Business email compromise invoice fraud is one of the most expensive scams a small company can fall for, because it does not look like a scam at all. There is no suspicious link and no obvious bad grammar. Instead, a familiar supplier “updates” its bank details, or the boss sends an urgent note asking finance to make a quiet transfer. The money goes out through your normal payment process, approved by your own staff, and often lands overseas within hours.
This guide focuses on how these payment scams work, the verification habits that stop them, and exactly what to do if your company has already paid. For wider protection such as passwords, backups and patching, treat this as one piece of your overall business continuity and risk planning.
How Business Email Compromise Actually Works
Business email compromise (BEC) is any scam where a criminal uses email to pose as someone your company already trusts, then redirects a payment. Most cases fall into two patterns.
Fake supplier bank change. The fraudster either breaks into a real supplier’s mailbox or registers a lookalike domain (for example, swapping a letter or adding a hyphen). They watch real conversations, wait until an invoice is due, then send a polite message: “Our bank account has changed, please pay the attached invoice to the new account.” The invoice often looks identical to previous ones because it is a copy of a real one with new bank details pasted in.
CEO or director fraud. Here the email appears to come from the owner, a director or a senior manager. It usually asks for a confidential, urgent transfer: a deposit for an acquisition, a payment to a “new partner”, or gift cards for a client event. The message stresses secrecy and speed, and often arrives when the real boss is travelling or out of the office.
Other variants include fake lawyers and payroll diversion. The pattern is always the same: a trusted identity, a change to where money goes, and pressure to skip the usual checks.
Warning Signs in Emails and Invoices
None of these signs proves fraud on its own, but any of them should trigger a pause and a call.
- A request to change bank details, especially to an account in a different name, a different bank or another country.
- Sender addresses that are almost right, or a display name that hides an unfamiliar address when you tap on it.
- “Reply-to” addresses that differ from the sender address.
- Urgency and secrecy: “please do not discuss this”, “must be done before 3pm”, “I am in a meeting, just process it”.
- A change in tone, sign-off or language compared with the person’s usual emails.
- Invoices with small changes in format, font, logo position or reference numbering.
- Requests that bypass your normal approval chain or arrive outside working hours.
A follow-up call or chat that “confirms” the change does not count if it used contact details from the suspicious email.
A Verification Process That Stops Most Losses
The single most effective control is simple: never act on a payment change using only the channel that requested it. Build these steps into a written procedure so staff are not relying on judgement under pressure.
- Keep a verified supplier master list. Record each supplier’s bank details and a known phone contact when you first onboard them, from a source other than email (a signed form, a contract, or an in-person meeting).
- Call back on a number you already hold. For any bank detail change, phone the supplier using the number in your records or on their official website, not the number in the email. Ask a specific question only the real contact would know.
- Use dual approval. Require two people to approve new payees and any change to existing payee details. Separate the person who sets up a payee from the person who releases payment.
- Add a cooling-off period. Hold the first payment to a newly changed account for a short period, or send a small test amount and confirm receipt by phone before releasing the full sum.
- Verify “boss” requests too. Agree internally that urgent transfer requests from directors are always confirmed by a call or face to face. Senior staff should praise, not punish, an employee who checks.
- Check your banking tools. Many banks offer payee name checks, transaction limits and alerts for new payees. Ask your bank which controls are available on your business account and turn them on.
Here is how a normal request compares with the high-risk version.
| Situation | Lower-risk signs | High-risk signs | What to do |
|---|---|---|---|
| Supplier invoice | Same bank account as before, expected amount | New bank account, different country or account name | Call the supplier on your stored number before paying |
| Director payment request | Goes through normal approval, has documents | Urgent, secret, sent while director is away | Confirm by phone or in person, follow normal approval |
| Employee salary change | Submitted through HR system with ID checks | Emailed request from a personal-looking address | Verify with the employee directly before changing |
| Customer refund | Refund to the original payment method | Refund to a different third-party account | Refund only to the original source unless verified |
Protecting Your Own Mailbox
BEC often starts with a stolen password. A few basics make your company a harder target, and they also protect your customers from fraudsters pretending to be you.
- Turn on multi-factor authentication for every email account, especially finance and directors.
- Watch for unknown mailbox rules that auto-forward or hide emails, a common trick after an account takeover.
- Ask your email or IT provider to set up email authentication records (SPF, DKIM and DMARC), which help stop others sending mail that looks like it came from your domain.
- Tell customers how you will communicate payment details and that you will never change your bank account by email alone. Put this line on your invoices.
If you also deal with clients over chat, apply the same rule there. A WhatsApp Business setup is convenient, but bank changes sent by message deserve the same callback check.
What to Do If You Have Already Paid
Speed matters more than anything else. Money sent to a fraudulent account is often moved on quickly, so act in this order.
- Call your bank immediately. Use the bank’s official hotline and say the payment was made to a scam account. Ask them to try to recall or stop the transfer and to contact the receiving bank. Have the date, amount, beneficiary account and transaction reference ready.
- Make a police report. You can report through the Singapore Police Force’s online services or at a neighbourhood police centre. A report number is often needed by banks and insurers. For general scam advice, the ScamShield Helpline (1799) can guide you on next steps.
- Secure the compromised account. Change passwords, reset multi-factor authentication, remove unknown forwarding rules, and check whether the breach was on your side or the supplier’s. Tell the real supplier so they can warn other customers.
- Preserve evidence. Keep the original emails with full headers, invoices, call logs and screenshots. Do not delete the scam emails.
- Notify your insurer. If you hold cyber or crime insurance, check the policy wording for notification deadlines and what is covered. Social engineering losses are sometimes excluded or need specific cover.
- Review personal data obligations. If customer or staff personal data may have been exposed, you may have duties under the Personal Data Protection Act. Check guidance from the Personal Data Protection Commission (PDPC).
Recovery is not guaranteed, and this is general information, not legal advice. For large sums or disputes over who bears the loss, speak to a lawyer.
Training Staff Without Making Them Paranoid
The goal is a calm habit, not fear. Brief anyone who touches payments, share real examples, and make “I will just call to confirm” a normal sentence in your company. Review the process at least once a year, for example during a mid-year business review, and refresh it whenever finance staff change.
Explore more: Avoiding Scams and Fraud in Singapore
Official sources: Singapore Police Force