In this guide · 8 sections
- 01The headline numbers for January to June 2026
- 02Business email compromise: the scam that grew
- 03Other scam trends that hit small businesses
- 04Changes in 2026 that affect how you pay and log in
- 05Map each trend to a control
- 06If your business has been scammed
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
In the first half of 2026, Singapore recorded 16,821 scam cases and about S$410.6 million lost, both down on 2025. Business email compromise bucked the trend: cases rose 67.9% to 262 and losses rose 193.1% to S$57.3 million.
The headline numbers for January to June 2026
All figures below come from the SPF Mid-Year Scam and Cybercrime Brief 2026 (PDF, published August 2026). They compare the first half of 2026 with the first half of 2025.
| Measure | 1H 2025 | 1H 2026 | Change |
|---|---|---|---|
| Scam and cybercrime cases | 22,397 | 18,391 | -17.9% |
| Scam cases | 19,644 | 16,821 | -14.4% |
| Amount lost to scams | about S$500.2M | about S$410.6M | -17.9% |
| Median loss per case | S$1,682 | S$1,350 | -19.8% |
| Scams where the victim made the transfer | 78.8% | 80.8% | +2.0 points |
The overall direction is good news. The SPF credits measures such as directives to Apple, Google and Meta, the disruption of 37,500 WhatsApp lines and 52,200 malicious websites, and more than 2,900 money mules and scammers investigated. Still, scams made up 91.5% of all scam and cybercrime cases, and online platforms were the first point of contact in 89.0% of them.
Business email compromise: the scam that grew
Business email compromise (BEC) is when a scammer impersonates a supplier, client or your own boss by email, usually to redirect a payment. The SPF brief describes the main variants: a 'new bank account' notice from a known supplier, a fake invoice with real letterhead and company stamp, and an email from the 'CEO' asking a staff member to buy gift cards.
| Business email compromise | 1H 2025 | 1H 2026 | Change |
|---|---|---|---|
| Cases reported | 156 | 262 | +67.9% |
| Amount lost | S$19.5M | S$57.3M | +193.1% |
| Average loss per case (our calculation) | about S$125,000 | about S$219,000 | Up |
BEC was third by amount lost, behind investment scams and government officials impersonation. By average loss per case it is far ahead of every scam type in the brief's top 10 table, where the highest is investment scams at S$75,267. For a small business, one successful BEC email can wipe out a year's profit.
Other scam trends that hit small businesses
Most of the top 10 scam types target individuals, but several land on businesses through their staff, customers or brand.
- Phishing: 3,104 cases and S$9.6 million lost, both down sharply from 1H 2025. The SPF highlights fake courier messages via Apple iMessage that steal card details and OTPs.
- Social media impersonation: cases rose 47.9% to 587. Of these, 391 involved scammers messaging the contacts of a hijacked WhatsApp account and asking for an urgent loan or transfer.
- E-commerce scams: the most common type, up 19.3% to 3,865 cases. These mostly hit buyers on Carousell and Telegram, but they damage trust in any small online seller.
- Government officials impersonation: S$90.8 million lost, down 31.7%. Scammers posed first as firms such as Singtel or Prudential, then passed victims to fake MAS, MinLaw or police officers.
- Job scams: 2,247 cases. The brief flags 'social media boosting' tasks, where victims are paid to like or follow posts, accounts or online merchants.
Meta's three platforms (Facebook, WhatsApp and Instagram) together accounted for 34.1% of all scam cases by platform. If your business runs a WhatsApp number or Facebook page, it is part of that attack surface. Our guide to a hacked business WhatsApp, Facebook or Instagram covers recovery and how to warn customers.
Changes in 2026 that affect how you pay and log in
The brief also lists anti-scam measures introduced this year. A few change day-to-day processes for SMEs:
- PayNow nicknames for retail customers were discontinued on 6 June 2026, so a nickname can no longer be used to pass off a scammer's account as a business. Check the name and UEN shown before confirming any PayNow transfer.
