Before changing a supplier’s bank account, approving an unusual company payment or entering your work password through a link, independently verify the request using a trusted contact channel—not the phone number, web link or reply address supplied in the suspicious message. This single control can help prevent phishing and Business Email Compromise (BEC) scams affecting Singapore companies. An email can look authentic because attackers spoof a domain, compromise a real mailbox or copy an existing invoice and signature.

The practical response at a Punggol workplace is pause the transaction → identify what changed → verify using a separately known channel → follow approved dual controls → protect work accounts → report anything suspicious promptly. A junior accounts assistant, a retail manager, a service provider or a Punggol Digital District employee can encounter these scams. A sophisticated IT environment does not remove the need for a trustworthy human payment process.

The Singapore Police Force’s 20 May 2026 advisory reported at least 66 BEC cases involving vendor bank-detail changes since 1 January 2026, with at least S$19 million in losses by that advisory date. Those figures describe the reported period, not an October-year-end total. Singapore’s Cyber Security Agency (CSA) provides phishing and incident-reporting guidance, while the Police handle suspected crimes.

The one-minute phishing and BEC checklist

Message or event	Why it deserves verification	Safer action
Supplier emails new bank details	Common 2026 BEC mechanism	Call established supplier contact using a verified stored number
CEO demands urgent secret transfer	Executive impersonation pattern	Independently verify and follow authorised payment workflow
Manager asks an intern to buy gift cards	Published 2026 BEC variant	Stop; confirm through genuine internal channels
Shared document demands password reset	Possible credential phishing	Open the organisation’s normal service directly
One-time password arrives unexpectedly	Possible login attempt or account takeover	Never share code; investigate through approved security team
A sender address differs by one letter	Lookalike domain or spoofing	Examine full address and verify separately
Real vendor email thread contains new payment request	Compromised genuine inbox remains possible	Out-of-band check, not reply to the same thread
Invoice asks for payment outside normal account	Possible account substitution	Require controlled vendor-master-data change
An employee clicks a suspicious attachment	Malware or data exposure may follow	Inform IT/security promptly, do not hide it
Login alerts show unfamiliar devices	Possible account compromise	Secure sessions and recovery factors
Staff files exposed to third party	Confidentiality and PDPA risk	Contain, assess and follow incident response
Staff unsure whether it is a scam	Genuine doubt merits support	Use ScamShield 1799 and approved internal channels

The official anchors are CSA’s phishing reporting guide, Police’s vendor-payment advisory, and ScamShield’s 2026 guidance.

One-sentence definition: what is phishing?

Phishing is a form of digital impersonation or deception designed to make someone reveal sensitive information, transfer funds, open malicious content or carry out another harmful action.

It can arrive through email, messaging apps, websites, QR codes or apparently authentic notifications. The scammer may pretend to be a bank, government agency, supplier, employer, manager or technology provider.

An email is not safe merely because it has no obvious spelling mistake. Modern fraud can use polished writing, convincing logos, authentic-looking signatures and information drawn from genuine commercial relationships.

Phishing is a method, not a particular brand of software. The worker needs to identify the unusual request and its evidence, not only the visual appearance of the message.

CSA’s Report a Phishing Email guide explains what attackers want and how reports help SingCERT take action against harmful addresses or websites.

One-sentence definition: what is Business Email Compromise?

Business Email Compromise occurs when criminals impersonate a business contact or gain access to a real email account to deceive someone into misdirecting payments, revealing sensitive records or obeying another fraudulent instruction.

BEC can occur even when there is no malicious attachment. A simple message saying “our supplier’s payment account has changed” can be enough to divert a very large transfer if the business relies only on email.

The Police’s May 2026 advisory identifies two major forms: spoofed or lookalike sender addresses and compromised legitimate vendor mailboxes.

A genuine sender address appearing in a long-running conversation therefore does not automatically prove that a new bank instruction is authorised. A criminal may already be inside the account.

The critical defence is to use a verification channel that does not depend on the compromised or spoofed conversation.

Why this is a practical Punggol employment question

Punggol contains small shops, food services, education-related providers, offices, contractors, businesses at Punggol Digital District and service organisations. Most can have legitimate invoices, payroll, supplier orders or customer records.

The same type of fraudulent email can affect a business owner working from an HDB flat and a large technology organisation. The absolute potential exposure differs, but the risk mechanism can be identical: a worker receives a familiar-looking message and is asked to take a payment or login action.

