One changed character. US$42.3 million. A Singapore business email fraud case

From the account-change email to discovery

INTERPOL also announced the international recovery effort on August 6. At the time of the announcements, arrangements to return the funds to the victim were still underway. INTERPOL announcement, August 6, 2024 ↗

The point to carry into a payment process is that the real supplier's nonpayment report exposed the fraud. “Transfer completed” in your banking system does not mean the contractual counterparty received the money. After an approved bank-account change, a separate confirmation of the first payment's receipt can provide another useful check.

The public accounts do not disclose internal approval screens or conversations between employees. They do not establish precisely which checks were performed or omitted. The address comparison and response workflow below are fictional examples for reviewing your own process.

Transferred, frozen, recovered, and returned mean different things

A headline about recovering more than US$40 million can sound as though the financial outcome is settled. Each stage in the movement of funds has a different meaning.

Do not subtract the secured amounts from the transfer and call the difference the final loss. Returning funds involves further steps, and the announced figures are not a final settlement statement. The freeze and additional recovery figures come from Singapore Police; both announcements describe the return process as ongoing at publication.

Use the same distinctions in an internal incident record. If your bank says it has sent a recall request to the recipient's bank, record “Recall requested.” Do not change the status to “Frozen” or “Returned” without confirmation. Retain the contact time, institution, and response, then update the status as new information arrives.

The outcome illustrates why prompt reporting and cooperation matter. It does not establish a safe window after a transfer or guarantee recovery when a report is made within a particular number of hours. The route taken by the funds and the actions available to banks and law enforcement will differ.

Expand the full sender address and check where a reply would go

Imagine a Finance employee receives an account-change request that appears to come from Lime Trading. The inbox shows a familiar “Lime Trading Finance” name and a subject related to the current payment. Recognizing the name can make it easy to overlook the actual address.

1. Open the address beneath the display name

The display name is a readable label. The From address is the complete email address presented as the sender. Open the sender details in your mail application. On a phone, where an address may be shortened, use a view that reveals it in full.

The first domain is lime.example; the second is llme.example. Recognizing a familiar name and roughly similar spelling can hide that difference. Compare the received address with a previously verified supplier record, side by side. Quoted conversation history or a signature inside the suspicious message is not an independent reference.

2. Compare both sides of the @ sign

The mailbox name appears before @; the domain follows it. In the fictional example, billing stays the same while the domain changes. An address could instead retain the domain but change billing to bllling. A difference on either side calls for checking why the contact address changed.

An exact match still does not authorize a transfer. A legitimate account may be compromised, or the visible sender address may be forged. Address comparison helps identify a discrepancy; changing payment details requires independent confirmation from the supplier.

3. Check the reply destination as well

From: "Lime Trading Finance" <billing@llme.example>
Reply-To: settle@accounts.example
Subject: New bank account for this month's payment

Reply-To specifies a separate reply destination. A normal reply to this example would go to settle@accounts.example, rather than billing@llme.example. You can inspect that difference in the message details and the recipient field of the reply window. The From and Reply-To fields ↗

A different Reply-To is not proof of fraud. Support platforms and shared departmental mailboxes legitimately use it. But replying to an unfamiliar destination to ask whether an account-change request is real lets the requester confirm their own story. Use an independent route.

In this fictional situation, Finance holds the payment and calls the number already in the verified supplier record. If the supplier denies the change, Finance leaves the new account unregistered and passes the original message to the security team. Specific observations help: “The i in the address was replaced with l, and Reply-To was unfamiliar.” The FBI recommends checking addresses carefully and confirming payment changes separately. FBI BEC prevention guidance ↗

DMARC PASS does not confirm a supplier's payment instructions

Would a DMARC pass make the request trustworthy? DMARC establishes whether the From domain aligns with a domain that passed authentication. It does not establish that the bank account belongs to the supplier or that the employee is authorized to change it.

In the second row, DMARC evaluated llme.example. It does not judge whether that name resembles the familiar lime.example. A company's DMARC policy does not control unrelated domains owned by other parties. The scope of the DMARC standard ↗

Domain authentication, inbound email security, and payment controls each have a role. When sharing an authentication result with Finance, the security team should include which From domain the result belongs to, alongside the word PASS.

The original message and its authentication results from the Singapore incident were not published. These examples explain technical boundaries; they do not establish that DMARC was absent or that a particular setting would certainly have prevented the incident. For a closer look at the headers, see why SPF and DKIM can pass while DMARC fails.

If payment has already been made, start the bank contact immediately

The fictional employee above catches the discrepancy before payment. If it is discovered afterward, the priorities change: the funds can move while the email is being examined. Finance should immediately tell the sending bank that the transfer may be fraudulent and request available contact, recall, or recovery action through the recipient's bank. Report the incident to law enforcement as well. FBI incident-response guidance ↗

Assign work so the bank contact does not wait until every document has been collected. One person can speak with the bank while others fill in the record. Separately check scheduled transfers and payments awaiting approval to prevent additional money from leaving.

Gather the details needed to identify the transfer

“We received a fraudulent email” does not identify which payment needs action. Provide the confirmed transaction details at the first contact and mark unknown fields as under investigation. Requirements vary by institution; use this example to organize the information internally.

Incident owner / reachable phone number:
Discovery time / time zone:
Transfer time / time zone:
Amount / currency:
Sending bank / transaction reference:
Receiving bank / country / beneficiary / account number:
Request received at / From / Reply-To:
What the genuine supplier confirmed / verification route:
Other payments still pending:
Location of original email / payment evidence:
Bank and law-enforcement case references / next follow-up:

Include time zones in international cases. “3 p.m.” in two countries may refer to different moments. Compare transaction references and account numbers with the bank's transfer record to avoid errors introduced by retyping. Submit sensitive details and original messages through the channels specified by the bank or investigating authority.

Preserve both what the employee saw and the original message

A screenshot can explain the display presented to the employee. Investigating the delivery route and authentication requires the original message with full headers as well. Download it through the mail service or ask an administrator to preserve it. Avoid reopening an attachment simply to inspect it again.

Security staff can look for other recipients of related sender addresses, reply addresses, and subjects. If there are signs of a legitimate account being misused, review sign-ins and forwarding rules too. Receiving an impersonation email does not itself establish that your account was compromised. Separate confirmed facts from the questions still being investigated.

Before any incident, record the bank's fraud contact route, verified supplier contacts, and who can preserve email evidence. The person who notices an address discrepancy needs a direct way to hold the payment and reach those owners. That is what makes a one-character difference actionable.