$40 Million Stolen from Singapore Company in BEC Scam Recovered in Interpol Operation

• Interpol recovered north of $40 million in funds defrauded in a business email compromise scam.
• The scam targeted a commodity firm based in Singapore, which transferred the money to an apparent supplier.
• Seven suspects have also been arrested upon further investigations.

Interpol's Financial Crime and Anti-Corruption Center intercepted $42.3 million stolen from a commodity company, helping Singapore authorities recover the largest amount of funds defrauded in a business email compromise (BEC) scam.

The money belonged to a commodity firm based in Singapore, which filed a police report on July 23 after becoming aware of the BEC scam they had fallen victim to on July 15.

The cybercriminals sent an email to the victim from an email address with a slightly different spelling than the legitimate one belonging to the entity they were impersonating. 

Pretending to be one of the suppliers working with the Singapore firm, the threat actors requested to get a pending payment to a new bank account based in Timor Leste, and the company failed to notice the scam and transferred the money.

The Singapore Police Force (SPF) and authorities in Timor Leste employed Interpol's Global Rapid Intervention of Payments (I-GRIP) mechanism. This global stop-payment mechanism uses a police network of 196 countries for assistance in financial crime cases.

On July 25, $39 million was detected and withheld from the fake supplier’s bank account in Timor Leste, where seven suspects were also arrested, leading to the recovery of another $2 million.

Now, the last step would be to facilitate the return of the stolen funds to the Singapore-based company.

Recently, threat actors exploited a critical in-the-wild Proofpoint email protection service flaw to steal funds and credit card details via millions of perfectly spoofed phishing emails impersonating Proofpoint customers such as Disney, IBM, Coca-Cola, Nike, Best Buy, and more.

An email-spoofing vulnerability recently emerged as well, allowing anyone to impersonate a Microsoft corporate email, sending email messages from any user and domain.