Accurate as of 27 October 2026. Scam figures are from the Singapore Police Force (SPF) Mid-Year Scam and Cybercrime Brief 2026, published on 26 August 2026, and SPF news releases dated 5 and 20 May 2026. Averages per case are our own calculation from SPF totals.
TL;DR
Business email compromise (BEC) scams in Singapore rose 67.9% to 262 cases in the first half of 2026, and losses rose 193.1% to S$57.3 million. That works out to about S$219,000 per case, while the median loss across all scams was S$1,350.
The most common version is simple: an email that looks like it comes from a regular supplier says its bank account has changed. SPF counted at least 66 such cases and S$19 million lost between 1 January and 20 May 2026 alone.
Spam filters won’t save you. A rule will: no supplier bank details change on the strength of an email. Call back on a number you already hold, have a second person approve, and log it.
Paying by PayNow to the supplier’s UEN adds a free name check, because your bank shows the account name before you confirm.
If money has already gone, call your bank within the hour to ask for a recall, then make a police report. Speed is what made a US$6.6 million recovery possible this year.
Two letters, three days, US$6.6 million
On 28 April 2026, staff at a Singapore commodity trading firm got an email from one of their suppliers. It appeared to come from that supplier. The only giveaway was in the sender’s domain, where two letters had been swapped. On a phone screen, almost nobody would notice.
The email said the supplier’s bank account had changed. The next day, the firm sent US$6.6 million to the “new” account, in Oman. On 30 April, the real supplier got in touch. It had never changed its bank account.
This story ended well. SPF’s Anti-Scam Centre worked with HSBC Singapore and police in Dubai and Oman, and the full amount was recovered. Most businesses don’t get that ending.
If you approve or make supplier payments, this is the scam worth 20 minutes of your time this week.
What is a supplier bank-detail change scam?
A supplier bank-detail change scam is a type of business email compromise (BEC). A fraudster either breaks into a real email account or uses a lookalike address to pose as your supplier, a colleague or your boss, then asks you to pay into a “new” bank account. The invoice is often genuine. Only the account number is not.
SPF describes two main routes in its 20 May 2026 advisory:
Spoofed or lookalike addresses. The email comes from a domain that is almost right, like the two swapped letters above.
Compromised mailboxes. The criminal is inside the supplier’s real email account. The message comes from the correct address and often replies inside a real conversation thread. This is why checking the sender’s address is not enough on its own.
SPF’s mid-year brief adds that some victims received fraudulent invoices carrying the real company’s address, letterhead, signature and even company stamp. A second variant targets staff directly: an email “from the boss” asks someone to buy gift cards for clients or staff and send the codes.
How big is the problem in Singapore?
Scams overall fell in the first half of 2026. Business email compromise went the other way.
Measure (SPF, reported cases) | 1H 2025 | 1H 2026 | Change |
|---|---|---|---|
BEC cases reported | 156 | 262 | +67.9% |
BEC losses | S$19.5 million | S$57.3 million | +193.1% |
Average loss per BEC case (our calculation) | About S$125,000 | About S$219,000 | +75% |
All scam cases | 19,644 | 16,821 | −14.4% |
All scam losses | About S$500.2 million | About S$410.6 million | −17.9% |
Source: SPF Mid-Year Scam and Cybercrime Brief 2026. Average loss per case is total losses divided by cases.
Three things stand out:
BEC was the third-largest scam type by money lost in Singapore in the first half of 2026, behind only investment scams and government official impersonation scams.
69.5% of all scam cases involved less than S$5,000. The average BEC case cost about S$219,000. Criminals target businesses because one email can move a year’s profit.
It is a global trend. Microsoft counted about 10.7 million BEC attacks in the first quarter of 2026, most of them opening with a harmless-looking question before any request for money.
Why the next few months carry extra risk
Three things are lining up between now and Chinese New Year.
Payment details are changing everywhere. Banks will not accept SGD corporate cheques from 1 January 2027. Thousands of businesses are emailing customers and suppliers with bank and PayNow details right now. A “please update our bank details” email has never looked more normal. (Our corporate cheques checklist covers the switch itself.)