The Cyber Security Agency of Singapore lists an office at 92 Punggol Way, within Punggol Digital District. This places a national cybersecurity agency in the area’s industry environment, but does not mean every resident should visit its office to report a scam. CSA directs cybersecurity incidents through its official SingCERT reporting routes.

Punggol’s connection to digital industries is a reason to learn the subject, not proof that local companies experience higher or lower attack rates than other towns.

Cybersecurity depends on how each actual employer manages information, systems and people.

A payment request can be fraudulent without malware

Some employees think cybersecurity begins only when someone downloads an infected file. BEC often works through ordinary business language and a forged account-change request, with no special software involved.

A company may have a proper invoice, an actual supplier relationship and a correct payment amount. The only altered detail may be the destination bank account.

If the finance team trusts the message, the transfer can reach criminals even though the payment approval software is functioning exactly as designed.

This is why payment process controls matter alongside antivirus tools. A business should require independent verification before changing supplier payment instructions, and appropriate review of material transactions.

A security product cannot fix a workflow whose policy says that any convincing email authorises a new payee.

The 2026 supplier-bank-detail scam, step by step

Police describe a pattern in which criminals impersonate a supplier or compromise its email account, then send apparently legitimate instructions that future invoice payments should go to a new bank account.

An employee sees a name, invoice reference or email thread they recognise. They may update the company’s vendor record and pay the next bill to the new account.

The real supplier later asks why payment has not arrived. Only then does the business discover that the bank account was not genuine.

The fix is not to accuse every supplier of dishonesty. A bank change can be legitimate; it simply needs verification through a pre-existing trusted number or another authorised independent channel, not through the new details supplied in the questionable email.

Ask for the supplier’s identity and change request to be confirmed under the company’s proper vendor-maintenance procedure. Record who verified and approved it.

A major real case illustrates how little a domain change can cost

On 5 May 2026, the Singapore Police reported international cooperation that recovered more than US$6.6 million connected to a BEC scam against a Singapore-based trading firm.

The Police said the victim company’s staff received an email appearing to come from a legitimate supplier, but the attacker had subtly altered the domain by transposing two letters. The fraud caused a transfer to an unauthorised overseas account before the genuine supplier clarified that its details had not changed.

This event demonstrates that a professional-looking message can contain one almost invisible substitution. It also illustrates why a single large payment deserves an independent check even if the amount and commercial relationship are real.

The successful recovery in that case is not a promise that every stolen transfer can be reversed. The best control is verification before payment, supported by prompt reporting if an incident occurs.

Do not copy private email addresses or case details into a public article; the official Police account is sufficient to establish the mechanism.

The supplier contact number must come from somewhere independent

Suppose a message says “our bank account changed; call this new number to confirm.” Calling that number may simply put the worker in contact with the scammer who wrote the email.

A safer option is a verified number already recorded in the company’s supplier master file, a reliable previously established contract contact or another independently authenticated official channel.

If the normal vendor representative has left, obtain the new authorised contact through the organisation’s verified route and record the change with appropriate approvals.

Do not use a phone number copied from a newly received PDF attachment as the sole authentication factor. A forged invoice can contain a forged number.

The principle is independence. A check controlled entirely by the suspicious message cannot reliably verify the suspicious message.

Worked example: a fictional invoice change at a Punggol shop

Imagine a fictional Punggol retailer owes an approved supplier S$8,400 for delivered merchandise. The supplier’s usual bank account is already in the company’s records.

An email claiming to be from the supplier asks for the S$8,400 to be transferred to a new account due to an “audit migration”. The attached invoice has an authentic-looking logo, reference number and ordinary item list.

A careful accounts worker should not change the bank details solely on that email. They contact the supplier using the number from the original verified agreement, ask for the appropriate authorised person and confirm whether a change was genuinely requested.

If the supplier denies the change, the worker stops payment, preserves relevant evidence and informs the organisation’s security or finance lead. The company may report the attempt through the proper channels.

This invented example illustrates the control. It is not a current Punggol supplier complaint or an actual financial loss.

Executive impersonation uses hierarchy as pressure

A scammer may impersonate the CEO, finance director, supervisor or project leader and ask a worker to make an urgent secret payment. The message can insist that nobody else should know because the task involves a confidential acquisition, legal matter or project.

