Scammers use forged company letter to trick Singapore petrochemical firm into transferring US$12.8 million

SINGAPORE: The Singapore Police Force’s (SPF) Cyber Command has recovered US$12.8 million (S$16.35 million) that a Singapore-based petrochemical company lost to a business email compromise scam, working with OCBC and the Cambodian National Police.

On October 1, 2026, the company received an email that appeared to come from a business counterpart, with revised payment instructions directing funds to a new bank account in Cambodia.

The company spotted a discrepancy in the payment documents. But the scammers responded with an authorisation letter bearing the counterpart’s company signature and stamp, lending the new instructions apparent legitimacy. On Oct 13, the company transferred US$12.8 million to the new account. The letter was later found to be fraudulent.

The scam came to light on Oct 26, when the real business counterpart told the company it had not received payment. The company lodged a police report the same day.

Full amount traced and recovered

Cyber Command officers immediately contacted the Cambodian National Police and coordinated recovery efforts with OCBC. The full amount was traced and recovered. The Police thanked both the Cambodian police and OCBC for their help.

Full recoveries in cross-border business email compromise cases are uncommon, as funds are often moved quickly through multiple accounts and jurisdictions once they leave the victim’s bank.

How businesses can protect themselves

The Police advised companies to review their payment processes and to always verify any new or sudden change in payment instructions by contacting the supplier or counterpart directly, using an independently verified phone number rather than contact details from the same email thread.

Businesses should also train staff responsible for authorising or making payments on the tactics used in such scams, maintain strong passwords, enable multi-factor authentication, and use email protection software capable of detecting spoofed or fraudulent messages.

Businesses that have fallen victim to such scams, or have information about them, can call the Police Hotline at 1800-255-0000 or submit details at www.police.gov.sg/i-witness. For more information, visit www.scamshield.gov.sg or call the ScamShield Helpline at 1799.

Read also: SPF: 3 men arrested over S$6,700 graphics card purchases using stolen card details