Payment runs get bigger and approvers get busier. Year-end bills, bonuses and pre-holiday settlements mean larger batches, more people on leave, and more pressure to push payments through before the office closes. “Urgent, please pay before the holidays” fits right in.
The emails are better written. AI tools now help criminals write fluent, personalised messages at scale. Forbes reported in September 2026 on a campaign Microsoft found that sent over a million targeted emails in three days, each one naming real finance staff and executives. Spotting bad grammar is no longer a defence.
How the scam works, step by step
Get in. The criminal steals an email password through a phishing link, at your supplier or at your company, or registers a domain one or two characters away from the real one.
Watch. Inside a compromised mailbox, they read quietly for days or weeks: which customers pay, how much, when, and who approves.
Time it. The bank-change email arrives just before a payment is due, often as a reply in a real thread, sometimes with the genuine invoice attached.
Add pressure. There is a reason (“our bank is under audit”, “the old account is frozen”) and a deadline. Sometimes there is a line like “I’m travelling, please just email.”
Collect. You pay the right amount for a real invoice, to the wrong account. Money is moved on quickly, often overseas.
Get found out, late. According to SPF, most victims only realise when the real supplier sends an overdue reminder, or when they finally check directly. By then, weeks may have passed.
9 red flags in a bank-change request
SPF puts it plainly: requests to change a vendor’s bank details are generally uncommon, so treat every one as a red flag until it is verified. These are the signs that should stop a payment:
# | Red flag | What to do |
|---|---|---|
1 | Bank details change announced by email only | Call back on a number from your own records |
2 | The request lands just before a payment run or a large payment | Treat the timing as a warning, not a coincidence |
3 | The domain is almost right: swapped letters, an extra hyphen, .co instead of .com.sg | Compare it letter by letter with an old email from the same supplier |
4 | The new account is overseas, or with a bank the supplier has never used | Ask why, on a call you initiate |
5 | The account name doesn’t match the supplier’s registered company name | Stop. A real supplier is paid into an account in its own name |
6 | You are asked to keep it confidential or skip the usual process | The usual process exists for exactly this moment |
7 | A new phone number is given in the email, or the sender “can’t take calls” | Never use contact details from the request itself |
8 | The reply-to address differs from the sender address | Check the reply-to field, not just the “From” name |
9 | A boss or colleague asks for gift cards or a transfer by WhatsApp | Confirm in person or on a number you know |
The 7-step Bank Change Check
The most effective control costs nothing: a rule that no supplier bank details are changed on the strength of an email, ever. The seven steps below turn that rule into a routine a two-person finance team can run in about 15 minutes. Feel free to share it or link to it.
Freeze. Don’t update the supplier record and don’t pay into the new account yet. Put any payment due to that supplier on hold. Don’t reply to the email to “check”, because you may be talking to the criminal.
Call back on a number you already hold. Use the number on your contract, an old invoice, or the supplier’s website, which you open yourself. Never use a number in the request. Ask for someone you have dealt with before.
Let them tell you. Ask your contact to read out the new bank, account number and account name. Don’t read the details to them, or a criminal on the line can simply agree.
Check the name. The account name must match the supplier’s registered company name. If the supplier uses PayNow Corporate, paying to its UEN shows you the name your bank holds (more on this below).
Use a second pair of eyes. A different person approves the change in your system from the person who received the request. Ideally, the person who edits supplier records is not the person who releases payments.
Confirm the first payment. After the first payment to the new account, call your known contact to confirm it arrived before you release anything else.
Log it and tell the supplier. Record what came in, how you verified it and who approved it (use the form below). Then email the supplier’s known address to confirm the change. A genuine supplier will immediately spot a change it never asked for.
Copy this: Supplier Bank Change Verification Form
Print it, paste it into your procedures, or keep it as a template in your shared drive. Every bank-detail change should have one completed form before the record is updated.
