Invoice Fraud in Singapore: When a Supplier’s Bank Details Change by Email

Short answer: Treat any email asking you to change a supplier’s bank details as suspect until you have confirmed it by phone on a number already in your records. If money has already gone to a fraudster’s account, call your bank at once to ask for a recall of funds, then file a police report and preserve the emails.

Invoice fraud in Singapore usually starts with a single, ordinary-looking email: a regular supplier writes to say its bank account has changed and asks you to pay the next invoice to the “new” account. The supplier never sent it. This type of scam is called business email compromise (BEC), meaning a fraudster either takes over a real email account or uses a lookalike address to impersonate a supplier or colleague. Below are the controls that stop it, the first steps if you have paid, and the effect on your accounts, tax, GST and board records.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

How does supplier bank-detail fraud work in a Singapore company?

A fraudster impersonates a supplier or a colleague by email and tells your finance team that the supplier’s bank account has changed, so the next payment lands in an account the fraudster controls. The company usually finds out only when the real supplier chases for payment.

According to the Singapore Police Force advisory of 20 May 2026, scammers either use spoofed email addresses or break into the vendor’s own email account. The second is harder to spot, because the email comes from the real address, often inside a real invoice thread.

Warning signs worth training your team on:

• A change of bank account announced by email alone, especially just before a payment run.
• A sender domain that differs by one letter, an extra hyphen or a different ending from the supplier’s usual domain.
• A new account overseas, or in a name that differs from the supplier’s registered name.
• Pressure to pay quickly, or a request to reply only to a new address.

Fraudsters also impersonate government agencies; our guide on telling a real ACRA message from a fake one covers that variant.

What accounts-payable controls stop invoice fraud in Singapore?

The single most effective control is a call-back: no change to a supplier’s bank details takes effect until someone confirms it by phone on a number already held on file, not one given in the email. Dual approval and a locked vendor master file close the remaining gaps.

The police advisory calls such requests generally uncommon and a red flag, and recommends verifying through a different medium. In a small company, that becomes a short written procedure:

1. Log every request to change supplier bank details in a change register, with the date, the requester and the source email.
2. Call the supplier back on the phone number recorded when the supplier was first set up, or on its published main line. Never use contact details in the request itself.
3. Ask the supplier to confirm the new account on its letterhead, and check that the account name matches the supplier’s registered business name.
4. Have a second person, who did not handle the request, approve the change in the accounting system.
5. Pay a small first amount to the new account, or ask the supplier to confirm receipt of the first payment, before releasing large sums.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email setting that helps stop others sending emails that pretend to come from your domain. The police advisory also recommends two-factor authentication, updated anti-virus software and prompt security patches. The wider principle is segregation of duties, explained in our article on internal controls for small businesses on a budget. Regular supplier statement reconciliation is often how an unpaid real supplier is noticed early.

What should you do immediately if money was sent to a fraudster?

Call your bank immediately and ask it to recall the payment and block further transactions, then file a police report. Speed matters, because funds are often moved on quickly.

1. Call your bank’s anti-scam or fraud hotline and ask for a recall of the funds. If you bank with DBS/POSB, UOB, OCBC, Citibank, Maybank, Standard Chartered or HSBC, the ScamShield Helpline on 1799 can connect you directly.
2. Stop further payments to that account and check every recent vendor master change.
3. File a police report online through the Singapore Police Force e-service or in person at a Neighbourhood Police Centre or Neighbourhood Police Post. Call 999 if urgent police help is needed. The ScamShield Helpline cannot file the report for you.
4. Preserve evidence: the fraudulent emails with full headers, the payment confirmation, the bank account details used, and a timeline of who did what. Do not delete the emails.
5. Secure your email: change passwords, turn on two-factor authentication and check for unknown forwarding rules. Tell the supplier if its email may have been hacked.
6. Tell the directors in writing the same day, and inform your external accountant and any insurer whose policy may respond.

ScamShield’s “I’ve been scammed” page sets out the official steps and bank hotlines. Recovery is never guaranteed.

Do you still owe the real supplier after paying a fraudster?

In many cases the company still owes the real supplier, because the money did not reach the supplier or an account it authorised. The answer depends on the contract, the facts and how the fraud happened, so it is a question for a lawyer.

