At Least $19 Million Lost to Business Payment Redirection Scams Since January

What Are Business Payment Redirection Scams?

Business payment redirection scams — also known as business email compromise (BEC) scams or invoice fraud — are a growing threat to companies in Singapore. Since January 2026, at least 66 cases have been reported, with victims losing a staggering $19 million.

In these scams, criminals impersonate a company's colleagues or business vendors using spoofed email addresses or by compromising the vendors' actual email accounts. They then instruct the victim to change the vendor's bank account details on record, redirecting future payments to fraudulent accounts instead.

How the Scam Works

The typical attack follows a well-rehearsed pattern:

1. Email impersonation: Scammers send emails that appear to come from a trusted vendor or colleague. They may use a spoofed email address that looks almost identical to the real one, or they may have gained access to the actual email account.
2. Request for change: The email informs the victim that the vendor's bank account details have changed — often with a plausible explanation such as a bank merger, system upgrade, or change of finance provider.
3. New payment instructions: The scammer provides "new" bank account details and requests that upcoming payments be directed there.
4. Delayed discovery: Victims typically realise they have been scammed only after the vendor confirms they never received payment, or when the victim clarifies the transaction directly with the vendor.

Warning Signs to Watch For

The Singapore Police Force has highlighted several red flags that businesses should treat as warning signs:

• Unusual requests to change bank account details. Changes to vendor payment information are uncommon and should always be treated with suspicion.
• Subtle differences in email domains. Scammers often use domains that closely resemble legitimate ones but contain subtle differences such as misspellings, extra characters, or different top-level domains (e.g., @vendor-company.com vs @vendor-company.com.sg).
• Urgency or pressure to act quickly. Scammers may claim the matter is urgent to prevent the victim from taking time to verify.
• Emails sent outside normal business hours. Fraudulent emails may arrive at unusual times, especially if the scammer is operating from a different time zone.
• Requests to keep the change confidential. Scammers may ask the recipient not to inform others to avoid detection.

How to Protect Your Business

Businesses can take several practical steps to reduce the risk of falling victim to payment redirection scams:

1. Verify Through a Separate Channel

Always verify requests to change bank account details through a different communication channel — such as a phone call to a known number — before making any changes. Do not use the contact details provided in the suspicious email.

2. Double-Check Email Addresses

Carefully examine the sender's email domain. Look for subtle misspellings, extra characters, or unfamiliar domain extensions. When in doubt, contact the sender through a known, trusted channel.

3. Educate Your Staff

Ensure all employees — especially new hires, interns, and staff responsible for updating payment details or making fund transfers — are aware of these scams and know how to respond. Regular training and awareness sessions can significantly reduce risk.

4. Implement Verification Procedures

Establish a clear internal process for verifying any changes to payment instructions. This should include:

• Mandatory verbal confirmation for any bank account changes
• Dual-authorisation for fund transfers above a certain threshold
• A register of verified vendor contact details that is kept up to date

5. Secure Your Email Systems

Protect your own email accounts from being compromised by:

• Using strong, unique passwords
• Enabling two-factor authentication (2FA)
• Installing email protection software
• Being vigilant against phishing attempts targeting your own staff

What to Do If You Have Been Scammed

If your business has fallen victim to a payment redirection scam, act quickly:

1. Contact your bank immediately to report the fraudulent transaction and request a recall of the funds.
2. File a police report by calling the Police hotline on 1800-255-0000 or submitting information online at www.police.gov.sg/i-witness.
3. Call the ScamShield hotline on 1799 for advice and assistance.
4. Preserve all evidence — including emails, transaction records, and any communication with the scammer.
5. Notify your vendors and business partners so they can take precautions if their accounts were impersonated.

Key Statistics

Stay Vigilant

With at least $19 million lost in just a few months, business payment redirection scams represent one of the most financially damaging scam types targeting Singapore businesses. The sophistication of these attacks continues to evolve, making vigilance and robust verification procedures essential.

Remember: If you receive an unexpected request to change a vendor's bank account details, stop, verify, and confirm through a separate channel before taking any action. A few minutes of verification can save your business hundreds of thousands of dollars.

For more information and advice, call the ScamShield hotline on 1799 or visit www.scam.sg.