The pressure is psychological: employees may worry that asking for verification looks disrespectful or will delay an important executive task.

The Police’s February 2026 executive-impersonation advisory describes this method on messaging apps.

A responsible company should establish that verification of unusual transactions is required regardless of the supposed sender’s seniority. A real CEO should expect a finance colleague to follow the company’s controlled approval process.

Trustworthy procedures protect leaders as much as junior staff. Do not create a culture where every message marked “CEO urgent” overrides normal security checks.

A gift-card request is not routine procurement

The Police’s 28 January 2026 advisory warned about impersonated managers instructing workers to buy gift cards for supposedly urgent company purposes.

The scammer could ask an employee or intern to use personal money and promise later reimbursement, then request card redemption codes. Once sent, those codes can be used by the criminal.

At least 25 cases involving S$30,000 or more in losses had been reported since the beginning of 2026 at the time of that January advisory. The number is date-specific, not a year-end estimate.

A worker should verify unusual purchase requests through legitimate workplace channels and avoid sharing gift card redemption codes or personal banking access based on a chat message.

If the organisation genuinely needs to buy gift cards for a campaign, it can use its normal authorised purchasing process rather than an unexplained secret request to one junior employee.

New employees and interns need explicit instructions

A new worker may be unfamiliar with the employer’s authorised bank details, normal procurement steps or the style of genuine executive messages. Scammers exploit that uncertainty.

The Police’s May advisory specifically recommends training new staff, interns, procurement and payroll employees on the bank-change scam. The January gift-card advisory similarly identifies juniors as a group worth briefing.

An induction should explain which person can approve a purchase, who maintains vendor bank details, what contact channel is trusted and where to report a suspicious message without fear of embarrassment.

Do not expect an intern to infer security policy from general instructions to “be professional”. A written process can reduce hesitation and prevent pressure from forged messages.

A positive security culture rewards careful verification rather than glorifying people who process every payment as fast as possible.

Phishing can steal passwords even when no payment is requested

A worker may receive a message that a Microsoft, Google, banking or internal HR password will expire. A link opens a convincing but fraudulent sign-in page.

Entering a username, password and possibly a one-time code can give the attacker a way to compromise an account or intercept a session, depending on the method and technical controls.

The CSA phishing guide recommends checking sender details and being cautious with unexpected links or attachments. ScamShield’s May 2026 advice warns against sharing sensitive credentials through unsolicited messages.

The safer habit is to open the established company login or service directly through a trusted bookmark or approved application, rather than following the link in an unexpected notice.

An authentic-looking page is not proof that the domain and session are genuine.

How to inspect an email without assuming grammar will reveal the scam

Look beyond typos. Check the actual sender domain, whether reply-to details differ, the context of the request, any unexpected bank change and whether the payment process is being bypassed.

A sender name can display “Finance Director” while the actual address belongs to an unrelated domain. Lookalike domains can differ by one character or use extra words that are easy to overlook.

But a genuine compromised mailbox may display the correct domain, so domain inspection alone is insufficient. Independent process verification remains essential.

Do not click potentially dangerous links merely to investigate where they lead. A trained IT or security team can inspect suspicious content using appropriate tools.

The goal is not for every office worker to become a forensic specialist. It is to recognise a risk and route it to the right trained person.

An apparent reply in an old supplier thread can still be forged

An employee may trust an email because it appears below months of genuine communications. Attackers can obtain access to a mailbox or manipulate conversation context.

If the message changes bank instructions or asks for sensitive information that would ordinarily require special authorisation, stop and verify outside the same thread.

Replying “Are you sure?” may simply ask the attacker to confirm their own fraud. A phone number in the suspicious signature may also be controlled by the attacker.

The Police’s vendor-payment advisory explicitly recommends a different communication medium for unusual bank account changes.

A business should teach this even to experienced staff, because familiarity with a real supplier relationship can make a fraudulent alteration feel more convincing.

Protect work accounts with strong authentication

The Police recommend strong passphrases, two-factor or multi-factor authentication and current software security measures to reduce the chances of account compromise.

Use unique work credentials under the company’s approved password policy, preferably with an authorised password manager if available. Reusing one password across personal and business accounts increases exposure when another service is breached.

Do not disclose one-time passwords, authentication recovery codes or push-notification approvals to someone claiming to be IT support without verifying the request.

If a login approval appears when the worker did not initiate sign-in, treat it as suspicious and follow the security escalation route.