- Singpass passkeys became available from 1 July 2026 as a password-free login that resists phishing. Encourage directors and anyone with Corppass roles to switch.
- Bank call notifications: major retail banks now push an in-app alert when they call you, so you can check a call is genuine.
- New Codes of Practice for messaging, social media and e-commerce services were issued on 17 August 2026 under the Online Criminal Harms Act.
Map each trend to a control
Statistics are only useful if they change what you do on Monday. Here is how the 1H 2026 trends map to practical controls for a team of 5 to 50.
| Trend in the SPF brief | Control that addresses it | Effort |
|---|---|---|
| BEC losses up 193% | Call-back rule for bank detail changes; two people approve new payees | One policy, one bank setting |
| BEC via compromised mailboxes | MFA on every mailbox; alerts for new forwarding rules | An afternoon |
| BEC via spoofed domains | SPF, DKIM and DMARC on your domain | 1 to 2 hours plus monitoring |
| WhatsApp takeovers | Two-step verification PIN on every business WhatsApp | 5 minutes per phone |
| Phishing for card details and OTPs | Short staff training; report-phish button | 30 minutes a quarter |
| Self-effected transfers at 80.8% | Pause-and-verify rule for any urgent payment request | Free |
Our MFA set-up guide covers Microsoft 365 and Google Workspace step by step, and how to spot a phishing email is a ready-made briefing for staff. If an account has already been taken over, the business email hacked guide has the first-hour steps.
If your business has been scammed
Speed matters most when money has moved. The SPF's Anti-Scam Centre froze more than S$97.7 million of scam funds in 1H 2026, which is only possible when reports arrive quickly.
Call your bank's fraud line immediately
Ask them to stop or recall the transfer and freeze the beneficiary account if possible.
Lodge a police report
File online through police e-services with dates, amounts, bank details and copies of the emails or messages.
Secure the account the scam came through
Reset the password, sign out all sessions, turn on MFA and remove unknown forwarding rules or linked devices.
Warn customers and suppliers
If your name was used, tell them which bank details are genuine and how you will confirm any change.
Check for unsure messages with ScamShield
Staff can call the ScamShield Helpline on 1799 to check whether something is a scam.
Do it yourself or get help?
The cheapest controls on this page cost nothing: a call-back rule for bank details, a two-person approval for new payees, and a WhatsApp two-step PIN. Write them down and tell your finance staff this week.
For the rest, Security Awareness Training (S$390) gives your team a short, Singapore-specific session on BEC, phishing and WhatsApp takeovers with a one-page policy. Email Threat Protection (S$290) sets up filtering, impersonation protection and forwarding-rule alerts on Microsoft 365 or Google Workspace.
Frequently asked questions
According to the SPF Mid-Year Scam and Cybercrime Brief 2026, there were 16,821 scam cases from January to June 2026, down 14.4% from 19,644 in the same period of 2025. About S$410.6 million was lost, down 17.9% from about S$500.2 million.
Business email compromise. In the first half of 2026 it caused S$57.3 million in losses across 262 cases, an average of roughly S$219,000 per case. Scammers impersonate suppliers, clients or senior staff by email and trick businesses into paying fraudulent bank accounts.
By number of cases, e-commerce scams were the most common in the first half of 2026, with 3,865 cases, followed by phishing, investment, job and government officials impersonation scams. By amount lost, investment scams were highest at S$169.8 million.
The Singapore Police Force publishes a mid-year and an annual scam and cybercrime brief on police.gov.sg, usually as a PDF with an infographic. The mid-year brief for 2026 covers January to June 2026 and was published in August 2026.
Use a call-back rule: never change a supplier's bank details based on an email alone, and confirm by phone using a number you already have. Add two-person approval for new payees, turn on MFA for every mailbox, and set up SPF, DKIM and DMARC on your domain.