JE Cleantech's dividend BEC: a fake DTC email diverts $795K (2026)

Public dividend-declaration filings are a legal disclosure requirement and cannot practically be hidden, so the realistic control is not suppressing this information but tightening verification on the payment-execution steps (Stages 3 and 5) that an attacker would exploit once they know the payment window.

Look-alike domains and spoofed sender identities are hard to block universally at the inbound-email layer; DMARC/DKIM/SPF enforcement and brand-impersonation email filtering reduce but do not eliminate this risk, making out-of-band verification of any new instruction (Stage 5) the more reliable backstop.

Email-security controls such as external-sender banners, attachment/link sandboxing, and impersonation-detection filters tuned to flag messages purporting to be from known financial-market utilities can catch some fraudulent DTC-branded email before it reaches a decision-maker.

Staff handling payment instructions should be trained that a request arriving through the expected, familiar channel is not itself evidence of legitimacy, and that live/urgent payment context is precisely when fraud is most often timed to land.

Any change to or first receipt of wire instructions for a financial intermediary should be verified through an independent, previously-established channel, such as a phone call to a known number, not one contained in the email, before funds move; dual sign-off/maker-checker approval should be mandatory for dividend and other large outbound wires regardless of counterparty prestige.

promptly notify the sending and receiving banks and law enforcement, preserve evidence and request available recall or freezing procedures. JCSE reported the fraud to both banks, the FBI's IC3 and Singapore Police; these actions do not establish a recovery.