Business Email Compromise and Social Media Impersonation Scams

Business Email Compromise and Social Media Impersonation Scams: A Growing Threat to Organisations

September 18, 2026

Scammers are getting bolder, and Singapore businesses are increasingly finding themselves in the crosshairs.

Business email compromise (BEC) scams have surged dramatically, with losses climbing 193.1 per cent to S$57.3 million in the first half of 2026 alone. Reported cases followed the same troubling trajectory, rising 67.9 per cent to 262 incidents. Behind these figures is a scam that can quietly drain company coffers, often before anyone realises something is wrong.

What Is Business Email Compromise?

Business email compromise is a form of fraud where criminals hijack or convincingly mimic legitimate email accounts to trick organisations into transferring money to accounts they control. Unlike smash-and-grab phishing attempts, BEC scams are patient and calculated. Perpetrators typically:

Spoof or compromise email accounts belonging to businesses, suppliers, clients, or colleagues within an organisation

Use digital manipulation to make fraudulent messages appear authentic — replicating email signatures, letterheads, and even writing styles

Impersonate trusted parties, such as a company’s finance director, a long-standing supplier, or a client awaiting an invoice

Redirect payments to fraudulent bank accounts by requesting last-minute changes to payment details, often citing “urgent” business reasons

The success of these scams hinges on exploiting trust and routine. A finance employee who regularly processes supplier payments may not think twice about an email that looks like it’s from a familiar vendor, especially if it references a real transaction or ongoing project.

Why the Sharp Rise

Several factors likely contribute to this spike. Remote and hybrid work arrangements mean more business is conducted over email and messaging platforms, with fewer face-to-face or phone verifications. Criminal groups have also grown more sophisticated, using research on company hierarchies, social engineering, and even AI-assisted tools to craft messages that are harder to distinguish from genuine correspondence.

The Social Media Impersonation Connection

BEC scams rarely operate in isolation. Fraudsters often use social media platforms — LinkedIn, Facebook, and others — to research targets, identify key decision-makers, and gather details that make their impersonation more convincing. In some cases, scammers go a step further, creating fake social media profiles of company executives or entire businesses to lend credibility to their fraudulent communications, or to reach victims directly through impersonated brand pages and customer service accounts.

This overlap between email-based fraud and social media reconnaissance means organisations need to think about their exposure holistically, not just within their inbox.

How Organisations Can Protect Themselves

While no single measure guarantees complete protection, a combination of practical steps can significantly reduce risk:

Verify payment changes independently. Any request to change bank account details or payment instructions should be confirmed through a separate, previously established communication channel, such as a phone call to a known number rather than one provided in the suspicious email.
Implement dual authorisation for payments. Requiring two people to approve significant fund transfers adds a critical checkpoint that can catch fraudulent requests.
Train staff to spot red flags. Urgency, secrecy, slightly altered email addresses, and unusual requests from senior executives are all common warning signs.
Secure email accounts with multi-factor authentication. This makes it significantly harder for criminals to compromise legitimate accounts in the first place.
Protect sensitive documents and information. Email and messaging platforms are often used to share contracts, invoices, quotations, identification documents, and other sensitive files. Where appropriate, organisations can add another layer of protection by verifying the recipient’s identity before allowing access to confidential documents, rather than relying solely on an email address or password. Solutions such as identi.ly can support this approach by adding identity verification to document sharing, helping organisations ensure that sensitive documents are accessed by the intended recipient. This can be particularly useful when documents contain confidential business, financial, or personal information.
Limit publicly available information. Be mindful of what organisational charts, job titles, and travel schedules are shared on social media, as these details can be weaponised by scammers.
Monitor for impersonation online. Regularly check for fake social media accounts or profiles mimicking your business or executives, and report them promptly.

A Call for Vigilance

The scale of losses from business email compromise scams is a stark reminder that cybercrime isn’t just about stolen data — it’s increasingly about exploiting human trust and organisational processes. As scammers refine their tactics, businesses of all sizes need to treat email verification and payment security not as an afterthought, but as a core part of their operational discipline.

Staying informed, questioning anything that feels slightly off, and building verification steps into everyday financial processes can make the difference between business as usual and becoming the next statistic in next year’s scam report.

Want to strengthen your organisation’s security?

From payment verification to secure document sharing and identity verification, the right processes can help reduce the risk of impersonation and business email compromise.

Book a Free 30-Minute Consultation
Discuss your organisation’s current processes and explore practical ways to strengthen your security.

Source: CNA – Scam cases, losses down in first half of 2026: Cybercrime report

Copyright © 2026 Intercorp Solutions Pte Ltd