In brief
In a cross‑border cyber‑crime investigation, Singaporean authorities and Cambodia’s police successfully recovered $12.8 million that had been siphoned from a local petrochemical firm through a business‑email‑compromise (BEC) attack. The illicit funds were routed to a Cambodian account, where the National Bank of Cambodia froze the transfer after a coordinated effort. Cyber‑security experts highlight BEC as the most common phishing variant, emphasizing the need for vigilant authentication procedures in corporate finance departments.
On 29 October 2026, Singapore’s petrochemical industry celebrated a rare win in the fight against cyber‑fraud when investigators traced and recovered 12.8 million United States dollars that had been siphoned from the firm through a sophisticated business‑email‑compromise (BEC) attack. The original transfer, executed on 13 October, was manipulated by attackers who spoofed the corporate email domain to masquerade as an authorized executive, tricking finance staff into approving a payment to a bank account in Phnom Phèn, Cambodia.
Business Email Compromise is a form of phishing wherein fraudsters impersonate company executives or trusted partners, luring employees into authorizing fraudulent wire transfers. It is currently the most prevalent phishing variant, accounting for 51.2 percent of phishing incidents, according to a recent Businesswire report. HR, finance, and executive leadership departments are cited as the most vulnerable targets, a trend mirrored in the Singapore case where the finance team was duped into initiating the bad‑money transfer.
The Singapore Police Force, alerted to the anomaly by internal audit after the clearance of the payment, immediately requested assistance from Cambodia’s General Commissariat of National Police (GCNP). The GCNP began a joint operation on Monday, leveraging its relationship with the National Bank of Cambodia to trace the flow of funds.
Through this collaborative effort, the General Commissariat of National Police coordinated with the National Bank of Cambodia and other relevant institutions to successfully freeze the aforementioned funds and return them to the victim, the GCNP press release stated.
Covering the legal steps involved, the National Bank of Cambodia acted swiftly upon GCNP notification to place a halt on the Cambodian account that had received the wire. The funds were then transferred back to the Singaporean company’s original account, restoring the $12.8 million in a matter of days, a process that underscores the importance of cross‑border cooperation in cyber‑crime investigations.
The Singapore‑Cambodia partnership extended beyond mere financial recovery. Both law‑enforcement agencies exchanged forensic analysis of the email chain, revealing that the attackers had employed “pharming” techniques to redirect email traffic. By controlling the domain’s DNS records, the fraudsters ensured that legitimate emails from the petrochemical firm were funneled through compromised servers, further obscuring the origin of the malicious instructions.
While the United States dollar amount recovered is headline‑making, the incident also highlights a broader trend: cyber‑criminals increasingly target multi‑nation supply chains, exploiting weak authentication practices in cross‑border wire transfers. Security researchers advise that companies bolster their ‘two‑factor authentication’ for payment authorizations and employ domain‑based email authentication protocols such as DMARC, DKIM, and SPF to prevent spoofing.
In the aftermath, Singapore authorities issued a advisory to businesses, warning them to remain cautious about falling for BEC scams, a message echoed by a Singapore‑based industry association. They emphasized the need for continued employee training and the implementation of stringent verification checks for high‑value wire operations.
Authorities also described the audit trail that allowed them to reconstruct the attempted transfer. Forensic experts replayed the timestamped email headers, confirming that the purported sender’s IP address did not match any legitimate corporate server, and matched the source IP range of a known fraud ring operating out of Southeast Asia.
Ultimately, the successful recovery of the full amount demonstrates the efficacy of coordinated legal frameworks and real‑time frozen‑account protocols in combating BEC, offering a template for other jurisdictions facing similar cross‑border financial frauds.