Security & Compliance
Bank-Detail Change Scams: The Controls That Work
A bank-detail change scam is an email or message, apparently from a supplier, a subcontractor or a colleague, saying "our account has changed, please pay the new one". The new account belongs to a criminal. The control that stops it is boring and works every time: never act on a bank-detail change until you have confirmed it by phone, on a number you already held.
This is a practical starting point for owner-managed service businesses, not legal or security-consultancy advice. Everything below that states a fact about scams, banks or agencies is linked to the Singapore source it came from, checked in October 2026.
What is a bank-detail change scam?
It is a form of business email compromise: the scammer impersonates someone you already deal with and asks you to move money to a different account. The Singapore Police Force describes the pattern in its 20 May 2026 advisory: scammers pose as a victim's colleagues or vendors, using spoofed email addresses or compromised vendor email accounts, and say the vendor's bank details have changed.
Victims typically find out when they check with the vendor, or when the vendor says the payment never arrived. By then the money has usually moved on. The same advisory reports at least 66 cases and at least $19 million in losses between 1 January 2026 and the advisory date. That is the police's figure, not ours, and it counts only reported cases.
How does it reach a service business?
It reaches you from two directions, and most owners only think about one.
The first is the one the police describe: you pay suppliers and subcontractors, and a "new account" notice arrives in a thread that looks like the real one. Renovation and interior design firms are exposed to this by the way the work is organised, with many payees, regular invoices and several people who can approve a transfer. That is our observation about how such firms operate, not a statistic.
The second is the same trick in reverse. A customer owes you a deposit, someone who can read your email, or who has copied your invoice and signature block, tells the customer your account has changed, and the deposit goes to the wrong place. The police advisories we cite are written from the payer's side, so treat this direction as our reasoning about the same mechanism rather than a reported trend. The defence is the same: your invoices should carry your bank details in a form customers can check, and your customers should be told, in writing and in advance, that you will never change them by email.
How it arrives varies. The advisories describe email, including spoofed addresses with slight misspellings or swapped letters. A WhatsApp message from a "new number" for the same person is the obvious cousin. The advisories we found do not address it, so the rule below is ours: a request to change payment details is a red flag on any channel.
What is the one control that stops most of it?
Call-back verification on a number you already had. The Singapore Police Force's 2022 advisory says to verify changes to payment instructions by calling the sender, using previously known numbers, not the numbers in the email. The Cyber Security Agency says the same thing in its business email compromise advisory: confirm funds transfers, changes of supplier bank account and invoice payments through a different medium, such as a phone call, so a compromised mailbox cannot approve its own request.
"Known number" is the whole point. The number in the suspicious email signature is the scammer's. Use the one in your own phone, an older invoice, a signed contract, or the supplier's website typed in by hand.
What rules should you write down?
Four short rules, on one page, shown to everyone who touches payments including new starters. The police advisory specifically names new staff, interns, and people who handle procurement and payroll.
- No bank-detail change is accepted from a message. Email, WhatsApp or a PDF. The change is requested in writing, then confirmed by a call-back, then recorded by someone other than the person who received the request.
- Two people approve any new payee. One enters it, a different person approves it. Neither relies on the email thread as proof. This is a practice we recommend, not an official requirement; it costs a minute and removes the situation where one rushed person is the only check.
- Hold the first payment to a changed account. A same-day deadline in the message is a warning sign in itself.
- Record who you called, on which number, and when. A line in the payment file is enough.
Does a PayNow name check help?
It helps, but it does not replace the call. Since 6 June 2026, PayNow nicknames are gone for individuals: the Association of Banks in Singapore says selected letters of the payee's registered account name are displayed instead, because scammers had used nicknames to impersonate businesses and trusted individuals.
So before you send, read the name on your banking screen and compare it with the name on the contract and the previous invoice. Take a hypothetical subcontractor, a company on the contract: if the screen shows an unrelated personal name, stop. A match is not proof, though. The same ABS notice says no single measure is sufficient on its own and warns against trusting someone just because they know your name. Treat the name check as a second layer behind the phone call.
What email basics matter, in plain terms?
Three things: lock the mailbox, make it hard to forge your domain, and make forgeries of other domains easier to spot.
Lock the mailbox. The police advisory recommends strong passphrases and two-factor authentication on email accounts, and the CSA advisory stresses multi-factor authentication for staff who can authorise payments. The police describe compromised vendor email accounts as one way the scam is run, so a locked mailbox protects your suppliers as well as you. CSA also lists checking for suspicious email forwarding rules, which is where a hidden copy of your mail often goes.
Make your domain hard to forge. Three settings, published by whoever manages your domain or email provider:
- SPF is a published list of servers allowed to send email for your domain. CSA describes it as helping the receiving server detect spoofed sender addresses, and notes that it does not stop spoofed emails being sent in your name.
- DKIM adds a digital signature to outgoing mail so the receiver can check it was not altered. The US agency CISA has a short plain description of SPF, DKIM and DMARC.
- DMARC is the instruction that ties them together: it tells receiving servers whether to deliver, quarantine or reject mail that fails the checks, per CSA's DMARC page. The police advisory recommends it and points to free configuration tools.
None of these protects you from a scammer's lookalike domain, such as an extra letter in the supplier's name. That is why the police advise checking the sender's domain for misspellings or additional characters, and why the call-back still matters.
Where do you report it in Singapore, and how fast?
Call your bank first, immediately. The police advise businesses hit by this scam to call the bank to request a recall of funds, and ScamShield keeps a list of bank anti-scam hotlines with the advice to call as soon as money is lost. It gives no grace period, so assume every hour counts.
Then make a police report, online through the Singapore Police Force e-service or in person; ScamShield's "I've been scammed" page lists the steps, including calling 999 for urgent help. Secure the compromised email account: change the password and turn on multi-factor authentication. If you are only unsure whether a message is a scam, the ScamShield Helpline is 1799.
When this is more process than you need
If you pay three suppliers who have not changed their accounts in years, you do not need a payments workflow. You need the one rule: a changed account is confirmed by phone on a known number.
You also do not need to buy anything. The measures above are habits, plus settings your email provider already offers. A software tool might later help log approvals, and that is a conversation for when the rules exist and are being skipped. Until then, a written page and a shared spreadsheet is a good tool.
And if the message is urgent, secretive, or asks you to bypass the usual approver, that is the moment to slow down, not speed up.
We are a software studio, not a security firm, so the controls above are the ones to put in place whoever builds your systems. Where they touch what we build, our rule is the one we give every client: important actions can require human approval, with a record of what happened. A workflow that changes who gets paid is exactly where that approval belongs, and approval gates are part of every Automation Sprint.
If a recurring administrative task is costing your business more time than it should, we offer a 20-minute workflow conversation — one task, and an honest answer about whether automation is appropriate. Get in touch.
More from the blog
AI & Automation
Is It Safe to Put Customer Data Into AI Tools?
Pasting a customer's details into an AI tool is still using personal data under the PDPA. What the PDPC's generative AI guidelines say, what to keep out, and the controls a small business can set up in an afternoon.
Buying Software
Owning Your Code: Why Repository Ownership Matters
Owning your code means the repository, the accounts and the legal right all sit with you. What that looks like in practice, what goes wrong when a vendor holds it, and what to check before signing.