Authentication controls do not replace payment verification; they reduce one route through which criminals gain access to genuine mailboxes.

A password change is not enough after every account compromise

Depending on the incident, an attacker may already have created unauthorised email forwarding rules, persistent sessions or alternate recovery methods.

A September 2026 Police advisory described compromised email accounts being used to search messages and create inbox rules that hide relevant notifications.

If a work account is suspected to be compromised, contact the organisation’s IT/security team promptly. An appropriate administrator may need to revoke sessions, check sign-in activity, remove unauthorised rules and recovery methods, reset credentials and inspect related systems.

An ordinary worker should not attempt unauthorised digital investigation or delete evidence that responders may need. Follow the company’s response instructions.

The corrective action should be based on the actual technical situation, not an internet checklist applied blindly without access or permission.

Email authentication helps but does not solve everything

The Police’s BEC advisory recommends that businesses consider Domain-based Message Authentication, Reporting and Conformance (DMARC) to reduce spoofing of their email domain.

DMARC works with relevant email authentication mechanisms and domain policies. It is a technical configuration that an authorised administrator or competent IT provider should implement and monitor, not a random setting for staff to change on personal devices.

The CSA DMARC information resources help organisations understand the mechanism.

Even good email authentication cannot prevent an attacker who has genuinely compromised a supplier’s inbox from sending a message through that real account. Payment-change verification still matters.

Layered protection means no one mechanism has to succeed perfectly for the business to remain safe.

Dual approval reduces single-person payment risk

A small business owner may be accustomed to approving everything personally. As the team grows, a clear payment process can reduce mistakes and prevent one compromised email from changing financial instructions.

A useful design separates request creation, verification of a new payee and approval or release of payment where practical. For larger transactions, appropriate independent review should be required.

The actual thresholds and segregation of duties depend on organisation size and risk. A two-person enterprise may not have a corporate finance department, but can still insist on independent supplier confirmation for bank changes and keeping a verified record.

Do not create a process that only looks secure because the same person signs two electronic fields. Meaningful independence matters.

A sound policy also records what happens during holidays, when an approver is absent, so staff are not pressured to bypass controls.

Worked example: a two-step vendor account change

Imagine a hypothetical service firm paying an equipment supplier S$12,600. The supplier bank account has been used for several years, but an email requests a sudden change.

Employee A receives the request and opens an authorised vendor-change ticket, attaching the relevant document without approving it. Employee B independently calls the supplier’s previously verified number, confirms with an authorised representative and records the verification method.

The responsible manager then reviews the change and confirms that the bank instructions match the legitimate commercial agreement before payment proceeds.

If the caller cannot reach the legitimate supplier, the business may delay the non-urgent transfer rather than risk sending money to an unverified account.

This is a hypothetical internal control. It does not guarantee that every possible fraud is blocked, but it gives the organisation a better process than trusting one email.

A Punggol home business can use simple versions of these controls

A sole proprietor who sells services from an HDB flat may receive invoices from suppliers, websites, delivery services and marketing providers. The business can still be targeted by phishing or forged payment instructions.

The owner can maintain a verified supplier contact list, use unique authentication for business accounts, enable MFA and avoid urgent bank changes without a separately confirmed request.

If the person uses a single business phone, it becomes particularly important not to accept verification from the same suspicious account. Use independent channels and previously known contact information.

A home business should also avoid putting customer identity and payment records into unapproved tools merely to speed up invoices.

Our Punggol HDB business guide covers business registration and premises obligations; this article owns the narrower cybercrime and payment-authentication question.

Recruitment impersonation and business email fraud are different

A job applicant might receive a fake offer and be asked for a deposit or Singpass details. That is a recruitment impersonation scam, which can overlap with phishing but differs from BEC targeting a company’s existing supplier-payment process.

Our Punggol recruiter verification guide explains verifying the employer, recruiter and real vacancy.

This article focuses on employee conduct after or during work, especially invoice approval, mailbox security and corporate messages that ask a real worker to take an unauthorised action.

The same independence principle applies: a logo, licence number or genuine building photograph is not proof that the sender controls the claimed identity.

Avoid mixing all fraud into one vague rule such as “anything online is a scam.” Clear categories help people recognise specific mechanisms and act appropriately.

Malware can be hidden in supposed business attachments

An employee may receive a resume, invoice, delivery notice, contract update or software installer that is malicious. CSA warns that phishing can seek to induce malware installation as well as credential theft.

