Over $8.4 million lost by S’pore-based firm in business e-mail scam recovered by police

SINGAPORE – More than US$6.6 million ($8.4 million) that a Singapore-based commodity trading firm lost to conmen in a business e-mail scam has been recovered, the police said.

The police worked with HSBC Singapore, the United Arab Emirates Interior Ministry, the Dubai Anti-Fraud Centre and the Royal Oman Police.

The police, in a statement on May 5, said a Singapore-based commodity trading firm lodged a report on April 30, after it was duped into transferring US$6.6 million to a fraudulent bank account in Oman.

Two days earlier, the firm got an e-mail that appeared to be from one of its suppliers.

However, the domain name of the e-mail was modified, with two letters moved around in such a way that it was virtually impossible to tell apart from the supplier’s real e-mail address.

Believing that the request was authentic, the firm’s employees began the process of transferring the full payment amount to the phoney bank account on April 29, the police said.

A day later, the firm’s employees found that they had been scammed after the genuine supplier told them that they had not changed their bank account.

The Singapore police’s Anti-Scam Centre engaged the Dubai Police Anti-Fraud Centre – a Funds Recovery Operations and Networks Team (Frontier+) coalition member – to work with the Omani authorities.

The funds were traced and fully recovered.

Commercial Affairs Department director Peggy Pao said the successful operation underscores the key role of Frontier+, a coalition of Anti-Scam Centres.

Frontier+ was set up in October 2024, and is made up of anti-scam agency representatives from 11 territories including Singapore, Hong Kong, Malaysia, Thailand, Australia and Indonesia.

The police advised Singaporeans to enhance their IT security and re-engineer their payment processes to guard against business e-mail compromise scams.

Businesses must verify any new or sudden changes in payment instructions by calling their supplier or counter-party on a trusted number that is independently verified, and never rely only on contact details given in the same e-mail chain, the police added.

Employees also need to be educated – especially staff responsible for making payments on behalf of the company – on the tactics used by scammers in business e-mail compromise scams, the police said.

Businesses need to maintain strong passwords, enable two-factor authentication and install e-mail protection software that can detect fraudulent or spoofed e-mails.

Anyone who is not sure about transactions or payment instructions can call the ScamShield hotline on 1799 for advice.

Businesses that have fallen prey to such scams or have information on them should call the police hotline on 1800-255-0000 or submit information online at www.police.gov.sg/i-witness

The police can be reached at 999 for urgent assistance.