In this guide · 8 sections
Short answer
Business email compromise is a scam where criminals impersonate a supplier, client or senior staff member by email to divert payments or get money sent. SPF reports BEC losses of S$57.3 million in the first half of 2026. Phone-verify bank changes, require two approvers and protect email with MFA.
What business email compromise means
SPF's Mid-Year Scam and Cybercrime Brief 2026 describes BEC like this: through email spoofing, compromised email accounts or digital manipulation, scammers impersonate businesses (suppliers, vendors, clients) or people inside an organisation (senior executives, management, staff) and trick victims into diverting payments to fraudulent bank accounts or meeting money requests.
Three techniques sit behind most BEC emails:
| Technique | How it works | What you see |
|---|---|---|
| Spoofing | The scammer forges the From address, or registers a look-alike domain | supplier-sg.com instead of suppliersg.com, or a display name that matches |
| Compromised mailbox | The scammer logs in to a real mailbox, often a supplier's, with a stolen password | A genuine email thread from the real address, with new bank details |
| Impersonation off email | The conversation moves to WhatsApp or a call | A 'boss' asking for your personal number to continue privately |
The compromised-mailbox type is the hardest to spot, because the email really does come from your supplier's account and replies to a real conversation.
BEC in Singapore: what the 2026 figures show
According to SPF's mid-year brief, BEC scams rose sharply in the first half of 2026 even as overall scam cases and losses fell.
- Losses: up 193.1% to S$57.3 million, from S$19.5 million in the first half of 2025.
- Cases: up 67.9% to 262, from 156.
- Ranking: third-highest scam type by amount lost, after investment scams and government officials impersonation scams.
Fewer than 300 cases causing over S$57 million in losses means the average BEC case is large. That is why it matters to businesses even when consumer scams get more attention. For the related government-impersonation trend, see our guide to government official impersonation scams targeting businesses.
Common types of BEC scam
Fake supplier invoice or change of bank details
SPF calls this a prominent variant: an email apparently from a known supplier, vendor or client announces new bank details or sends an invoice with real company details (address, letterhead, signature, company stamp). The victim pays the 'updated' account and only finds out when the real supplier sends a late-payment notice. Our freight and trading invoice fraud guide covers this variant in depth for firms that pay many overseas suppliers.
CEO or boss fraud, including gift cards
Staff receive an email that appears to come from the CEO or a supervisor. SPF describes cases where scammers asked for the employee's personal mobile number to continue on WhatsApp, then asked them to buy gift cards for 'staff incentives' or 'client gifts', mostly Razer Gold cards bought in person at shops such as 7-Eleven. The employee sends the codes and only realises after checking with the real boss.
Payroll diversion
A message apparently from an employee asks HR to change the bank account for their salary. The next payroll run goes to the scammer. The control is the same as for suppliers: confirm any bank change with the person directly, using contact details you already hold.
Warning signs of a BEC email
Pause and verify if you see any of these
None of these proves a scam on its own, and a compromised supplier mailbox may show none of the domain clues. The safest habit is to treat every bank change as suspicious until verified by phone.
Three controls that stop most BEC attacks
SPF's advice to businesses is to train staff who make fund transfers, be wary of sudden transfer instructions or bank detail changes and always verify who is giving the instruction. In practice, three controls do most of the work.
Call back on a known number before any bank change
When a supplier, client or employee asks to change bank details, call them on the number in your records or their official website, never the one in the email. Write down who confirmed it and when.
Require two people to approve new payees and large transfers
Set up dual approval in your business banking for new payees and for payments above a threshold. A scammer then has to fool two people, and the second one asks questions.
Protect your own email with MFA and DMARC
Turn on multi-factor authentication for every mailbox so stolen passwords alone do not work, and publish a DMARC record so others cannot easily spoof your domain. Email filtering adds a further layer.
If the scammer used your own mailbox, follow our hacked business email guide to lock them out and check for hidden forwarding rules.
Is BEC covered by MFA alone?
MFA stops many account takeovers, but not all BEC. It does nothing if the compromised mailbox belongs to your supplier, or if the scammer uses a look-alike domain. Process controls, call-backs and dual approval, are what protect your money. Technical controls protect your reputation, by making it harder for scammers to send from your accounts or spoof your domain to your own customers.
Technical controls stop
- Logins with stolen passwords (MFA)
- Spoofing of your exact domain (DMARC)
- Many phishing emails before they arrive (filtering)
Process controls stop
- Fake bank changes from a hacked supplier
- Look-alike domains and WhatsApp follow-ups
- Gift card and urgent payment requests
Do it yourself or get help?
The call-back rule and dual approval cost nothing and can start this week: write them down, tell finance staff and set up approval in your bank's business portal. Technical controls take more set-up.
Our Email Threat Protection (S$290) tunes Microsoft Defender or Google Workspace protection, adds impersonation protection for directors and finance staff, an external sender banner and rules that catch payment-change and gift-card scams. Security Awareness Training (S$390) teaches staff, especially those who pay invoices, to spot BEC requests and follow the verification steps.
Frequently asked questions
It is a scam where a criminal pretends to be someone you trust by email, such as a supplier, client, boss or colleague, and convinces you to send money to their bank account. They use forged addresses, look-alike domains or a real mailbox they have broken into, so the email often looks normal.
The Singapore Police Force reported S$57.3 million lost to business email compromise scams in the first half of 2026, from 262 cases. That was up from S$19.5 million and 156 cases in the first half of 2025, making BEC the third-largest scam type by losses in that period.
Never act on a bank change received by email alone. Call the supplier or employee on a phone number you already have on file, not one in the email, and confirm the change. Combine this with two-person approval for new payees in your business banking, so a single person cannot be tricked into paying.
Call your bank straight away and ask them to stop or recall the transfer, then file a police report. The ScamShield Helpline 1799 can help direct you to your bank. Tell the real supplier, check whether your own mailbox was compromised, and keep all emails as evidence.
Partly. A DMARC record with an enforcing policy makes it much harder for scammers to send emails that pretend to come from your exact domain. It does not stop look-alike domains, emails from a supplier's genuinely hacked account or requests moved to WhatsApp, so process controls are still needed.