Do not open unexpected attachments from unverified contacts, especially when asked to bypass company security warnings. Follow authorised IT procedures for scanning or inspection.

Use approved software distribution and update channels. A message asking you to install a “security patch” from an unfamiliar website can itself be part of an attack.

If a worker accidentally opens a suspicious file, promptly notify the appropriate IT team and avoid unnecessary interaction with the affected device while following their instructions.

Early reporting allows responders to assess harm before it spreads. Hiding the event because it feels embarrassing can make an incident more difficult to contain.

What to do immediately after clicking a suspicious link

The CSA incident guidance says people using work devices should contact their IT department after interacting with suspicious phishing content.

If credentials were entered, secure affected accounts following appropriate IT guidance, including password reset and session checks. If banking information was given, contact the bank through its genuine official route.

If money has already been transferred, notify the organisation’s authorised finance and incident team immediately, contact the bank to seek urgent assistance and report suspected criminal activity through proper Police channels.

Do not forward a malicious attachment repeatedly to colleagues as a warning. Instead, use the organisation’s approved phishing-report feature or security channel.

A fast, accurate report helps the organisation respond. It should state what was clicked, the approximate time and whether credentials or money were involved.

The first fifteen minutes: employee action table

Incident	Immediate action	Avoid
Suspicious email not opened	Report through approved channel	Replying to attacker
Link opened but no details entered	Inform IT/security for assessment	Guessing all risk is gone
Work password entered	Report promptly and secure account under IT guidance	Reusing same password elsewhere
Unexpected MFA prompt approved	Notify security immediately	Hiding possible account takeover
New vendor bank account already saved	Freeze pending change and inform finance/security	Paying before verification
Fraudulent bank transfer sent	Contact bank and Police promptly	Assuming funds will be recovered automatically
Malicious attachment opened	Follow IT incident isolation advice	Deleting evidence or spreading attachment
Customer data exposed	Notify DPO and incident team	Sending more copies to investigate informally

This is an editorial quick-response guide, not a substitute for a company’s certified incident plan. The urgency and proper actions depend on the actual circumstances.

If there is immediate danger or an active crime, use the relevant emergency service. Routine phishing reports have different channels from emergency Police assistance.

Report phishing to SingCERT through official routes

CSA’s SingCERT Report a Phishing Email service lets members of the public provide suspected phishing email information for review.

SingCERT may investigate and work with providers to disable malicious addresses or linked sites. This is part of broader incident prevention; it is not an automatic financial recovery service.

The CSA Cyber Aid service allows reporting of cybersecurity incidents such as phishing websites, ransomware and unauthorised system access, and provides guidance.

For a workplace message containing confidential information, consult the company’s incident process before submitting sensitive files, and use the appropriate secure official channel. Do not publicly post corporate email headers or customer records.

If a scam resulted in theft or criminal activity, Police reporting is the relevant separate route.

The Police investigate suspected cybercrime

CSA explicitly distinguishes SingCERT cybersecurity incident handling from the Police’s role investigating cybercrime. A person who has lost money or suspects criminal conduct should use the appropriate Police eServices or official Police contact.

ScamShield’s 1799 helpline is available 24/7 for people uncertain whether something is a scam and seeking advice.

Do not assume a social-media account with a government badge can receive a full identity record or freeze stolen payments. Verify official channels independently.

Rapid action matters when funds have been sent. The Police’s large recovered BEC case demonstrates that intervention can be effective in some situations, but recovery is not guaranteed for every case or every delay.

Preserve the transaction reference, relevant evidence and authorised internal incident timeline.

Data breaches require another kind of assessment

Phishing can lead to a data breach if attackers obtain personal records. The company’s obligation under the Personal Data Protection Act (PDPA) then depends on the actual information, risk and notification conditions.

A personal data breach is not automatically notifiable to the regulator merely because any email was opened. The organisation needs to assess whether the incident meets the appropriate significant harm or significant scale test and follow the relevant PDPC process.

Notifiable breaches generally must be reported to PDPC as soon as practicable and no later than three calendar days after determining that notification is required, subject to the actual rules. Do not confuse this with every incident being reportable three days after first discovery.

Our Punggol AI and PDPA guide handles privacy and breach responsibilities more fully.

