The invoice that came from your supplier's real mailbox
Nothing about the email is fake. The domain is right, the thread is real, and the bank details are new. This is the fraud that costs Singapore businesses the most money.
A payment goes out to the wrong bank account. Somebody notices three weeks later when the real supplier chases the invoice. By then the money has moved through two accounts and out of the country, and the bank's answer is that the transfer was authorized by you.
This is business email compromise, and it is the least technically impressive attack in this list of articles. There is no malware. Often there is no compromise of your own systems at all. Somebody got into a mailbox at a company you buy from, read six months of correspondence, and waited for an invoice worth intercepting.
Why it gets through
Every filter you own is looking for signals of badness. A malicious link, an attachment that behaves oddly, a domain registered last Tuesday, a sender who has never written to you before. A payment redirect email has none of these. It is a plain text message from a known correspondent, inside a thread you started, referencing a quotation you actually received.
The variations are worth knowing because they call for slightly different answers. Sometimes the attacker sends from the supplier's genuine mailbox, in which case the address is perfect and there is nothing to spot. Sometimes they register a lookalike domain and reply from that, and the difference is one character you were never going to read. Sometimes they add a forwarding rule and answer from the real account while the supplier's own copy of the thread quietly disappears.
The other common version comes from inside. A message that appears to be from the managing director, sent while they are visibly traveling, asking for an urgent transfer and asking that it be kept between the two of you. It works because of who is asking, not because of how it is written.
The control that actually works
Bank details change by phone call, to a number you already had. Not the number in the email signature, not a number in the invoice, and not a callback to whoever emailed you. A number from your own records, called by the person about to release the payment.
That single rule stops nearly all of it, and it costs nothing. The reason it fails in practice is that it is a rule with no owner. Write it into the payment process so that finance cannot complete a change of bank details without recording who they called and when. Make the verification part of the paperwork rather than part of somebody's judgment on a busy afternoon.
Two supporting settings help on the technical side. Block auto-forwarding to external addresses in Exchange Online, which is off by default in newer tenants but on in plenty of older ones. And turn on external sender tagging, so that a lookalike domain arrives with a visible marker rather than looking exactly like an internal reply.
Call your bank and ask for a recall on the transfer. Hours matter here, not days. Do this before you investigate anything.
Report it to the Singapore Police Force through the Anti-Scam Centre. A police report is usually required before a bank will pursue the receiving account.
Check whether the breach was yours. Look for forwarding rules, unfamiliar sign-ins and consented applications in your own tenant before assuming it was the supplier's.
Tell the supplier, by phone. If their mailbox is the one that was read, every other customer of theirs is exposed to the same invoice.
The awkward part about liability
If the interception happened in your supplier's mailbox and you paid the wrong account, the debt to your supplier generally still stands. You paid somebody, but you did not pay them. This surprises people, and it is worth understanding before it happens rather than during the argument that follows.
If personal data was exposed along the way, PDPA notification obligations may also apply, which is a separate assessment from the money.
One sentence for your staff
New bank details are never accepted by email, no matter who sent them or how urgent it sounds. Pick up the phone and use a number we already had.