A Singapore-based petrochemical company has recovered US$12.8 million (approximately S$16.4 million) after falling victim to a sophisticated business email compromise scam that diverted its payment to a fraudulent bank account in Cambodia.
The recovery was made possible through coordinated efforts by the Singapore Police Force (SPF), Cambodia’s National Police and OCBC Bank, the SPF said on October 29.
According to preliminary investigations, the fraud began on October 1, when the company received an email purportedly from its business counterpart containing revised payment instructions and details of a new bank account.
Although the company noticed inconsistencies in the payment documents, the fraudsters allegedly sent an authorisation letter carrying the business partner’s company signature and stamp to establish credibility and convince the firm that the changes were genuine.
Believing the revised instructions to be legitimate, the company transferred US$12.8 million to the new account on October 13. The document was subsequently established to be fraudulent.
The fraud came to light on October 26, when the business counterpart informed the company that the payment had not reached its account. The affected firm subsequently approached the police.
Following the complaint, officers from SPF’s Cyber Command contacted Cambodian authorities and worked with OCBC to trace the funds. Their coordinated intervention led to the recovery of the entire amount from the fraudulent bank account in Cambodia.
The police have urged businesses to strengthen safeguards against business email compromise scams. Recommended precautions include independently verifying changes to payment instructions, regularly training employees to identify suspicious communications and deploying email security software.
The case highlights how manipulated business correspondence and forged documentation can expose companies to substantial financial losses.
