Supplier Bank Change Fraud: Securing the December Payment Run in Singapore SMEs

The single control that stops December payment-run fraud is an out-of-band callback: a supplier's bank details are never changed on the strength of an email, an attached letter of authority, or an incoming phone call, but only after someone in your finance function rings the supplier on a number already held in your master file — not the number in the request — and confirms the change with a named person. Pair that with two approvers on the payment file itself, and the two patterns that cost Singapore SMEs the most money each December, the fake bank-change email and the deepfake approval call, both fail. Everything else below is about making those two controls survive a month when half your approvers are on leave and your payment volume has tripled.

Why is the December payment run the most exposed of the year?

Because every condition a fraudster needs arrives at once. Volume is at its annual peak: you are settling supplier invoices from the 11.11 build-up, Black Friday on 27 November, and the Christmas despatch window, while simultaneously paying deposits on Chinese New Year orders because the 2027 holiday falls on 17 February and factories across China and Malaysia begin shutting from early February. A large, unusual payment to an overseas supplier — the exact shape of a fraudulent instruction — looks entirely normal in December.

People are the second condition. Leave season thins out the finance function, approvals get delegated to someone covering, and that person does not know which suppliers normally get paid what. The third is time pressure: everyone wants payments cleared before the bank cut-off on 31 December, and urgency is the lever every payment fraud pulls.

The fourth condition is the one that turns a loss into an unrecoverable loss. Reconciliation happens in January. A payment made on 18 December to the wrong account is often discovered five or six weeks later, when the real supplier chases. By then the funds have been layered through several accounts and recall is close to impossible.

What does a supplier bank-change scam actually look like?

It rarely arrives as an obvious scam. The realistic version starts with a compromised mailbox — your supplier's, not yours — where the attacker has been reading the thread for weeks. They wait for a genuine invoice to be issued, then reply inside that real thread, from either the real address or a lookalike domain differing by one character, saying the company has changed banks and attaching a new invoice with new details.

Things to treat as automatic red flags:

• Any change of bank details, ever — this is the event, not a category of event
• A reply-to address that differs from the display name, or a domain with a swapped or inserted character
• A request to pay early, or to split a payment, or to pay to a different entity name than the one on your purchase order
• An account name that is close to but not identical to the supplier's registered name
• A new account in a jurisdiction the supplier has never invoiced from
• Any reason offered for why you should not telephone — the line is down, the accounts person is on leave, the office is closed

That last one is the tell. A legitimate supplier changing banks expects to be called.

Can a deepfake approval call really get past a Singapore SME?

Yes, and the assumption that a small company is too obscure to target is no longer sound. Voice cloning now needs only a short sample, and most business owners have supplied one publicly — a webinar recording, a company video, a podcast interview, a WhatsApp voice note forwarded outside the company. The call does not need to be long or perfect. It needs to last ninety seconds and say that the transfer in the email is approved, please release it before the cut-off.

The defence is structural, not perceptual. Do not train staff to detect a fake voice; they cannot reliably do it, and it is unfair to make that their job. Instead, make authority incapable of travelling through a channel the requester controls. Approval happens inside the accounting or banking system, under a named login with multi-factor authentication — never by voice, never by WhatsApp, never by email alone. If a verbal confirmation is genuinely needed, the finance person hangs up and calls back on the number in the HR or director record. A pre-agreed challenge phrase, known to three people and written nowhere in your email system, costs nothing and defeats a cloned voice outright.

Which controls should be in place before the December run?

1. Lock the bank-detail field in your supplier master so it cannot be edited by the person who processes invoices.
2. Require a callback to a number held on file before any change is applied, performed by someone other than the person who received the request.
3. Log every callback — date, number dialled, person spoken to, who made the call. This register is what an auditor or insurer will ask for.
4. Run a changed-bank exception report before every payment batch, listing any vendor whose details changed in the last 90 days, and have a second person clear each line.
5. Check the account name against ACRA records and against the name displayed by PayNow or FAST before release. A mismatch is a stop, not a query.
6. Enforce dual approval above a stated threshold, with the two approvers named and neither able to create the payee.
7. Name your leave cover in writing, and apply the identical controls to them. Cover arrangements are where controls quietly lapse.
8. Ban approvals from personal email or messaging apps outright, with no exception for the owner.

How do you verify changes without slowing the run down?

The objection is always speed, and it is answered by scoping. Bank details change for perhaps two or three suppliers a year. If your controls only trigger on that event, they add minutes annually, not hours monthly. The delay SMEs actually experience comes from having no system of record — when supplier details live in a spreadsheet and invoices arrive as PDFs in a shared mailbox, every payment needs manual judgement, so every additional check feels expensive.

Fixing that is a Q4 automation job with a clean payback. Move supplier master data into the accounting system with a change log. Route invoices through a structured channel rather than a mailbox — InvoiceNow on the Peppol network removes the emailed PDF entirely for participating suppliers, and a document that never travels as an email attachment cannot be intercepted and edited in transit. Separate the banking token from the person who prepares the file. None of this is a large project, and all of it makes the January reconciliation faster too.

What do you do in the first hour after a wrong payment?

Speed determines recovery, so work in parallel rather than in sequence. Call your bank's fraud line immediately and request a recall on the specific transaction — do not email, do not wait for business hours. File a police report through the Singapore Police Force e-service and call the Anti-Scam Helpline on 1800 722 6688. Preserve the original email with full headers; do not delete or forward-and-delete anything. Telephone the real supplier on a known number to confirm they did not send the request and to warn them their mailbox may be compromised. Have IT check your own mailboxes for unauthorised forwarding rules, reset credentials and enforce MFA. Notify your insurer if you hold crime or cyber cover, as most policies impose short notification windows.

Then, before you touch the rest of the payment run, pull every other payment made in the same batch and re-verify any with changed details. A successful fraud is usually not a single attempt.

Frequently asked questions

Is a letter of authority on the supplier's letterhead enough to authorise a bank change?

No. Letterheads, signatures, stamps and company chops are all trivially reproduced from any previous document the attacker has read in the hijacked thread. Documentation supports the change; only a callback to an independently held number verifies it. Treat a letter of authority as the request, never as the proof.

Should the person who received the request make the verification call?

No. They already hold the fraudster's contact details and, having read a persuasive message, are primed to accept confirmation. A separate person should make the call, using the number in the supplier master rather than any number in the request, and record the outcome in the callback log. In a small team this may mean the owner makes the call — which is a reasonable use of five minutes.

If the money has already gone out, can we get it back?

Sometimes, and almost entirely as a function of how fast you move. Recall requests raised within hours, while funds are still sitting in the receiving account, do occasionally succeed. After 24 to 48 hours the money has usually been withdrawn or moved onward, and recovery becomes unlikely. Report it regardless — it supports any insurance claim and contributes to account-level intelligence — but budget for the loss rather than for the recovery.