Field | Fill in |
|---|---|
Supplier name and UEN | |
Date and time request received | |
How it arrived (email, letter, call) and the exact sender address | |
Old bank and last 4 digits of old account | |
New bank, account number and account name (as read out by the supplier) | |
Reason given for the change | |
Number called, where that number came from, person spoken to, date and time | |
Account name matches registered company name? (Yes / No) | |
Request received by (name) | |
Change approved by (a different person) | |
First payment confirmed received by supplier (date, by whom) | |
Supplier notified of the change via known contact (date) |
Pay to the UEN, not just an account number
PayNow Corporate lets a business receive payments to its Unique Entity Number (UEN). When you pay to a UEN, your bank shows the recipient’s registered display name before you confirm. For a company, UOB explains that this display name is the account name from the bank’s own records.
That matters because anyone can type any name on an invoice. The name your banking app shows comes from the bank. If it isn’t your supplier’s registered name, stop the payment.
Two limits to know. It only works if your supplier has registered PayNow Corporate, and some large or overseas payments will still go by account number. For those, the callback in step 2 is your main defence.
It works both ways. Put your own PayNow UEN on your invoices, and add one line to your invoice footer: “Our bank details will never change by email. If you receive such a request, call us.” Your customers are targets too.
Where InvoiceNow helps, and where it doesn’t
InvoiceNow is Singapore’s nationwide e-invoicing network, built on the international Peppol standard. IMDA describes it as UEN-based, in the same way PayNow is. Invoices travel between accredited Access Points as structured data, straight from the supplier’s system into yours, instead of as a PDF in someone’s inbox. (New to it? Start with what InvoiceNow is and how it works.)
Risk | Emailed PDF invoice | InvoiceNow invoice |
|---|---|---|
A lookalike email domain sends a fake invoice | Lands in your inbox looking real | Can’t arrive that way. An InvoiceNow invoice has to come from a business registered on the network |
Bank details edited on the invoice | Easy. A PDF can be altered in minutes | Harder. The data comes from the supplier’s system, not a file someone can edit on the way |
The supplier’s own email or system is compromised | Exposed | Still exposed. InvoiceNow can’t stop someone who controls the supplier’s own system |
A separate “we’ve changed banks” email | Exposed | Still exposed. That request still arrives by email or phone |
Do you still need the 7-step check? | Yes | Yes |
The honest summary: InvoiceNow removes the easiest route, the fake PDF from a lookalike address, and cuts down how much invoice traffic sits in email at all. It doesn’t replace the phone call. The more of your suppliers send through InvoiceNow, the easier it is to notice the one email that doesn’t fit. Our guide on supplier invoices under GST InvoiceNow covers the purchase side in more detail.
Lock down your own email so you’re not the one being used
If your mailbox is compromised, criminals can use it to redirect your customers’ payments. SPF and the Cyber Security Agency of Singapore (CSA) recommend a short list:
Turn on two-factor authentication (2FA) for every email account, especially finance, sales and directors.
Set up DMARC on your company domain, which makes it much harder for anyone to send email pretending to be you. CSA has a plain-English DMARC guide.
Check mailbox rules and forwarding every few months. A rule you didn’t create, forwarding or hiding emails with “invoice” or “payment” in them, is a classic sign of a break-in.
Keep systems and software patched, and train new staff and interns. SPF singles out people who update payment details or make transfers.
Paid the wrong account? What to do in the first hour
Speed matters more than anything else here. In the US$6.6 million case, the money went out on 29 April and the firm reported it on 30 April, which gave investigators time to trace and freeze it across three countries.
Call your bank immediately. Ask it to recall the payment and contact the receiving bank. Have the date, amount and beneficiary details ready.
Make a police report. File online through SPF’s e-services or at a police centre. For information, the Police Hotline is 1800-255-0000. If you need urgent help, dial 999. For advice on whether something is a scam, the ScamShield Helpline is 1799.
Call the real supplier on a number you already hold. Their mailbox may be compromised, and other customers may be at risk.
Secure your own email. Change passwords, sign out all sessions, turn on 2FA and check forwarding rules.
Keep the evidence. Don’t delete anything. Save the emails (with full headers if your IT support can export them), the invoice and the bank confirmation.
Check other recent changes. Review every supplier record changed in the last few months, not just this one.
