Business Email Compromise: Protecting Singapore SME Year-End Payments

If your company pays suppliers by bank transfer in November and December, the highest-value control you can put in place this month is a callback rule: no payment to a new or changed bank account leaves your account until someone has phoned the supplier on a number from your own records, never a number or reply address taken from the email requesting the change. Business email compromise, or BEC, is the fraud where someone impersonates a supplier, a director or a colleague to redirect a payment that was always going to happen anyway. It needs no malware and no careless staff. It needs one rushed approver in a quarter where half the team is covering for someone on leave, which is a fair description of Q4 in most Singapore SMEs.

Why does business email compromise spike at year-end?

Because the conditions a scammer needs are all seasonal. Payment runs get bigger as suppliers push to close their own books. Approvers go on leave and delegate sign-off to someone who has never questioned an invoice before. Order volumes rise, so an unfamiliar purchase order looks like good news rather than a red flag. And everyone is answering email on a phone between meetings, where the sender display name is visible but the actual address is not.

The Singapore Police Force has for several years reported BEC among the scam types with the highest average loss per case precisely because it targets businesses rather than consumers. A single successful redirection commonly takes five figures, sometimes six. There is rarely a second attempt, because the first one works.

What does a real attempt actually look like?

Less dramatic than most owners expect. The three patterns that account for most losses here are:

• The supplier bank change. A genuine invoice arrives from a genuine supplier, with a polite note that they have changed banks. Sometimes the scammer has access to the supplier's real mailbox and is editing a real thread, which is why the formatting, signature and history all look correct.
• The boss on a plane. A message from the director's name, often from a lookalike domain or a free email account, asking finance to urgently settle something confidentially. The urgency and the confidentiality are the tell; both exist to stop the recipient from checking.
• The fake purchase order. Someone poses as a known corporate or government buyer, orders goods on credit terms, and has them delivered to an address that is not the buyer's. The loss is inventory and logistics rather than cash, and it hits distributors and trading firms hardest in Q4.

Which three controls stop most of it?

You do not need a security product. You need three rules written down and applied without exception, even when the person asking is the owner.

1. Verified callback on any bank detail change. Phone a number from your own supplier master file, speak to a named person, and log the date, the number dialled and who you spoke to. If the only contact number you hold came from the same email chain, you do not yet have verification.
2. Dual authorisation above a threshold. Set a figure that hurts but is not so low it paralyses the team, and require two different people to release anything above it in your corporate banking platform. The preparer and the approver must be different humans with different logins.
3. A change freeze window. Treat any bank account change received in the two weeks before a scheduled payment run as suspicious by default, and pay to the old verified account or hold the payment until the supplier confirms by phone. Legitimate suppliers are almost never harmed by a short delay. Scammers cannot afford one.

How do you harden the email account itself?

Most SMEs here run Microsoft 365 or Google Workspace, and both give you what you need in the admin console at no extra cost.

• Enforce multi-factor authentication on every mailbox, not just the owner's. Finance and sales inboxes are the ones worth stealing.
• Audit mail forwarding and inbox rules monthly. A quiet rule that forwards anything containing the word invoice to an external address, or files replies from one supplier into an unused folder, is the signature of an account that has already been compromised. Block automatic external forwarding at the tenant level unless a specific business process needs it.
• Publish SPF, DKIM and DMARC records for your domain so other companies' mail systems can reject messages that forge your name. This protects your customers from being scammed in your name, which is a reputational exposure most owners never consider.
• Turn on external sender warnings, so a message from a lookalike domain is visibly tagged even on a phone screen.

What should you do in the first hour if money has already left?

Speed matters more than accuracy of blame. Funds are sometimes recoverable if the receiving account is frozen before the money is moved on, and that window is measured in hours.

1. Call your bank's 24-hour corporate fraud line immediately and ask for a recall and for the beneficiary account to be flagged. Do this before you finish investigating internally.
2. File a police report online at police.gov.sg, and use the ScamShield Helpline on 1799 if you need guidance on what to report.
3. Preserve evidence. Do not delete the email thread, and export the full message headers before anyone tidies the mailbox.
4. Force a password reset and revoke active sessions on every mailbox involved, then check for forwarding rules created in the past 90 days.
5. Tell the real supplier. If their mailbox is the compromised one, your call may be the first they hear of it, and other customers are being targeted with the same thread.

Who owns this when the owner is away in December?

This is the part that quietly decides whether your controls hold. If sign-off authority above the dual-authorisation threshold rests only with the owner, then the moment the owner is on a flight or at a family event, the team's real choice is to break the rule or stall a payment. Both are bad. Before the December leave wave, name a second authorised approver, write down the ceiling they may approve alone, and state in one line what they must do when a request exceeds it. A control that depends on one person being reachable is not a control; it is a hope.

Frequently asked questions

Is a 10-person company really a target? Yes, and often a preferred one. Smaller firms make meaningful payments without the segregation of duties a larger finance department enforces, which is a better risk-reward trade for a scammer than a multinational with a formal vendor onboarding process.

Will cyber insurance cover a redirected payment? Sometimes, but social engineering losses are frequently excluded or capped under a separate sub-limit, and insurers may require evidence that your own verification procedure was followed. Read the fraudulent instruction wording in your policy before you rely on it.

Does moving to InvoiceNow or e-invoicing solve this? It helps considerably, because invoices arriving through the Peppol network come from a registered sender rather than an email attachment anyone can forge. It does not remove the need for the callback and dual-authorisation rules, since the payment instruction still has to be approved by a person on your side.

If you only do one thing after reading this, write the callback rule into a single paragraph, send it to whoever releases payments, and have them confirm they have read it. That paragraph is worth more between now and January than any product you could buy this quarter.