In this guide · 8 sections
- 01Why accounting firms are a target
- 02The controls that matter most
- 03Stopping invoice fraud and fake payment instructions
- 04Sharing files with clients: portals vs email attachments
- 05Corppass, Bizfile and client filing access
- 06PDPA, client trust and the Cyber Essentials mark
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Start with MFA on every mailbox, email protection against impersonation, a call-back rule for any change in bank details, and client files shared through access-controlled folders instead of attachments. Then tidy Corppass and Bizfile access and consider the CSA Cyber Essentials mark as proof for clients.
Why accounting firms are a target
Three things make accounting and corporate secretarial (corpsec) firms attractive to attackers:
- Concentrated client data. One mailbox can hold payroll files, NRIC and passport copies, bank statements and tax computations for many companies.
- Trusted payment relationships. Clients are used to receiving invoices and payment instructions from you, so a fake one from your real mailbox is very convincing.
- Filing authority. Staff act for clients in IRAS myTax Portal through Corppass and in ACRA's Bizfile. Misused access can change company records or submit returns.
Business email compromise (BEC) is the scam that targets exactly this. The Singapore Police Force's Mid-Year Scam and Cybercrime Brief 2026 reported 262 BEC cases in the first half of 2026, up 67.9%, with losses up 193.1% to S$57.3 million. Our summary of the first-half 2026 scam statistics explains what that means for SMEs.
The controls that matter most
You don't need an enterprise security stack. Most incidents at small firms trace back to a handful of gaps.
| Control | What it stops | Effort |
|---|---|---|
| MFA on every email and cloud account | Stolen passwords being used to log in | Low |
| Email impersonation protection and external-sender warnings | Lookalike domains and fake director or partner emails | Low to medium |
| Call-back rule for bank detail changes | Fake supplier or client payment instructions | Low |
| Separate admin accounts and two global admins | One compromised user taking over the whole tenant | Low |
| Device encryption and screen lock | Client data exposed from a lost laptop or phone | Medium |
| Managed antivirus and automatic updates | Malware and known software flaws | Medium |
| Backups of mailboxes and files, tested | Ransomware or accidental deletion | Medium |
Our guide to setting up MFA for business accounts covers the first row step by step for Microsoft 365 and Google Workspace.
Stopping invoice fraud and fake payment instructions
BEC works because it looks like normal business. A practical defence combines technology with a rule everyone follows.
Write a call-back rule
Any new or changed bank account, for a supplier, a client refund or a payroll payee, is confirmed by phone using a number already on file. Never use the number in the email.
Require two people for large payments
One person prepares, another approves in the bank portal. Set a threshold that fits your firm.
Turn on impersonation protection
Protect the names of partners, directors and finance staff so emails from lookalike addresses are flagged or quarantined.
Add an external-sender banner
A visible warning on emails from outside the firm makes a fake "internal" request easier to spot.
Tell clients how you will contact them
Put a line in engagement letters and email signatures: we will never change our bank details by email.
Corppass, Bizfile and client filing access
Your firm's ability to act for clients is itself an asset to protect.
Filing access checklist
Our guide to Corppass setup and roles explains Third Party Authorisation and the Preparer and Approver roles. Registered corporate service providers also have AML/CFT duties under ACRA's CSP requirements, which means holding client due diligence records that need the same protection as tax files.
PDPA, client trust and the Cyber Essentials mark
Under the PDPA, your firm must make reasonable security arrangements to protect the personal data it holds, including clients' employees' payroll and ID details. PDPC publishes its enforcement decisions, a useful record of the security gaps it has found at other organisations. Maximum penalties are S$1 million or 10% of Singapore turnover for larger organisations.
Clients increasingly ask suppliers how they protect data. The CSA Cyber Essentials mark is Singapore's baseline certification for SMEs and gives independent evidence that the basics are in place. CSA funding from S$250 for first-time certification is available until 6 February 2028. Our Cyber Essentials checklist covers the five requirement areas and costs.
Do it yourself or get help?
A firm with an IT-minded partner can switch on MFA, external banners and a call-back rule in a week. The harder parts are keeping it all on as staff join and leave, and producing evidence when a client or assessor asks.
If you would rather hand it over, Email Threat Protection (S$290) sets up impersonation protection, safe links and payment-change rules in Microsoft 365 or Google Workspace. Protect Standard (S$19 per user a month) keeps settings, devices, antivirus and the password manager in order every month. CSA Cyber Essentials Readiness (from S$990) gets you assessment-ready with an evidence pack.
Frequently asked questions
Business email compromise. Criminals take over or imitate a mailbox and send fake invoices or bank detail changes to clients or the firm. SPF reported BEC losses in Singapore rose to S$57.3 million in the first half of 2026. MFA, impersonation protection and a phone call-back rule for bank changes stop most of it.
It is common but risky, because copies stay in both mailboxes indefinitely and are exposed if either is breached or the email goes to the wrong person. Share them through a client folder or portal limited to named contacts, and remove access when the engagement ends.
It is not mandatory, but it gives clients and tender panels independent evidence that baseline controls are in place. It suits firms that hold client payroll and ID data. CSA funding from S$250 for first-time certification is available until 6 February 2028.
Through Corppass Third Party Authorisation. The client's Corppass Admin authorises your firm for specific IRAS services and roles, and your own Corppass Admin assigns them to your staff. Never use a client director's Singpass, and remove access promptly when staff or engagements end.
Tell the client to contact their bank immediately to try to recall the payment and to make a police report. Secure your mailbox by resetting the password, signing out all sessions and removing suspicious rules. Assess whether personal data was exposed, because a notifiable breach must be reported to PDPC.