A business should coordinate cyber incident response, Police reporting where needed and personal data assessment without assuming that one submission automatically covers every authority.

A compromised mailbox may still look ordinary

Suppose the actual mailbox of a long-standing vendor is breached. The attacker can see prior invoices, communication style and usual contact names, making a fraudulent instruction much harder to notice.

A worker may examine the real domain and see nothing suspicious because the message genuinely came from the compromised account.

That is why independent confirmation matters even when the sender address and conversation history are authentic. Cybersecurity cannot be reduced to checking spelling mistakes.

An employee can also notice unusual behaviour: a new bank account with no normal confirmation, pressure to skip verification or instructions not consistent with the existing agreement.

The verification control should be written into normal operations, so nobody needs to decide case by case whether the supplier seems “trustworthy enough”.

Deepfakes and AI-generated messages do not change the basic process

Artificial intelligence can make impersonation more convincing through polished writing, manipulated images or synthetic voice. But the correct payment process still requires independent authorisation.

A voice note that sounds like a manager is not a substitute for a verified work identity and approved payment pathway. A video meeting with familiar branding cannot independently establish a change in supplier banking instructions.

The Police have warned about executive impersonation that can use sophisticated digital manipulation. Employees should ask whether an instruction is ordinary, documented and appropriately approved, not only whether the speaker sounds familiar.

A strong control should work against both a clumsy email and a convincing synthetic message.

Our Punggol AI-at-work guide covers permission, data handling and agentic systems more broadly.

Staff should not send passwords to IT support

An authorised IT colleague may ask someone to complete a password reset through a trusted system, but should not need the employee to send their password or MFA recovery codes through chat.

If a message claims to come from IT and asks for secrets, check using the organisation’s usual helpdesk number or approved contact channel.

Similarly, no recruiter or payroll provider should be given the employee’s personal Singpass login or one-time password so they can “verify employment status”.

A small company should train staff to distinguish legitimate administrative help from taking control of another person’s identity. Account recovery should be managed through the appropriate official process.

When roles change, administrators should grant and remove system access through authorised procedures rather than borrowing the previous employee’s credentials.

A small company’s first cybersecurity policy

A practical policy need not begin with a hundred-page document. It can identify approved business accounts, authentication requirements, vendor-payment verification, device updates, access approval and incident reporting contacts.

Specify who may approve a new payee and which independent channel is required. State that urgent executive messages do not override these checks.

Define how employees report phishing without forwarding dangerous content to everyone. Appoint a person or service that responds to suspicious emails and compromised work devices.

Keep the policy current when staff, systems or payment processes change. A rule written five years ago about an obsolete email platform may not protect today’s operations.

The business owner should also understand that cybersecurity is an ongoing organisational responsibility, not a task delegated entirely to a junior employee.

CSA’s Cyber Essentials framework can help smaller firms

The Cyber Security Agency’s Cyber Essentials certification guidance provides a structured approach to foundational organisational cybersecurity.

CSA’s 2025 Cyber Essentials materials, updated in the 2026 certification resources, cover classical cybersecurity, cloud, operational technology and AI-related security. A small company can use the framework as a reference for developing controls appropriate to its risks.

A certification mark is not an absolute guarantee against fraud. Nor does a Punggol company become certified simply by reading the checklist.

An employer should compare the framework’s controls with its actual devices, staff access, vendors and payment system. Where necessary, engage qualified cybersecurity support.

Even with formal certification, independently checking an unexpected supplier bank change remains a sensible everyday control.

A thirty-day small-business cyber readiness plan

Days 1–4: identify actual financial and data assets, including bank access, vendor details, employee credentials and customer records. Clarify who owns each system.

Days 5–8: implement or verify appropriate MFA, unique credentials and secure account recovery under authorised IT management.

Days 9–12: examine who can add or change supplier bank details, how changes are independently confirmed and whether payments have suitable approvals.

Days 13–16: brief all staff, including interns and temporary workers, on current BEC, gift-card and credential phishing examples from the Police and CSA.

Days 17–20: review software updates, backup and recovery arrangements and the policy for opening unexpected attachments.

Days 21–24: practise a fictitious suspicious invoice report, including who to contact and what evidence to preserve. Do not use real stolen information in a training exercise.

Days 25–30: review gaps, establish an incident response contact sheet and consider appropriate external guidance or Cyber Essentials assessment.

This is an editorial thirty-day implementation guide, not a promise that a company will be invulnerable or certified in thirty days.

