Article
A Singapore Firm Recovered $12.8M From a Bank-Change Scam. What Worked
A Singapore petrochemical company sent $12.8 million to a fraudulent bank account after accepting a forged authorization letter, and then got the entire amount back. That full recovery is unusual: once money reaches a scam account overseas, most of it is moved again within hours and is gone for good. This case worked because the company caught the fraud fast and because two governments and a bank moved just as fast behind it.
What happened in the Singapore business email compromise case?
On October 1, 2026, a Singapore-based petrochemical company received an email that appeared to come from its business counterpart, with revised instructions to send payment to a new bank account. According to the Singapore Police Force, the company flagged inconsistencies in the paperwork at first. The scammers then supplied an authorization letter carrying the counterpart's signature and company stamp, which was later confirmed to be forged. Reassured, the company transferred $12.8 million to the new account on October 13.
The fraud only surfaced on October 26, when the real business counterpart asked why its payment had never arrived. The company filed a police report the same day. Singapore's Cyber Command then worked with the Cambodian National Police and OCBC Bank to trace and freeze the money before it could be dispersed further, and the Singapore Police Force confirmed on October 29 that the full amount had been recovered.
This is a textbook vendor bank-change scam, also called payment redirection fraud: nothing about the invoice itself was fake. The scam targeted the one detail that moves the money, the bank account number attached to a trusted vendor.
How did a forged authorization letter get the bank change past the company's checks?
The company already had a control in place: it noticed something was off in the first set of documents and asked questions instead of paying immediately. The scam's answer to that was a forged authorization letter with a real-looking signature and company stamp. A document that looks official is still just a document. A PDF, a letterhead, and a stamp can all be copied or recreated; none of them proves that the person on the other end actually authorized a change to where money goes.
That is the gap a lot of accounts payable (AP) processes have: they treat a convincing document as proof, when the only thing that proves a bank change is real is reaching the vendor through a channel the fraudster does not control. Quittance's review of the FBI's 2025 BEC data covers the same gap in more detail: criminals have gotten very good at producing paperwork that passes a visual check, which is exactly why a visual check cannot be the control that stands between a scam and a wire transfer.
Why are most bank-change scams never recovered?
Business email compromise is not a small problem. The FBI's Internet Crime Complaint Center (IC3) reported $3.05 billion in BEC losses across 24,768 complaints in 2025, the second-costliest category of cybercrime it tracks after investment fraud. Most of that money is never seen again. Once a fraudulent wire lands in an account, criminals typically move it through a chain of other accounts and jurisdictions within hours, specifically to outrun the paperwork a bank or police force needs to freeze it.
The FBI's own Recovery Asset Team (RAT), which coordinates bank freezes on reported wire fraud, initiated 3,900 Financial Fraud Kill Chain cases in 2025 and froze $679 million, a 58% success rate on the cases it was able to act on. That success rate depends almost entirely on speed: the sooner a victim reports the fraud, the sooner a bank can place a hold before the funds move again. In the Singapore case, the company discovered the fraud 13 days after the transfer, which is slow compared to same-day detection, but it still reported the loss immediately once it was found, and investigators moved it across two jurisdictions before the trail went cold. That combination, not the dollar amount, is what made a full recovery possible.
Singapore's own numbers show how exposed this fraud type is more broadly. A police advisory from May 2026 reported at least 66 cases of vendor payment-detail-change scams since the start of the year, with losses of at least $19 million, and this is one city-state. Most of that money did not come back.
What is the one verification step that would have stopped this before the payment went out?
An independent callback. Before acting on any change to a vendor's bank details, call the vendor using a phone number you already had on file, not a number provided in the email, the new invoice, or the authorization letter itself. Ask the person who answers to confirm the new account in their own words.
This is the same guidance the Singapore Police Force gave after this case: verify any new or sudden change in payment instructions by contacting the supplier directly, using an independently verified phone number rather than contact details from the same email thread. It works because it breaks the one channel the fraudster controls. A scammer can fake an email thread, a signature, a stamp, and a PDF. What they cannot do is answer a phone number that was never theirs to begin with.
The reason this control gets skipped is not that AP teams don't know about it. It is that a callback takes a few minutes and a payment run does not want to wait. The fix is procedural, not technical: freeze any vendor record the moment a bank-change request arrives, and do not release a payment to that vendor until the callback is logged. Quittance's writeup on a $1.9 million jail-vendor scam shows the same pattern playing out over months rather than days, for the same underlying reason: nobody owned the step between "a bank change arrived" and "a payment went out."
