Letter from the Table: Amend the Business Fraud Standard for the Details That Decide Recovery

To the Fair Play Council

I am writing in English, but I am carrying into it a concern I hear among Mandarin-speaking business owners here. People describe it in different ways, but the question underneath is often the same: once money has left an account because someone was deceived, what can a small business realistically do before the trail goes cold? I do not claim to speak for every owner in my language community. The episode below is mine.

On 3 March this year, I received an email that appeared to continue an ordinary supplier conversation. It said the payment account for an outstanding invoice had changed. The amount was S$18,640. The message used the right names and referred to the right work. I did not notice that the sender’s address differed by one character from the address I had used before.

I made the transfer from my business account using FAST. Before sending it, I checked the invoice details against the email. I did not call the supplier using a number I had independently saved. That was the mistake. Later that afternoon, I called the supplier’s usual number and learned that no payment details had changed. I contacted my bank within about twenty minutes of finding out, asked for the transfer to be recalled, and made a police report that day. I gave the bank the transfer details and the report reference. I also sent the supplier the fraudulent email so they could warn other customers.

The money was not returned. I understand that a payment sent through a fast transfer system is not like a card payment that I can simply cancel. I am not asking the Council to pretend that recovery is always possible, or that a bank can retrieve money that has already moved on. I am asking for a fair, quick, and visible process while recovery may still be possible.

Singapore has protections and processes, but they do not amount to a general promise that every business payment made after deception will be reimbursed. The E-Payments User Protection Guidelines set duties for financial institutions and users in covered cases. The Shared Responsibility Framework, which took effect on 16 December 2024, addresses defined phishing scams and assigns duties to financial institutions and telecommunications providers. That is important work. But an owner who personally approves a transfer after being misled by a changed invoice may not fit neatly into a framework focused on phishing and its specified duties. A police report is necessary; it does not itself restore working capital. A recall request is also necessary; without clear response times and updates, the owner is left not knowing whether anyone is acting on it.

For a small firm, S$18,640 is not an abstract loss figure. It was money set aside for obligations that still had to be met. I spent time checking messages, supplying documents, calling the bank and explaining the incident to the supplier. That time came out of the same working week in which I had to keep the business operating. The fraudster’s deception was theirs. My failure to call was mine. But that does not answer what a payment provider should do once it receives a credible report of a misdirected payment.

I support the purpose of FP-001, but my stance is amend. Please make the standard more specific before adoption. “Verify payee names” needs to say what verification means in practice: show the sender whether the entered name matches, partly matches or does not match the receiving account, before the transfer is released. Where names are written in different scripts, abbreviated, or represented through transliteration, the process should explain uncertainty rather than silently treating it as a match. The customer should be able to understand the warning without needing technical knowledge.

The standard should also establish a clear, rapid recall process. When a customer reports suspected business email compromise or invoice diversion, the sending provider should promptly contact the receiving provider through a defined channel, request preservation or return of available funds where lawful, and tell the customer when the request was made and what happens next. Providers should record the time of the report, the time of the recall request and the response. A short, published

service target would make “quickly” something an owner can rely on and the Council can later assess.

Finally, the reimbursement language should distinguish between a business that ignored a clear, usable warning and one that was deceived despite reasonable care. It should state how evidence is assessed, how partial recovery affects reimbursement, and how cross-border cases are handled. A small business should not lose access to a fair review simply because the receiving account is in another country. If a provider believes reimbursement is not due, it should give a reasoned explanation and a route to challenge the decision. The standard should not promise an outcome that local law cannot deliver; it should set a meaningful baseline for providers to adopt and explain any limits plainly.