As a general principle, paying a third party normally discharges a debt only if the creditor authorised that payment. Where the supplier’s own email was compromised, the position can be more arguable, and some contracts deal with payment detail changes expressly. Do not admit or deny liability early. Keep the supplier informed, and speak to a lawyer before agreeing how the loss is shared.

How should the loss be recorded in the accounts?

The amount paid to the fraudster is usually recorded as a loss, while the real supplier’s invoice stays in accounts payable until settled. A recovery is recorded only when confirmed. In practice, your accountant will:

• reverse the payment out of the supplier’s ledger, so the supplier balance again shows the unpaid invoice;
• post the amount sent to the fraudster to a separate expense account, such as “loss from fraud”, with the police report reference in the narration;
• not book a receivable for a hoped-for bank recall or insurance claim until recovery is confirmed, then record any amount received as a recovery;
• disclose the event in the financial statements where it is material.

Is a fraud loss tax-deductible in Singapore?

It may be, but there is no automatic deduction. IRAS’s published guidance links deductibility of losses from embezzlement or unauthorised transactions to the strength of the company’s internal controls.

The IRAS page on business expenses lists losses through embezzlement or unauthorised transactions as deductible where the employee does not have overriding power or control and the company has put in place a sufficient system of checks and balances. Where the employee has overriding power or control and the company did not have sufficient checks, the loss is listed as not deductible. The general test for any business expense is that it is wholly and exclusively incurred in the production of income and is revenue, not capital, in nature.

That guidance is written with employee wrongdoing in mind. We did not find IRAS guidance written specifically for losses to an outside fraudster, so the treatment depends on the facts, and documented controls will matter. Discuss it with your tax adviser before the tax computation is finalised.

Can you claim GST on an invoice you paid to a fraudster?

You can claim input tax only on a valid tax invoice from your real, GST-registered supplier for goods or services it supplied to you. A payment to a fraudster’s account is not a supply, so no input tax arises on it.

The IRAS conditions for claiming input tax require, among other things, that the goods or services are supplied to you and that local purchases are supported by valid tax invoices addressed to you. IRAS’s GST Registered Business Search lets you check a supplier’s GST registration.

If you hold a genuine tax invoice from the real supplier, the input tax claim relates to that invoice, not to where your money went. IRAS also requires you to pay your supplier within 12 months of the due date of payment, failing which you must repay the input tax claimed. If you later pay the supplier within five years from the end of the accounting period in which the input tax was first claimed, you can claim it again. Ask your GST adviser how these rules apply where the payment went to a fraudster instead of the supplier.

What do directors need to do, and what should the board minutes record?

Directors should be told promptly, decide the response and approve stronger controls, and the minutes should record those decisions.

Section 157(1) of the Companies Act 1967 requires a director to act with honesty and use reasonable diligence in the discharge of the duties of the office. Our guide to directors’ duties under section 157 explains the duty in more detail.

Section 188 of the Companies Act 1967 requires minutes of directors’ meetings to be entered in the minute books within one month of the meeting. After an invoice fraud, a board meeting or directors’ resolution should cover:

• the facts of the incident, the amount lost and the date it was found;
• the steps taken with the bank, the police and the supplier;
• the decision on whether to involve lawyers or notify insurers;
• approval of revised payment and vendor master controls, with named owners;
• instructions to the accountant on how the loss is recorded.

See our article on minute books and meeting minutes under section 188 for what good minutes contain.

Frequently asked questions

Will the bank refund money sent to a fraudster’s account?

Not automatically. The bank can try to recall the funds, but recovery depends on how quickly it is told and whether the money is still in the receiving account.

Is a ScamShield report the same as a police report?

No. The ScamShield Helpline on 1799 can give advice and connect you to seven major banks, but it cannot file a police report. File the report through the police e-service or at a Neighbourhood Police Centre.

Is an email from the supplier’s usual address safe?

Not necessarily. Scammers sometimes take over the vendor’s real email account. Always verify bank detail changes by phone on a number already on file.

Should a small company with one finance staff member use dual approval?

Yes, where possible. A director can act as the second approver for vendor master changes and payment runs. Ask your bank and accounting software provider whether a maker and checker set-up is available, where one person prepares a payment and another approves it.

Our free tools help with related compliance checks, and our sister site Singapore Secretary Services covers board resolutions.

Last reviewed: 21 October 2026. The Editorial Team, Raffles Corporate Services.