A fictional Punggol campus contractor case

Imagine a facilities contractor providing a service at a campus-related building in Punggol. The contractor receives a message apparently from a verified equipment vendor announcing a new bank account for a scheduled payment.

Although the campus setting seems professional, the supplier’s actual legal entity and bank instructions are maintained by the contractor’s finance team, not necessarily the campus operator.

The contractor should use its own verified vendor records and independent approval process. A new email claiming to come from the campus’s procurement officer does not replace the supplier’s authenticated instruction.

If a payment incident occurs, the contractor must investigate and report through the appropriate internal and official channels without falsely accusing the campus operator.

The example demonstrates that outsourcing creates multiple identities to verify. It makes no allegation about SIT, JTC or any actual contractor.

A fictional payroll account-change case

A Punggol employee appears to email HR saying their salary account has changed. The note includes a plausible new account and a polite explanation about switching banks.

If the organisation changes employee bank details solely from the email, an attacker who compromised the mailbox could redirect salary. The payroll team should follow its approved identity verification process before modifying banking records.

This control must also respect employee privacy. Staff should not be forced to share bank login credentials to prove account ownership; legitimate bank account evidence and properly authenticated requests may be sufficient under the employer’s process.

Record the authorised change and notify the employee through an established separate channel. If the change is unexpected or disputed, halt payment where possible and investigate promptly.

The case is hypothetical. It shows why BEC prevention includes payroll, not only external supplier invoices.

Business email fraud can affect small amounts too

A company may decide that only transfers above S$50,000 deserve verification. But repeated small fraudulent changes can still cause significant loss, and a scammer may deliberately split requests to avoid attention.

The appropriate control threshold should be risk-based. Unusual new payees, sensitive payroll changes or sudden executive instructions may deserve independent review even when the amount is relatively small.

A uniform basic check for bank-account changes is often easier for staff to understand than a complicated exception process based solely on amount.

Do not create needless friction for every ordinary low-risk email. The goal is to focus verification on identity, account changes and consequential actions.

Management should review whether staff can follow the procedure during peak workload, holidays and unexpected absences.

Employee training should use real mechanisms and fictional data

A helpful exercise can present a fabricated invoice with a subtly altered sender domain and a request for urgent payment. Staff practise identifying the changed instruction and confirming it through the company’s stored supplier contact.

Another exercise can show a spoofed executive message requesting gift cards. The worker should know the proper internal purchasing process and how to report pressure to bypass it.

Do not use real customer account information in training materials unnecessarily. Fictional data allow the team to learn the decision without creating privacy risks.

Training should be supportive. A person who reports a suspicious message should receive constructive feedback rather than public humiliation.

A workplace becomes more resilient when employees feel authorised to slow down a risky transaction, not when they are frightened of admitting uncertainty.

The verification rule should apply to management too

Security policies fail when senior staff routinely tell junior workers to bypass controls for convenience. If a manager can demand an unverified payment by writing “urgent”, scammers can imitate the same style.

Leaders should model the behaviour they want: use official channels, tolerate reasonable verification, approve change requests properly and take suspected incidents seriously.

A good culture says that no job title makes an unexpected bank instruction self-authenticating. A genuine executive can cooperate with a known finance verification step.

This is especially important for smaller businesses where the owner may be the sole signatory and employee trust is highly personal.

A control that applies consistently is more credible and less likely to be defeated by social pressure.

A two-minute employee screening routine

Before acting on a financially or technically consequential message, ask: Was I expecting this? Who actually sent it? What has changed? What happens if the instruction is false? Can I verify through a separately trusted channel?

If the message only shares non-sensitive routine information, the ordinary company process may be sufficient. If it changes bank details, asks for credentials or directs an unusual transfer, stop until verification is complete.

Do not download attachments or click links simply to make the sender prove they are genuine. Contact the real organisation through approved channels.

The purpose is to make a good decision without requiring every employee to remember dozens of scam stories.

A short repeatable process can protect a business more consistently than occasional dramatic warnings.

Common mistakes to avoid

“The grammar is perfect, so it is real.” False. Fraud can be professionally written.

“The domain is correct, so the new account is real.” Not necessarily. The real mailbox may have been compromised.

“I called the number in the suspicious email.” That number may be controlled by the attacker. Use an independent trusted contact.

“The CEO asked, so we skip checks.” A forged executive instruction is a known scam method.

