Landing page banner

The Police would like to alert members of the public on business email compromise scams that involve the purchase of gift cards. Since 1 January 2026, at least 25 cases were reported, with total losses amounting to at least $30,000.

In this scam variant, the scammers would send emails to the victims, impersonating as the victims’ CEO or supervisor. The scammers would alter their email display name to appear as victims’ CEO or supervisor and deceived the victims into urgently purchasing gift cards (i.e., Razer Gold, Apple, or Xbox) for work purposes using their own funds. The scammers would assure the victims that they would eventually be reimbursed by the company. The victims would be instructed to provide the scammers with the redemption codes on the gift cards, which the scammers would use, to redeem the gift cards. The victims would subsequently discover that they had been scammed after checking with their colleagues. 

Businesses are advised to adopt the following preventive measures:

1. Brief your staff on this scam variant, especially new employees and interns. 
   
   
2. Be wary of any urgent requests to purchase gift cards, especially in large quantities. 
   
   
3. Always verify with others through a different medium (i.e. phone call, text message or enterprise communication channels) before proceeding with any out-of-ordinary instructions sent via email.
   
   
4. Always make work-related communications through official channels such as company emails. Ensure that the sender's email address corresponds to the legitimate email address of the person they claim to be.
   
   
5. Prevent your email account from being hacked by using strong passphrases, changing them regularly, and enabling Two-Factor Authentication (2FA) where possible. Consider installing free email authentication tools such as Domain-based Message Authentication, Reporting and Conformance, DMARC (dmarc.globalcyberalliance.org), which can help detect fraudulent emails and prevent such emails from reaching users’ inboxes.
   
   
6. Install anti-virus, anti-spyware/malware and firewalls on your computer, and keep them updated. Perform full scans of your machine(s) in your network regularly. You may consider installing free Domain Name System (DNS) protection services such as Quad9 (quad9.net) to protect against such attacks.
   
   
7. Ensure that your Operating System (OS) is up-to-date and update the OS when new patches are made available.
   
   
8. Report to authorities immediately on any scam encounters and make a police report. 

For more information on scams, members of the public can visit www.scamshield.gov.sg or call the ScamShield Helpline at 1799. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community!

Annex A