A sobering note on recovery SPF’s Anti-Scam Centre froze more than S$97.7 million of scam proceeds in the first half of 2026. SPF is careful to say that frozen funds are not the same as money returned to victims. Prevention is far cheaper than recovery. |
How AveriWorks helps you control supplier payments
Software won’t make the phone call for you. What it can do is keep supplier records, bills and payments in one place, with clear limits on who can change what, so the 7-step check is easier to follow every time.
Free on Starter: unlimited InvoiceNow, including an InvoiceNow Inbox, so suppliers on the network send bills as data into your books rather than as PDFs in someone’s email. Supplier records, supplier invoices, cash payments and the AP aging report sit in one ledger, and two-factor authentication is available on every plan.
Business: adds role-based access control with three roles, so the person who records supplier bills doesn’t also need the right to change supplier details or pay them, plus authentication logs that show who signed in and when.
Enterprise: adds multi-tier approval workflows, action logs that record who changed what, and bank statement import, so what left your bank can be matched against approved bills.
Get your supplier bills out of email Set up AveriWorks Starter for free, ask your regular suppliers for their Peppol IDs, and start receiving their invoices through InvoiceNow. Start free at averiworks.com or compare plans. |
Frequently asked questions
What is business email compromise (BEC)?
BEC is a scam where criminals use a hacked or lookalike email account to pose as a supplier, customer, colleague or boss, and trick a business into sending money or information. In Singapore, the most common version is a fake request to update a supplier’s bank details.
How do I verify a supplier’s new bank account details?
Don’t act on the email. Call the supplier on a number you already hold, ask them to read out the new details, check the account name matches their registered company name, have a second person approve the change, and confirm the first payment arrived before paying more.
Is a letter on company letterhead enough to confirm a bank change?
No. SPF has seen fraudulent invoices that carry the real company’s address, letterhead, signature and company stamp. Treat documents as supporting evidence only. The callback to a known number is what verifies the change.
Can we get our money back after paying a scammer?
Sometimes, if you act fast. Call your bank straight away to request a recall, then make a police report. A Singapore firm recovered US$6.6 million in May 2026 after reporting the day after paying, but recovery is never guaranteed.
Does InvoiceNow stop invoice fraud?
It reduces it. InvoiceNow invoices come from businesses registered on the network as structured data, so a fake PDF from a lookalike email address can’t arrive that way. It can’t stop a criminal who controls the supplier’s own systems, or a separate bank-change email, so you still need a callback.
Do we still owe the real supplier if we paid a fake account?
Often, yes, because the real supplier never received the money. Who bears the loss depends on the facts and your contracts, so speak to a lawyer early.
How often do suppliers really change bank accounts?
Rarely. SPF describes vendor bank-detail changes as generally uncommon, which is why every request deserves a pause and a phone call.
Sources
Singapore Police Force: Mid-Year Scam and Cybercrime Brief 2026 (PDF), 26 August 2026 (BEC cases and losses, overall scam figures, scam variants, funds frozen)
SPF: Police advisory on BEC scams involving requests to update vendors’ payment account details, 20 May 2026 (66 cases and S$19 million since 1 January 2026, recommended measures)
SPF: International cooperation leads to the recovery of over USD 6.6 million from BEC scam, 5 May 2026 (the transposed-domain case and timeline)
UOB: PayNow Corporate (display name for corporate payees)
UOB: Cheques and cashier’s orders (corporate cheques not accepted from 1 January 2027)
IMDA: InvoiceNow FAQs (PDF) (InvoiceNow as UEN-based e-invoicing on Peppol)
Microsoft Security: Email threat landscape, Q1 2026 trends and insights, 30 April 2026
Forbes: Business email compromise, how AI is transforming an old scam, 20 September 2026
ScamShield (helpline 1799)
AveriWorks pricing (plan contents and prices as listed on 27 October 2026)
This article is accurate as of 27 October 2026. Scam statistics are SPF figures for reported cases and may be revised in later releases. Average losses per case are our own calculation from SPF totals. Product features and prices are as listed on averiworks.com on 27 October 2026 and may change. This article is general information, not legal, financial or cybersecurity advice. If you suspect a scam, contact your bank and the police immediately.