What should an AP team do in the first hour if a payment already went to a changed account?
- Call the bank immediately, your own bank first, and ask for an emergency recall or hold on the wire. Every hour matters; funds that sit still long enough to be frozen are funds that can be recovered.
- File a report with law enforcement the same day. In the US, that means the FBI's IC3 at ic3.gov, which can route the case to its Recovery Asset Team for a Financial Fraud Kill Chain request if it is still inside the window where a freeze is possible.
- Contact the real vendor through a verified channel to confirm the payment never arrived and to start documenting the timeline.
- Preserve everything: the original email, the forged document, headers, timestamps, and the wire confirmation. Investigators and insurers will need all of it.
- Freeze the vendor record so a second payment cannot go out to the same fraudulent account while the first is still being chased.
Speed is the only lever an AP team controls once money has already moved. The Singapore case recovered the full amount because the gap between the wire and the report was measured in days, not months.
A vendor bank-change verification checklist for AP teams
| Verification method | What it actually proves | Stops this scam? |
|---|---|---|
| Replying to the same email thread | Nothing. You're confirming with the attacker, not the vendor. | No |
| Reviewing a signed authorization letter or PDF | Nothing on its own. Signatures, stamps, and letterhead can all be forged. | No |
| Calling a number provided with the change request | Nothing. If the fraudster supplied the number, you're calling them. | No |
| Calling a number already on file, from the contract or vendor master | Confirms you reached someone at the real organization. | Yes |
| Requiring a second approver before updating the vendor master | Reduces the chance one compromised inbox or rushed employee acts alone. | Yes, as a backstop |
The table makes the pattern obvious: every weak method still uses a channel the request itself supplied. The two methods that work both depend on reaching the vendor, or a second set of eyes, through something the fraud could not have touched.
Where this fits for a growing AP team
None of this requires new headcount. It requires a rule that a bank-change request is never actioned from the same thread it arrived on, and that someone besides the person who processes the payment confirms the callback happened. For a CFO, the real question behind a case like this one is not "could we spot a forged letter," it is "does our process depend on spotting one." A control that depends on a human catching a convincing fake, under deadline pressure, on a Friday, is not a control you can report to an auditor with confidence. A documented callback, logged against the vendor record before any payment goes out, is something you can show.
This is also the exact failure mode agreement-aware AP review is built to catch: a changed bank account paired with documents that look right on their face is one of the clearest fraud signals in accounts payable, and it is worth treating as a hard stop rather than a judgment call, however convincing the paperwork looks.
FAQ
What is a vendor bank-change scam? A vendor bank-change scam, also called payment redirection fraud, is a form of business email compromise where a scammer impersonates a trusted vendor or business partner and asks a company to send upcoming payments to a new bank account that the scammer controls. The invoice amount and details are often genuine; only the destination account is fraudulent.
How much money do businesses lose to business email compromise scams each year? The FBI's Internet Crime Complaint Center reported $3.05 billion in business email compromise losses across 24,768 complaints in 2025, making it the second-costliest category of cybercrime the agency tracks, according to the FBI's 2025 Internet Crime Report.
Why are bank-change scam funds so rarely recovered in full? Criminals typically move stolen funds through several accounts and jurisdictions within hours of receiving them, which is faster than most victims discover the fraud and report it. Recovery depends on speed: the FBI's Recovery Asset Team froze funds in 58% of the cases where it was able to initiate a Financial Fraud Kill Chain in 2025, a rate tied directly to how quickly the fraud was reported.
Can a signed authorization letter prove a bank change is legitimate? No. A signature, company stamp, or letterhead on a document can be copied or recreated, and in the Singapore case, the authorization letter was forged despite looking convincing. The only verification that reliably confirms a bank change is an independent callback to a phone number the company already had on file before the change request arrived, not a number supplied with the request.
What should an AP team do the moment a vendor asks to change its bank details? Freeze that vendor's record so no payment can go out, then call the vendor using a number from the existing contract or vendor file, never a number in the request itself. Only release the hold once someone at the vendor confirms the new account in their own words, and log that callback against the vendor record.
What should we do if we already sent money to a changed account that turns out to be fraudulent? Call your bank immediately to request an emergency recall or freeze, file a report with law enforcement the same day (in the US, the FBI's IC3), contact the real vendor through a verified channel, and preserve every document and timestamp involved. Speed is the main factor in whether any of the money is recoverable.