Freight and Trading Firms: Stopping Invoice Fraud and Bank Scams

Why freight and trading firms are targeted

Criminals pick industries where large payments are routine and verification is hard. Logistics and trading tick every box:

• Overseas counterparties: agents, carriers and suppliers in many countries, often with changing staff and banks.
• Time pressure: cargo held at port, demurrage charges and release deadlines push people to pay first and check later.
• Long email threads: a criminal who joins a real thread about a real shipment looks completely legitimate.
• Shared mailboxes: ops@ and accounts@ boxes with several users and weak passwords are easy to break into.
• Documents everywhere: invoices, bills of lading and debit notes are PDFs that are easy to copy and edit.

The government's ScamShield site reports scam losses in the hundreds of millions of dollars a year in Singapore. For a trading firm, one wrong transfer can be worth a whole shipment.

The two patterns: lookalike domains and hacked mailboxes

Either way, the email typically says the supplier's bank has changed due to an 'audit', 'tax issue' or 'account under review', and asks you to pay the next invoice to a new account, often in another country. Our guide on spotting phishing emails covers the general warning signs.

A payment verification protocol for finance teams

Technology helps, but the control that actually stops this fraud is a simple rule followed every time. Write it down, train it, and make it safe for junior staff to delay a payment.

1. 1

   Freeze on any bank change

   Any new payee or change of bank details stops the payment. No exceptions for urgency, seniority or 'the cargo will be held'.

2. 2

   Call back on a known number

   Phone the supplier using a number from your vendor master file, a past contract or their official website, never from the email or invoice in question.

3. 3

   Ask a question only they would know

   Confirm a recent invoice number or amount. Note who you spoke to, the time and the number you called.

4. 4

   Second person approves

   A different person updates the vendor master file and another approves the first payment to the new account.

5. 5

   Send a test or partial payment for big amounts

   For a new overseas account, a small payment confirmed by phone before the full amount lowers the risk.

6. 6

   Watch for 'change of plan' emails

   A last-minute request to pay a different entity, use a personal account or split a payment is a red flag in itself.

Email settings that make BEC harder

These settings protect your own domain and mailboxes. They also make your firm a harder target than the one next door.

Microsoft's guide to configuring DMARC explains the policy levels: p=none takes no action, p=quarantine marks or junks failing mail, and p=reject asks receivers to reject it. Start at p=none with reports, fix legitimate senders, then move up. Our guide to SPF, DKIM and DMARC has the steps. Phishing-resistant sign-in such as passkeys also blocks the relay phishing kits that steal sessions.

Audit mailbox rules and sign-ins

A hacked mailbox almost always has rules the user did not create. Check finance, ops and director mailboxes monthly, and immediately after any suspicious payment request.

In Microsoft 365, admins can review rules in the Exchange admin centre or with PowerShell, and sign-ins in the Entra admin centre. In Google Workspace, use the Admin console's audit and investigation tools. If you find signs of compromise, follow our guide on what to do when business email is hacked.

If you already paid: who to call in Singapore

Speed matters more than anything else. Banks can sometimes stop or recall a transfer if they hear within hours.

• Your bank, first: call its anti-scam or fraud hotline, give the transaction details and ask it to contact the receiving bank.
• Police report: file a report with the Singapore Police Force and keep the report number for your bank and insurer.
• ScamShield: call the ScamShield Helpline on 1799 if you are unsure whether something is a scam.
• SingCERT: CSA's SingCERT handles cybersecurity incidents and can be reached at singcert@csa.gov.sg.
• Your supplier or customer: warn them by phone; their mailbox may be the one compromised.
• Your insurer: check whether your cyber or crime policy covers social engineering fraud, and notify within its deadline.

If the attacker accessed personal data in your mailbox, also consider your PDPA breach assessment duties. This is general guidance, not legal advice.

Do it yourself or get help?

The payment verification protocol costs nothing and can start tomorrow. The email settings need an admin who knows Microsoft 365 or Google Workspace well, because a wrong DMARC or forwarding setting can block legitimate mail.

Our Email Threat Protection (S$290) tightens filtering, impersonation protection and external tags. Microsoft 365 / Google Security Lockdown (S$590) adds MFA, admin protection and forwarding controls, and Security Awareness Training (S$390) trains finance and ops staff on bank-change scams.