“MFA means nobody can steal money.” MFA protects one layer; payment-process verification is still needed.

“I clicked, so I should hide it.” Prompt reporting helps responders contain harm.

“Cyber Essentials is a magic shield.” It supports structured controls but does not eliminate all risk.

Frequently asked questions

What is phishing in a workplace?

Digital deception intended to obtain sensitive information, money, malware execution or another unauthorised action through impersonation or misleading communications.

What is Business Email Compromise?

A scam where criminals spoof or compromise business communications to redirect payments or obtain unauthorised actions.

Are BEC scams still a problem in 2026?

Yes. Police reported at least 66 vendor-bank-change BEC cases and S$19 million in losses from January through its 20 May 2026 advisory.

How can an email from a genuine supplier be fraudulent?

The supplier’s actual mailbox may have been compromised. Independent verification is necessary for unusual sensitive instructions.

Should I call the phone number shown in a suspicious invoice?

Not as the only check. Use a trusted number from an independent pre-existing source.

Does an urgent CEO message override finance controls?

No. Approved verification and payment processes should apply regardless of the claimed sender’s seniority.

Why do scammers request gift cards?

They can obtain the redemption codes and use the value. Police documented executive-impersonation variants involving gift-card purchases in January 2026.

Can a scammer change one letter in a real email domain?

Yes. Police described a 2026 supplier-fraud case using a subtly transposed domain name.

Is multi-factor authentication useful?

Yes. It reduces credential-based risk, but does not replace secure payment approval or protection against compromised accounts.

What if I get an MFA request I did not initiate?

Treat it as suspicious and follow your organisation’s account-security procedure promptly. Do not approve random requests.

What if I clicked a phishing link on my work laptop?

Inform your IT/security team promptly and follow its containment and account-security instructions.

What if payment has already gone to a scammer?

Contact the bank and relevant finance team immediately, preserve evidence and report the suspected crime through official Police channels.

Where can phishing be reported?

CSA’s SingCERT provides an official phishing email reporting service and Cyber Aid for qualifying cybersecurity incidents.

Is SingCERT the same as the Police?

No. SingCERT handles cybersecurity incident coordination and reporting; Police investigate suspected criminal offences.

What is ScamShield’s helpline?

1799, available 24/7 for assistance when unsure whether something is a scam.

Does Punggol Digital District have its own scam reporting law?

No. National Singapore cyber and criminal reporting channels apply. CSA has an office in the district, but its reporting routes are official online and contact services.

Can an AI voice message prove an executive authorised a payment?

Not by itself. Use the actual financial approval and independent verification process.

Is DMARC enough to prevent all BEC scams?

No. Email authentication helps against spoofing but cannot guarantee protection when a legitimate mailbox is compromised.

Can an intern be responsible for approving a high-value bank change alone?

A business should design appropriate role authority and verification. Training and meaningful controls are especially important for inexperienced employees.

Does a personal data breach always have to be reported within three days of discovery?

Not exactly. PDPA notification depends on the legally notifiable criteria, and the three-calendar-day timing generally runs after the determination that a breach is notifiable.

Official sources and accuracy boundaries

Verified for October 2026: Police’s January, February and May BEC advisories; the at-least-66-cases/S$19-million May 20 snapshot; the US$6.6-million international recovery case; CSA’s phishing reporting and Cyber Aid services; ScamShield’s 1799 helpline; and CSA’s October 2026 Cyber Essentials materials.

Examples: all Punggol supplier, payroll, retail and campus contractor cases are fictional security training scenarios. No named local employer has been reported here as victim, attacker or noncompliant. Payment controls and incident response must be adapted to the actual organisation and verified official guidance.

• Singapore Police: 20 May 2026 BEC vendor bank-detail advisory
• Singapore Police: 5 May 2026 US$6.6 million recovery case
• Singapore Police: 28 January 2026 gift-card impersonation
• Singapore Police: Executive impersonation messages
• CSA: Report a phishing email
• CSA: SingCERT incident coordination
• CSA: Cyber Aid incident reporting
• CSA: DMARC email protection resources
• CSA: Cyber Essentials certification and controls
• CSA: Punggol Digital District official contact listing
• ScamShield: Phishing scam recognition
• ScamShield: 1799 helpline
• Working in Punggol: AI, privacy and data protection
• Working in Punggol: Complete series archive