Singapore Police Recover US$12.8 Million Lost to a Business Email Compromise Scam via Cambodia
A Singapore petrochemical firm paid US$12.8 million to a scammer's account in Cambodia after a fake change of bank details. Police, OCBC and Cambodian police got it all back.
Singapore police have recovered the full US$12.8 million that a Singapore-based petrochemical company sent to a scammer's bank account in Cambodia. The Singapore Police Force's Cyber Command worked with OCBC and the Cambodian National Police, and Cambodia's state news agency says the funds were intercepted and returned with help from the National Bank of Cambodia.
How the scam worked
On 1 October the company got an email that appeared to come from a business counterpart, with revised payment instructions pointing to a new account. Staff queried it. The scammers replied with an authorisation letter bearing the counterpart's signature and company stamp, and the company paid on 13 October. The letter was forged.
The real counterpart said on 26 October that it hadn't been paid, and the company went to the police that day.
Police haven't named the company or reported arrests. Whether the counterpart's mailbox was hacked or its address faked isn't public; Cambodian police describe "a counterfeit email address".
What police tell businesses to do
The police advice is to confirm any new or sudden change to payment details by calling the counterpart on an independently verified number, never on contact details from the same email thread. Businesses hit by this kind of scam can call the police hotline on 1800-255-0000.
More news
Binance Security Incident: Withdrawals Paused, $2.54 Billion Frozen
Trackers saw billions in crypto leave Binance's hot wallets on 29 October. Binance calls it a security incident, has paused withdrawals on several networks and says $2.54 billion is frozen.
eMudhra Distrust: macOS Command-Line Tools Still Trust the Compromised CAs, Apple Says
Apple confirms curl, git and python3 on macOS still accept the compromised eMudhra certificates. What Apple, Microsoft, Cisco and Google tell admins to do.
Linux Kernel TCP Flaw CVE-2026-98432: Patched Kernels by Distribution, Ubuntu Pending, RHEL Deferred
A use-after-free in the Linux kernel's IPv4 TCP handshake, scored 9.8 in the CVE record. Fixed upstream since 15 October; here is what each distribution has shipped.