SME Payment Verification in Singapore: Who Pays When a Scam Hits Your Company Account?

If a scammer tricks your company into paying the wrong bank account, your SME almost certainly absorbs the loss. Singapore's Shared Responsibility Framework, in force since 16 December 2024, assigns duties to banks and telcos and is built around individual account holders. Corporate accounts generally sit outside it. The practical conclusion is that payment verification is now your control, not your bank's. Before the festive ordering rush and the Chinese New Year 2027 prepayment run, the fix is a written rule for every outgoing payment: who checks it, what they check it against, and which amount triggers a second pair of eyes.

Who actually pays when a scam hits a business account?

Three separate things get confused here, and the difference decides who carries the money.

The Shared Responsibility Framework deals with phishing scams, where a victim is deceived into handing over credentials. It sets out duties for financial institutions and telcos, and where those duties are breached, the affected individual can be made good. Its design centre is the retail consumer.

The E-payments User Protection Guidelines give limited protection for unauthorised transactions to consumers and micro-enterprises, which for this purpose means a business with annual turnover below S$1 million. Confirm your own standing with your bank in writing rather than assuming it, because the protection depends on account type and on you reporting promptly.

Neither of those covers the case that actually catches SMEs. Business email compromise is an authorised transaction: your own staff member logged in correctly, approved correctly, and paid the account they were told to pay. The bank executed a valid instruction. There is no mis-sold product and no systems failure, so there is nothing to claim against.

Your insurance may not catch it either. A standard cyber policy covers data breach and business interruption; money paid away through social engineering is usually excluded unless you have specifically bought a fraudulent funds transfer or crime extension. Ask your broker to confirm the sub-limit and the deductible at your next renewal, because an SME with a S$1 million cyber policy and no crime extension is uninsured for the single most likely fraud it will face.

Which payments are most likely to go wrong before February?

Three patterns cause most SME losses in Singapore, and all three get worse in the next four months.

The supplier bank-change email. A long-standing supplier emails to say their account has moved, often with a plausible reason such as a bank merger or a new entity. The email thread is real, because the fraudster is inside it. One invoice goes to the new account and nobody notices until the supplier chases payment 45 days later.

The new supplier for festive stock. Buying pressure in October and November pushes teams to source from vendors they have never paid before, frequently with a deposit upfront. There is no payment history to compare against, so an entirely fake vendor looks identical to a real one.

The urgent transfer while finance is on leave. From mid-December through the Chinese New Year break, approvals move to phone and messaging apps, the usual approver is away, and the stand-in does not know what normal looks like. Factory prepayments before a February shutdown are large, time-pressured, and often to a first-time account. That combination is exactly what fraudsters wait for.

What does a payment verification rule look like in practice?

One page, six rules, applied without exception. The strength of this control is that it is boring and absolute, not that it is clever.

1. No bank detail change by email, ever. A change is accepted only after a voice call to the number already on your supplier file, never a number in the request.
2. Call back, do not call forward. The person who verifies is not the person who received the request, and they use the stored contact record.
3. Dual approval above a threshold. Pick a figure that matters to your business, commonly S$5,000, and require two named approvers in the bank's own system, not in an email chain.
4. Match the PayNow or account name. If the registered name shown by the bank does not match the invoice name, the payment stops. A mismatch is a hard stop, not a judgement call.
5. Onboard new suppliers properly. UEN checked against ACRA, a bank letter or bank-headed confirmation of the account, and the first payment held for 24 hours.
6. Name a holiday approver in writing. Before anyone goes on leave, record who approves what and up to what amount, and tell the bank.

How much does this cost and what does it save?

The software cost is usually zero. Dual authorisation is a standard feature of corporate internet banking in Singapore and is free to switch on. The real cost is time: roughly 10 minutes per bank detail change, 15 minutes per new supplier, and one hour to write the page and brief the team.

Set that against a single successful invoice fraud. For a trading or retail SME, one hijacked supplier invoice commonly runs between S$20,000 and S$80,000, and recovery after the funds leave Singapore is rare. A control that costs about two hours a month to operate and removes the most likely five-figure loss of the year is the cheapest line in your risk budget. If you are building a case for automation spend this budget season, this is the version of the argument that needs no modelling.

Does your own domain make your customers a target?

Verification runs both ways. If your sending domain can be spoofed, fraudsters send fake invoices in your name to your customers, and your business absorbs the dispute, the goodwill damage and the credit risk even though nothing of yours was breached.

Two fixes matter. Get DMARC to an enforcing policy so spoofed mail from your domain is rejected rather than delivered. Then make your invoices hard to fake: sequential numbering, bank details that never change, and a standing line on every invoice telling customers you will never notify a change of bank account by email. Tell your top 20 customers that rule once, in writing, before the festive peak.

What should you do in the next two weeks?

Five actions, all completable before the end of October.

1. Write the one-page verification rule and have the directors sign it.
2. Switch on dual authorisation in your bank portal and set the threshold.
3. Verify by phone the bank details of your 10 largest suppliers and date-stamp the file.
4. Ask your broker, in writing, whether social engineering fraud is covered and at what limit.
5. Name the December and February approvers and circulate the list.

None of this requires new software, and all of it is in place before the first festive deposit leaves your account.

Frequently asked questions

Does the Shared Responsibility Framework cover my company's bank account?

Generally no. The framework is built around individual account holders who lose money to phishing scams, and corporate accounts are not its target. Ask your bank to confirm in writing how your specific account type is treated, and treat the answer as the baseline for your own controls rather than a substitute for them.

We already use two-factor authentication. Is that enough?

No. Two-factor authentication stops someone logging in as you. It does nothing when your own staff member logs in properly and pays a fraudulent account because the invoice looked right. Login security and payment verification are different controls, and invoice fraud defeats the first one by design.

Can we recover money already sent to a scam account?

Sometimes, if you move within hours. Call your bank's fraud line immediately, file a police report, and ask the bank to attempt a recall. Funds that have been moved on or sent overseas are usually gone. Speed is the only variable you control, which is why your team should know the fraud line number before they need it.