If scammers are using your company’s name, logo or directors’ faces to cheat the public, your company is not usually legally liable to the victims simply because a criminal pretended to be you. The risk rises if your own systems were compromised, your customer data leaked, or you knew of the scam and gave customers misleading assurances. Act quickly: collect evidence, make a police report, report to ScamShield and the platforms, publish a clear notice of your official channels, and use your trade mark rights to speed up takedowns. Most insurance will not compensate the victims, but some cyber policies help with response costs.
How do impersonation scams use a company’s name?
An impersonation scam borrows the trust attached to a real business. Common patterns in Singapore include:
- Fake websites and online shops copying your logo, product photos and address, taking payment for goods that never arrive.
- Fake customer service numbers posted on search results, maps listings or forums, so callers reach the scammer instead of you.
- Fake job offers on WhatsApp or Telegram using your company name, asking applicants to pay for “tasks” or hand over Singpass or bank details.
- Fake social media pages and ads offering giveaways or discounts to harvest card details.
- Deepfake videos of your founder or CEO endorsing an investment scheme.
- Fake invoices sent to your customers from a lookalike email domain, asking them to pay a “new” bank account.
The last pattern overlaps with business email compromise. When fraudsters impersonate your executives to your own staff, the issue is your company’s loss, which we cover in our sibling article on whether insurance covers scam payments by staff. This article deals with the outward-facing problem: the public, your customers or job seekers being cheated in your name.
Is your company liable to people who were scammed?
Generally, a business is not responsible for the independent criminal acts of strangers who misuse its name. A victim would need a legal basis, such as a contract with you, a duty of care you owed them that you breached, or a misrepresentation you made. Exposure becomes more realistic in these situations:
| Situation | Why it may create exposure | What to look at |
|---|---|---|
| Your real email or WhatsApp Business account was hacked and used to send fake payment instructions | A customer may argue your company failed to take reasonable security measures | Your security measures, the customer contract, your cyber and professional indemnity policies |
| Customer data leaked from your systems and scammers used it to target those customers | Possible breach of the PDPA protection obligation, PDPC action and civil claims by affected individuals | Breach assessment, PDPC notification, cyber policy privacy cover |
| Staff confirmed a fake account or website as genuine when customers asked | A statement by your company may be relied on as a representation | Staff scripts, call records, complaint handling |
| Purely external spoofing with no access to your systems | Usually no legal liability, but reputational and commercial pressure | Speed and clarity of your public warnings |
Even where you are not liable, customers may ask for goodwill gestures. Before offering compensation, consider whether a payment could be read as an admission and, if a claim is possible, notify your insurer first. If a lawyer’s letter arrives, see our guide on responding to a letter of demand without making it worse.
What should you do when you discover an impersonation scam?
- Capture evidence. Take screenshots with URLs, dates and times, save phone numbers, social media handles, bank account details given to victims, and any victim messages forwarded to you. Record the domain name and, if visible, its registrar and hosting provider.
- Make a police report. Report the impersonation to the Singapore Police Force, and give the bank account and phone numbers being used. Ask customers who lost money to make their own reports, since the losses are theirs.
- Report to ScamShield. Use the ScamShield reporting channel and tell the public they can call the ScamShield Helpline at 1799 if unsure whether a message is genuine.
- Report to platforms and registrars. Use the impersonation and intellectual property reporting tools of the social media platform, messaging app, search engine, app store, domain registrar or host. A registered trade mark certificate and proof of company identity usually speed this up.
- Report phishing sites to SingCERT. The Cyber Security Agency of Singapore’s SingCERT accepts reports of cyber incidents, including phishing websites.
- Publish a notice. Put a dated warning on your website and verified social media accounts, listing your only official domains, phone numbers and payment accounts, and saying what you will never ask customers to do.
- Brief your staff. Give front-line staff a script so they confirm only official channels and log every report.
- Check your own systems. Confirm that your email domain, social media accounts and customer database have not been compromised. If they have, the matter becomes a data breach response with PDPA deadlines.
- Notify your insurer if any claim against you is possible, or if your cyber policy covers crisis communications or response costs.
What can the Online Criminal Harms Act do?
The Online Criminal Harms Act 2023 (OCHA) gives the government powers to act quickly against online activity connected with crime. The provisions allowing directions against scam-related online activity came into force on 1 February 2024. According to the Singapore Police Force, a designated officer may issue directions to online service providers, entities or individuals, and for scams and malicious cyber activity the threshold is lower: the officer need only suspect or have reason to believe that the online activity is preparatory to, or in furtherance of, such an offence.
Directions can require, for example, that content be taken down or disabled, that an account be restricted, or that access to a website or app be blocked in Singapore. Non-compliance can lead to access blocking, app removal or service restriction orders.
OCHA is a government power, not a private takedown right. Your company’s role is to give the police clear, well-organised evidence quickly, which helps the authorities decide whether to act. In parallel, continue with platform reports, which are often faster for a single fake page.
Can you use trade mark or passing off law?
