SINGAPORE — Using his boss’ internet banking tokens to access their company’s corporate bank accounts, Cheng Jun siphoned over S$1 million from the accounts over three years.

On Monday (March 30), the then-financial manager of Sinopay (Singapore) was sentenced in a district court to three years and nine months’ jail. He claimed to have spent the money on gambling at casinos and for his personal expenses.

He had pleaded guilty to 14 counts of illegally accessing computer material under the Computer Misuse and Cybersecurity Act, with another 22 charges taken into consideration for sentencing.

The court heard that Cheng — a Singaporean originally from China — managed Sinopay’s business accounting and human resources, including customer payments and employees’ salaries.

The firm is a subsidiary of the Sinopay Group, which provides professional bankcard and financial services.

In October 2014, Mr Christopher Chuang, the company’s chief executive officer and director, applied for internet banking facilities for the company’s three UOB accounts.

Cheng helped to apply for three internet banking tokens for himself, Mr Chuang and the firm’s general manager.

Cheng and the general manager could give instructions for transactions to be made through the accounts, but Mr Chuang had to give permission first and use his token to approve them.

Cheng then took advantage of the fact that Mr Chuang lived in Hong Kong. When he received the tokens at Sinopay’s Kallang office, he did not mail Mr Chuang’s to him, only sending him the UOB confirmation letter.

Unaware of the existence of the physical banking tokens, Mr Chuang signed the letter and sent it back to Cheng.

Cheng managed to keep all three tokens after pulling the same stunt with the firm’s general manager.

When he received the initial passwords to the three UOB accounts, he logged into them and used Mr Chuang’s internet banking credentials to activate the assigned banking token, then changed the password without Mr Chuang knowing.

Armed with the tokens, Cheng transferred a total of S$1,293,497 to his own bank accounts between January 2015 and March 2017.

In order to hide his crimes, he indicated that the transfers were for work-related purposes. He also included random dollars and cents to the sums he wanted to transfer to make the transactions look legitimate.

In February 2017, Mr Chuang returned to Singapore to apply for Sinopay to be publicly listed. He then discovered multiple unknown transfers out of the company’s accounts and confronted Cheng after checking with UOB.

On March 3 that year, Cheng returned S$20,000 to Sinopay’s account after suspecting that the firm had found out about his actions.

During investigations, the police also froze his OCBC account with S$135,400 in it and his wife’s account with about S$11,000 in it. The sums will be returned to the company.

Meanwhile, a Nissan Qashqai that Cheng had bought with the money he took was returned to the firm and sold for about S$63,000.

Deputy Public Prosecutor Jordon Li, who sought five years’ jail, told the court that Cheng had abused the trust of his firm and showed “substantial premeditation”.

Cheng’s lawyer Amarjit Singh Sidhu asked for 45 months’ jail instead, saying that some of the money was recovered and that Cheng was remorseful.

As a first-time offender, he could have been jailed for up to two years, fined up to S$5,000 or both for each charge.