StarLabs Glossary / Cybersecurity & Network Terms
Phishing & Business Email Compromise
Fake messages that trick staff into handing over passwords, data or money.
Phishing is a scam where criminals send emails, texts or messages that pretend to come from a trusted source, to trick people into clicking a link, entering a password or opening malware. Business email compromise (BEC) is a targeted form where attackers impersonate a boss, supplier or customer to get staff to pay money into the wrong account.
How it works
Phishing works because it targets people, not technology. CSA’s Singapore Cyber Landscape 2024/2025 reported a 49% increase in phishing attempts reported locally, to around 6,100 cases in 2024, with banking and financial services the most spoofed industry.
| Type | What it looks like |
|---|---|
| Credential phishing | “Your Microsoft 365 password expires today” with a link to a fake login page |
| Malware attachment | A fake invoice, delivery notice or quotation that installs malware when opened |
| Smishing and messaging scams | SMS or WhatsApp messages posing as banks, couriers or government agencies |
| CEO fraud (BEC) | “I’m in a meeting, please make this urgent transfer” from what looks like the director’s email |
| Invoice fraud (BEC) | A real supplier’s email account is hacked, or copied, and sends “updated bank details” |
BEC is especially damaging because there may be no malware or link at all. The attacker often reads a hacked mailbox for weeks, learns how invoices are paid, then steps into a real email thread at the right moment. The message looks normal, uses the right names and arrives when a payment is expected.
Warning signs to train staff on:
- Urgency or secrecy: “do this now”, “don’t tell anyone”.
- A change of bank details, especially by email alone.
- A sender address that is slightly wrong, or a reply-to address that differs from the sender.
- Links that point somewhere unexpected when you hover over them.
- Requests for passwords, one-time codes or gift cards.
What it means for your business
Make one rule non-negotiable: any new or changed bank details are confirmed by phone, using a number you already have, never one in the email. Turn on MFA for every mailbox, set up email authentication (SPF, DKIM and DMARC) for your domain, and run short refresher training. If a phished account exposed customer data, check your duties under the PDPA and the data breach notification rules. StarLabs can harden your email setup, enforce MFA and help you respond if an account is compromised.
Common questions
What should a staff member do after clicking a phishing link?
Tell IT straight away. Change the password from a different device, sign out of all sessions, and check the mailbox for new forwarding rules. Quick action limits the damage.
Where can we report phishing in Singapore?
Phishing emails can be reported to SingCERT through CSA’s “Report a Phishing Email” page. If you are unsure whether something is a scam, CSA points people to the 24/7 ScamShield Helpline at 1799. Report any money lost to the police.
Can email filters stop BEC?
They help, but BEC emails often contain no malware or links, so filters miss them. Payment verification by phone is the most reliable defence.
Worried a staff mailbox has been compromised?
StarLabs can check, lock it down and tighten your email security.
Sources: CSA Singapore Cyber Landscape 2024/2025, CSA: Report a phishing email, CSA: Report an incident
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
