In July 2026, the Singapore Police Force investigated 255 people across the island for suspected roles in scams and money laundering. The sweep covered more than 660 cases and about S$5.6 million in losses.
The suspects, aged 16 to 77, were allegedly acting either as scammers or as money mules, moving stolen funds through their own accounts.
For finance leaders, the arrest count is only part of the story. The money moved much like legitimate payments do: through ordinary transfers that cleared before anyone confirmed who was actually on the other end.
Scam losses are falling, but remain close to a billion dollars
Singapore recorded 41,974 scam cases in 2025, down almost a quarter from the year before. Reported losses also fell, from S$1.1 billion in 2024 to S$913.1 million, according to the Singapore Police Force.
Recovery improved too. Police returned more than S$140 million to victims and prevented a further S$348 million in losses through intervention.
But the remaining scale matters. Even after a significant decline, scam losses in one city-state came close to a billion dollars. Business email compromise (BEC) also ranked among the five scam types responsible for the highest losses.
BEC doesn't necessarily depend on malware or a technical breach. It can be as simple as a believable payment instruction reaching someone with the authority to approve it. That puts finance teams directly in the path of the attack.
The payment approval is where the loss happens
In April 2026, a Singapore commodity trading firm lost US$6.6 million to a BEC scam after fraudsters spoofed a vendor's email address, transposing two letters so it was almost indistinguishable from the real one.
The firm approved the payment and discovered the fraud two days later.
In this case, the money was fully recovered through coordinated work between the Singapore Police Force, HSBC Singapore and law enforcement in the UAE and Oman. But cross-border recovery depends heavily on how quickly fraud is detected and whether the funds can still be traced and frozen.
The methods are also becoming harder to spot. Voice and video impersonation now sit alongside spoofed email domains, but they target the same weakness in the payment process.
In another case highlighted by the Singapore Police Force, a Singapore chief executive approved US$36.3 million in transfers over four days after a WhatsApp call impersonating his company's chairman.
The channel was different. The underlying exploit wasn't: an instruction appeared to come from someone with the authority to give it, and money moved before that identity was independently confirmed.
Put verification before payment
Across these cases, the critical point isn't where the scam started. It's where the money left.
That's the point finance teams can control most directly.
Changes to a vendor's bank details should be confirmed through a separate, independent channel using contact details already on file, rather than details supplied in the request. Urgency or secrecy around a payment should trigger additional scrutiny, regardless of who appears to be asking. Large or unusual transfers should also be checked against the confirmed owner of the destination account, not simply the name on an invoice or payment instruction.
Enforcement can disrupt scammers and money mules after fraud has occurred. Finance teams have an opportunity to intervene earlier, at the point a payment is approved.
That's the point Eftsure is built to protect. Its payment assurance technology helps finance teams confirm who they're paying before money leaves the business.
It's also why Eftsure recently launched in Singapore, extending that verification to finance teams across the region and helping organisations build stronger controls around every payment before money moves.
