Authorities have seized more than $41 million stolen from a Singaporean commodities firm in a business email compromise scam (BEC), Interpol announced Monday. 

The exceptionally large sum was stolen from the company through a simple but common trick — the impersonation of one of the company’s suppliers by changing a single character in the email address. On July 15, the purported supplier requested payment to an account based in Timor Leste, and four days later $42.3 million was transferred. 

Only when the real supplier complained about not having been paid did the company realize what had happened. 

The Singapore Police Force contacted authorities in Timor Leste, who were able to trace $39 million to the scammer’s bank account. Police in Timor Leste also arrested seven suspects and recovered another $2 million believed to be connected to the theft. 

According to Interpol, the global cooperation was made possible through its I-GRIP mechanism, a police network set up in 2022 across 196 countries intended to expedite requests in cases involving financial fraud. The agency says that as of the end of 2023 I-GRIP had resulted in the recovery of more than a half billion dollars.

“Speed is crucial to successfully intercepting the proceeds of online scams, with police, financial intelligence units and banks cooperating across multiple jurisdictions in a race against time,” said Isaac Oginni, director of INTERPOL’s Financial Crime and Anti-Corruption Centre (IFCACC), in a statement.

“The cooperation between authorities in Singapore and Timor Leste in this case was exemplary and demonstrates how quick action through INTERPOL can help recover funds taken from the fraud victims and identify the perpetrators.”

In the U.S. alone, the FBI found that BEC scams in 2023 resulted in $2.94 billion in losses.