain had two letters transposed, which made it almost impossible to spot. The staff transferred the full USD 6.6 million to an account in Oman on 29 April. The next day, the genuine supplier said it had never changed its bank account.
The company reported the same day. The Anti-Scam Centre worked with HSBC Singapore and authorities in the UAE and Oman, and the money was fully recovered.
Lesson: a lookalike domain defeats the eye test, and reporting within hours made recovery possible.
Case 2: A “chairman” on WhatsApp, USD 36.3 million (April 2026)
The CEO of a Singapore company received a WhatsApp call from someone posing as the chairman of the firm’s headquarters, who told him to take charge of an acquisition project. The CEO asked his CFO to arrange funding. Between 13 and 17 April, USD 36.3 million moved from the group’s overseas and Singapore accounts into two local accounts. The fraud surfaced when the CEO checked with the real chairman.
Police seized USD 9.7 million locally. About USD 26.5 million had already been wired to Hong Kong, where authorities later seized more than USD 11.1 million. Two Singaporeans were arrested for helping to open the corporate bank account that received the funds.
Lesson: this was not an email attack at all, and recovery was only partial.
Case 3: The CFO saved by a signature (September 2026)
As reported by The Straits Times, scammers posing as a healthcare company’s chairman and managing director asked the CFO on Microsoft Teams to send financial statements, then to transfer S$120,000. She realised something was wrong only after speaking to the real managing director. The loss was avoided because the company required payment slips to be signed physically before any transfer.
Lesson: a simple, boring control beat a convincing impersonation.
How Scammers Get In
Spoofed and lookalike addresses
Criminals register a domain that differs from the real one by a single character or a swapped pair, or they fake the display name. Always expand the full sender address and compare it letter by letter with earlier genuine emails.
Compromised mailboxes
SPF lists compromised email accounts as a common method. When a real mailbox is taken over, the request arrives from the genuine address, sometimes inside an existing email thread. A familiar address is therefore not proof that the request is real.
Messaging, voice and video impersonation
UOB’s head of group compliance has warned that scammers increasingly use messaging, voice and video channels, including AI-enabled impersonation, to pose as trusted executives. A voice on a call or a face on a video is no longer enough. You should start the verification call yourself, using a number you already trust.
What To Do When a Payment Request Arrives
Use these seven steps for any new bank account, changed bank account, or urgent or unusual payment instruction.
- Pause. Do not reply, click links or open attachments in the message.
- Check the sender. Read the full email address and domain letter by letter against previous genuine emails.
- Name the red flags. Is it a new account, a time limit, secrecy, or a request to skip approval?
- Call back on a trusted number. Use the contract, your supplier records or a previous invoice you know is genuine. Never use contact details in the same email or chat.
- Confirm the details. Ask the other party to read out the bank name and account number, then check that the account name matches the company.
- Get a second approver. A different person should review the request and the verification before payment.
- Record the check. Note who you called, which number, and when, on the payment file. If anything still feels wrong, call the 24/7 ScamShield Helpline at 1799 for advice.
Payment Controls Checklist for SMEs and Finance Teams
Awareness training helps, but controls matter more. On a busy Friday afternoon, a message that sounds like the managing director will beat awareness every time. Controls take the decision away from one person under pressure.
