In this guide · 8 sections
- 01Why business accounts need more of your own protection
- 02The settings to enable in business internet banking
- 03Set it up in an afternoon: step by step
- 04The payment-change check that stops invoice fraud
- 05Leavers, shared tokens and the kill switch
- 06If you think you've been scammed: the first hour
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Set up two-person approval (maker-checker) for payments, transaction limits per user, alerts for every payment and admin change, and remove leavers' access the day they go. Verify any change to a supplier's bank details by calling a number you already have, not one in the email.
Why business accounts need more of your own protection
Since December 2024, the Guidelines on the Shared Responsibility Framework (SRF) set out when banks and telcos share losses from phishing scams. The SRF only protects a "protected account": one held by individuals, opened with the bank's retail unit or not usable for business transactions. A company current account falls outside it.
Banks also added safeguards that apply more widely. The Association of Banks in Singapore announced that from 15 October 2025 major retail banks would hold or reject transactions when an account with at least S$50,000 is being emptied quickly, defined as more than 50% of the balance leaving within 24 hours. That catches the worst cases, but a scam that takes 20% of your balance, or tricks staff into paying a fake supplier, will not trigger it.
The settings to enable in business internet banking
DBS IDEAL, OCBC Velocity and UOB Infinity all let an administrator set roles, approvals and limits. The names differ; the controls are the same. DBS, for example, describes approval groups set up by an IDEAL administrator, and says the number of approvers needed can vary by payment type.
| Control | What it does | Suggested setting for a small business |
|---|---|---|
| Maker-checker (dual approval) | One user creates a payment, a different user approves it | Required for all payments above a low threshold, and for every new payee |
| User roles | Separates who can view, create, approve and administer | Admin rights for one or two directors only; bookkeepers create, owners approve |
| Transaction limits | Caps per payment and per day, per user | Well below your usual balance; raise temporarily for payroll if needed |
| Payee management | Who can add new beneficiaries | Adding a payee needs approval by a second person |
| Alerts | SMS or email on payments, new payees, user and limit changes | On for every transaction and every admin change, to two people |
| Token or app authentication | Second factor for login and approvals | One token per person; never shared |
Maker-checker feels like overkill in a three-person company. It is the single control that turns a stolen login or a convincing phone call into a failed attempt, because the scammer needs to fool two people.
Set it up in an afternoon: step by step
Work with whoever is the administrator on your business banking profile. Some changes need a form or a call to the bank.
List every user with access
Export or screenshot the user list. Remove anyone who has left, and anyone who no longer needs access.
Separate the roles
Give admin rights to one or two directors. Give staff who prepare payments a maker role without approval rights.
Require a second approver
Set the approval policy so payments above your threshold, and all new payees, need a different person to approve.
Set limits per user
Set per-transaction and daily limits that match each person's job, not the account's maximum.
Turn on alerts to two people
Payment, payee and user-change alerts to the owner and a second director, so one compromised phone isn't enough to hide activity.
Save the bank's fraud line
Put the bank's official number in every approver's phone now, from the bank's website or the back of the card, not from an email.
If you also use Corppass for government services, apply the same idea there: separate admins, remove leavers, review quarterly. Our Corppass roles guide covers it.
The payment-change check that stops invoice fraud
The most common business payment scam does not touch your bank login at all. A scammer, often using a hacked or look-alike email address, sends a genuine-looking invoice or a message saying a supplier's bank details have changed. Staff pay it in good faith.
Supplier bank detail change checklist
Our guide to spotting phishing emails shows the signs of a spoofed or look-alike sender, and our law firm payment fraud guide covers the same scam in a high-value setting.
If you think you've been scammed: the first hour
Speed matters more than anything else once money has left.
- Call your bank's official fraud hotline immediately and ask them to try to recall or freeze the payment.
- Block online banking access for any user whose login may be compromised.
- Make a police report, and keep the transaction details, emails and messages.
- If you are unsure whether something is a scam, call the 24/7 ScamShield Helpline at 1799.
- If an email account was used in the scam, secure it before anything else, as the scammer may still be reading it.
Do it yourself or get help?
The banking settings are yours to change and take an afternoon with your bank's admin guide or relationship manager. The harder part is making the verification habit stick among staff who pay invoices, especially under time pressure.
Our Security Awareness Training (S$390) covers invoice and payment-change fraud, impersonation calls and phishing for the people who handle money, with a written payment verification procedure you can keep. It does not replace your bank's own advice or its fraud team.
Frequently asked questions
No. The SRF guidelines define a protected account as one held by individuals, opened with the bank's retail unit or not usable for business transactions. A company account used for business falls outside it, so the SRF's loss-sharing rules for phishing scams do not apply. Your own controls and your bank's terms matter more.
It is a two-person rule. One user creates or keys in a payment and a different user reviews and approves it before the bank sends it. Business internet banking platforms let an administrator require this for some or all payment types, and for adding new payees.
Call your bank's official fraud hotline straight away. Some banks also offer self-service blocking; OCBC, for example, describes a Block my access temporarily option on the Velocity login page and a Block Access option in its business app. Check your own bank's security page so you know where it is before you need it.
Do not pay to the new details yet. Call the supplier on a number you already have on file, not one in the email, and confirm the change with someone you know. Record who confirmed it and when. Have a second person approve the first payment to the new account.
Sometimes, if you act fast. Call your bank immediately so it can contact the receiving bank, and make a police report. If the funds have already been moved on, recovery is unlikely, and because staff authorised the payment, the bank is not usually obliged to refund it.