Yes, and these rights help even when you cannot identify the scammer.
- Registered trade mark. A Singapore trade mark registration makes platform and registrar complaints much more effective, because many intellectual property reporting tools ask for a registration number. If your name and logo are not registered, see our guide to trade mark registration with IPOS.
- Passing off. Without a registration, a business with goodwill in Singapore may rely on passing off where someone misrepresents a connection with it. Our article on passing off and protecting your business name explains the elements.
- Court action against anonymous scammers is rarely practical, but lawyers can sometimes seek orders against identifiable parties, such as a local person who registered a lookalike domain or company name.
Scammers sometimes also misuse government names to target business owners. Our guide on telling a real ACRA message from a fake one covers that variant.
What happened when well-known names were impersonated?
Shopee job scams (2023)
In May 2023, the Singapore Police Force and Shopee Singapore issued a joint advisory on fake online job scams. Scammers contacted people on WhatsApp or Telegram posing as Shopee employees, sometimes with fake staff identification, and sent them to a fake Shopee website where they were asked to pay for “task packages”. The police said at least 46 victims had lost at least S$753,000 since March 2023. Shopee set out its official contact channels, stated that it did not have the “Shopee Assistant” role the scammers advertised, and asked the public to report the scammers to the messaging platforms.
Singapore Airlines fake hotlines and pages (2024)
In August 2024, as reported by The Straits Times, Singapore Airlines warned customers that phishing websites, emails, text messages, social media accounts and phone calls had falsely claimed to be from the airline. Fake hotline numbers had been posted online, including on map listings and forums, and fake social media accounts ran discount advertisements to collect personal data. The airline told customers to use only the hotline numbers on its official website. This is a useful model: name the channels that are genuine, rather than only describing the fakes.
Deepfake videos of leaders (2023 to 2024)
In December 2023, then Prime Minister Lee Hsien Loong warned the public, as reported by CNA and other outlets, about deepfake videos using his likeness to promote a cryptocurrency investment scheme. He issued a further warning in June 2024 about another deepfake investment video. If public leaders with official channels are impersonated this way, a company founder who appears in interviews or videos can be too.
Does insurance help?
Usually only partly. Insurance responds to your company’s own losses or legal liability, not to losses the public suffered at the hands of strangers.
- Cyber policies may pay incident response, forensic and crisis communications costs if your systems were compromised. Some include brand protection or reputational harm sections, often sub-limited. Purely external spoofing, with no breach of your systems, may not trigger cover at all. Our sibling article on cyber insurance for Singapore SMEs explains the sections.
- Professional indemnity and cyber liability sections may defend your company if a customer claims you were negligent, for example because your hacked email sent fake payment instructions. They will not pay victims where your company has no legal liability.
- Media liability cover protects against claims about your own published content, such as defamation or infringement, not against others impersonating you.
Policies typically require prompt notice and forbid admissions or settlements without consent, so speak to your insurer before promising compensation.
Example: a fake online shop and a hacked WhatsApp account
Example: A Singapore bakery finds a lookalike website taking festive orders in its name. Separately, its WhatsApp Business account is taken over and used to send customers a “new” PayNow number.
- For the fake website, the bakery reports it to the police, ScamShield, SingCERT and the domain registrar, and posts a notice listing its genuine domain. It is unlikely to be legally liable to buyers on the fake site.
- For the hijacked WhatsApp account, customers who paid the fraudster may argue the bakery failed to secure its account. The bakery recovers the account, checks whether customer data was exposed, assesses whether the PDPA breach notification rules apply, notifies its cyber insurer and avoids admitting liability while it takes advice.
Frequently asked questions
Should we refund customers who paid a fake website?
You have no general obligation to, but you may choose a goodwill gesture. Take advice first if any claim is possible, and notify your insurer before offering money.
Can we ask the police to issue an OCHA direction?
You can report the scam and provide evidence. Whether to issue a direction is a decision for the designated officer under the Act.
Can a director sue over a deepfake of them?
Possibly, depending on what the content says and who can be identified. In practice, the priorities are takedown, a public denial on official channels and a police report.
Does registering similar domain names help?
It can reduce lookalike domains, but scammers have endless variations. A clear official channels page and fast reporting matter more.
Do we need to report to the PDPC?
Only if personal data in your company’s possession or control was affected and the breach is notifiable. Impersonation alone, using public information, does not trigger it.
Official sources: Singapore Police Force: Introduction to the Online Criminal Harms Act; Online Criminal Harms Act 2023; MHA: Commencement of OCHA on 1 February 2024; SPF and Shopee joint advisory, 22 May 2023; ScamShield; CSA SingCERT Cyber Aid; Trade Marks Act 1998.
Cyber or media liability cover itself should be arranged through a licensed insurer or insurance broker.
Need help with scammers using your company’s name?
If your company, or you as a director or shareholder, is dealing with scammers impersonating your business, brand or directors, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if a customer makes a claim against your company, you want to take action against an identifiable infringer or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles intellectual property, data protection and commercial disputes. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services