| Control | What to put in place | Why it helps |
|---|---|---|
| Callback verification | A written rule that every new or changed bank detail is confirmed by phone on a known number. | Defeats spoofed and hijacked email. |
| Dual approval | Two people approve payments above a set amount, including dual authorisation in your internet banking. | No single person can release funds alone. |
| Restricted vendor master data | Only named staff can edit supplier bank details in your accounting software. Every change is logged and reviewed by a second person. | Fraudulent changes are caught before the payment run. |
| Segregation of duties | The person who adds or edits suppliers is not the person who approves or releases payments. | Removes the single point of failure. |
| Pre-payment change report | Before each payment run, review all supplier bank detail changes since the last run. | Catches changes slipped in quietly. |
| Executive request rule | No payment instruction is accepted from email, chat, WhatsApp or Teams alone, however senior the sender. | Protects staff from authority pressure. |
| Email security | Two-factor authentication on every mailbox, strong passwords, and email protection that flags spoofed messages. | Reduces mailbox takeover. |
| Bank limits and alerts | Set transfer limits and alerts with your bank and ask it to verify large or unusual instructions. | Adds a bank-side check. |
| Practice drills | Run a simulated fake invoice or executive request each quarter. | Builds the habit of verifying. |
If you use cloud accounting software, check that user roles, approval workflows and audit trails are switched on and used. A shared admin login removes the audit trail that would show who changed a supplier’s bank account, and when.
If You Have Already Paid: The First 60 Minutes
Speed decides whether money can be recovered. In Case 1 above, the report was made within a day and the funds were still traceable. In Case 2, money had already moved on to Hong Kong and only part could be seized.
- Call your bank immediately and ask for a recall of the funds. Have the date, amount and beneficiary account details ready. SPF’s standing advice to affected businesses is to do this first.
- Report to the police. Call the Police Hotline on 1800-255-0000 or submit details at www.police.gov.sg/i-witness. Dial 999 if you need urgent police assistance.
- Preserve evidence. Keep the original emails with full headers, invoices, chat logs, call records and bank advice. Do not delete anything.
- Secure your accounts. Change passwords on affected mailboxes, switch on two-factor authentication, and ask your IT provider to check for unfamiliar logins and mail forwarding rules.
- Call the real counterparty on a verified number. They may be impersonated too, and they need to know the payment did not reach them.
- Review what failed. Work out which step of verification was skipped, then update your process and brief your team.
Next Step: Review How Payments Are Approved in Your Business
A convincing email should never be able to move money on one person’s say-so. If you would like a second pair of eyes on your payment approval workflow or want your finance team trained to handle these requests, 361 Degree Consultancy can help.
Call us on 6515 7906 or email enquiry@361dc.com.
Frequently Asked Questions
It is a scam where criminals pose as a supplier, client, executive or colleague, often through spoofed or hacked email, to get your business to send money to an account they control.
Call the supplier on a phone number from your own records, not from the email. Confirm the new account details verbally and have a second person approve the change before any payment is made.
Sometimes. Recovery depends on how fast you act and whether the funds are still in the receiving account. SPF's Anti-Scam Centre froze or recovered more than S$97.7 million across all scam types in H1 2026, but SPF notes this refers to funds frozen in scammers' or mules' accounts, not money already returned to victims. Contact your bank and the police immediately.
If you have not paid, the 24/7 ScamShield Helpline on 1799 can help you check. If you have paid, call your bank first, then the Police Hotline on 1800-255-0000 or report at www.police.gov.sg/i-witness. Dial 999 for urgent police assistance.
Not by itself. Email accounts can be compromised, so the message may come from the genuine address. Verify any payment instruction through a separate channel, such as a call you initiate.
Phishing mainly tries to steal credentials or card details. BEC aims to redirect a payment by impersonating someone you trust. The two can be linked, because stolen email credentials can be used to take over a mailbox and send convincing requests.
Make the business owner or a director the second approver or involve your external accountant. The second person should check the verification record for any changed bank details, not just the amount.
Sources
- Singapore Police Force, Mid-Year Scam and Cybercrime Brief 2026 (26 August 2026)
- Singapore Police Force news release, International Cooperation Leads To The Recovery Of Over USD 6.6 Million From Business Email Compromise Scam (5 May 2026)
- Singapore Police Force news release, Operation FRONTIER+ III: Joint Two-Month Crackdown On Transnational Scams (20 May 2026)
- Malay Mail, Singapore company CFO nearly loses S$120,000 after scammers impersonate bosses on Teams (19 September 2026), citing The Straits Times
