Rockland Securities and Skysphere: How Investment Impersonators Used Trusted Financial Names to Demand More Money

Publication date: October 31, 2026

An investment opportunity can look convincing when it appears to come from a familiar financial company. A professional-looking application, an adviser using a credible title, and references to established banks can make an unfamiliar platform seem legitimate. But when those identities are being impersonated, the appearance of credibility can become part of the deception.

A recent warning from the Washington State Department of Financial Institutions (DFI) describes an alleged investment scheme involving the names Rockland Securities and Bank of Singapore, an application called Skysphere, and an individual identified as Eva Merkel.

The reported sequence is particularly important: an investor was introduced to an opportunity through a Facebook work-from-home advertisement, communicated with an alleged investment adviser through WhatsApp, transferred funds through Cash App and Western Union, and later encountered a demand for an additional tax payment before a withdrawal could be completed.

The case illustrates several warning signs that investors should understand: employment advertisements that lead into investment offers, unverified financial advisers, platforms that display apparent investment activity, and unexpected payments demanded when someone tries to withdraw their money.

For people investigating suspicious investment activity, the case also demonstrates why preserving communications, payment records, website details, and transaction information can be essential.

What happened in the Rockland Securities and Skysphere case?

On October 26, 2026, Washington DFI published an alert concerning a company calling itself Rockland Securities. The regulator said the company appeared to be impersonating the legitimate Rockland Securities, LLC.

According to the alert, an investor first encountered the opportunity through a Facebook advertisement promoting a work-from-home position. The investor subsequently communicated with an individual named Eva Merkel, who claimed to be an investment adviser at Rockland Securities.

The conversations reportedly took place through WhatsApp.

The investor was then directed toward an application called Skysphere, where the opportunity was presented as an investment capable of generating high returns.

The DFI alert describes the following reported sequence:

• The investor was introduced to the opportunity through a Facebook work-from-home advertisement.
• An individual identifying herself as Eva Merkel claimed to be an investment adviser.
• Communication continued through WhatsApp.
• The investor transferred approximately $23,505 through Cash App and Western Union.
• The investor was promised high returns through an application called Skysphere.
• After several alleged mistakes occurred on the application, the investor was told additional funds were required.
• When the investor attempted to withdraw the money, the purported Rockland Securities operation said the funds had been sent to the Bank of Singapore.
• An entity appearing to impersonate the Bank of Singapore subsequently demanded a $3,038 tax payment before the funds could be released.

The investor did not pay the additional amount and remained unable to withdraw the investment.

These details come from a consumer report summarized by Washington DFI. The regulator explicitly stated that the allegations and reported losses had not been independently verified. The alert is a consumer warning, not a court judgment or a final regulatory finding.

Why impersonating legitimate financial institutions is so effective

One of the most concerning aspects of this case is the alleged use of established financial names.

A person considering an unfamiliar investment platform may search for the name of the company presented by an adviser. If that name resembles a genuine financial business, the investor may feel reassured before checking whether the person contacting them is actually connected to that business.

This creates an important distinction: a real company’s existence does not establish that an individual using its name is authorized to represent it.

In an impersonation scheme, several elements may be presented together:

• A company name that resembles a legitimate financial institution.
• An individual claiming to be an adviser, analyst, account manager, or investment professional.
• A digital application displaying account balances or apparent trading activity.
• References to banks or financial institutions supposedly holding customer funds.
• Documents, logos, or messages intended to make the arrangement appear official.

Each element must be independently verified.

Investors should not rely on a company logo, a WhatsApp profile, an email signature, or an application screen as proof of authorization. They should contact the legitimate institution using contact details obtained independently from its official website or regulatory records.

A genuine financial institution should also be able to confirm whether the individual, company, website, and investment service are actually associated with it.

The Skysphere application: why a displayed balance is not proof of funds

Digital investment applications can make it difficult for customers to distinguish between genuine financial activity and information displayed by a platform operator.

An application may show:

• An account balance.
• Apparent investment returns.
• Transaction histories.
• Pending withdrawals.
• Tax or compliance notifications.
• Messages claiming that funds have been transferred to another institution.

However, a balance shown inside an application does not independently establish that the money exists in a bank account, brokerage account, or cryptocurrency wallet.

This distinction matters in the Skysphere case because the reported investor was told that funds had been sent to the Bank of Singapore after attempting to withdraw them.

A genuine transfer should have independently verifiable supporting information. Depending on the payment method, that may include a bank transfer reference, recipient details, transaction confirmation, or a blockchain transaction hash.

If a platform claims that money has moved between financial institutions, the customer should verify the transaction directly with the institution supposedly receiving it. Contact information supplied by the platform or its representatives should not be treated as independent verification.

For a deeper explanation of how investigators assess digital financial records, see Cyb3rsect’s Digital Evidence Preservation guide and Blockchain Transaction Tracing guide.

The additional tax demand: a major warning sign

The reported demand for $3,038 is another important part of the case.

According to Washington DFI, an entity appearing to impersonate the Bank of Singapore told the investor that a tax payment was required before the funds could be withdrawn.

This resembles an advance-fee pattern: someone is told that their money is supposedly available, but they must first send another payment to unlock it.

The explanation may vary. A platform might describe the demand as:

• A tax payment.
• An account-release fee.
• A compliance deposit.
• A verification charge.
• A security payment.
• A liquidity or processing requirement.

The terminology does not establish whether the charge is legitimate.

A particularly concerning situation occurs when a platform repeatedly introduces new financial requirements after the customer has already attempted to withdraw. The customer may be told that one payment will solve the problem, only to receive another demand afterward.

Before paying any unexpected withdrawal charge, investors should independently contact the relevant bank, tax authority, financial regulator, or licensed professional. They should request written documentation explaining the legal basis for the payment and verify it through an independent channel.

Paying another fee should never be treated as a guarantee that previously transferred funds will be released.

How to investigate a suspicious investment platform

When an investment platform becomes inaccessible or refuses withdrawals, the priority should be to preserve evidence and establish what happened.

Deleting an application, closing a WhatsApp conversation, or discarding payment confirmations can make later investigation more difficult.

A structured investigation should consider several evidence categories.

1. Preserve the original communications

Save conversations with the alleged adviser, including WhatsApp messages, voice notes, documents, telephone numbers, profile details, and any payment instructions.

Preserve the original files wherever possible. Screenshots are useful, but they should not be the only records retained.

Record the dates and times of important conversations, especially when the investor was instructed to transfer money or was told that a withdrawal required another payment.

2. Document the application and associated websites

Record the exact application name, website addresses, login pages, email addresses, and any domains associated with the investment operation.

Save screenshots of account balances, transaction histories, withdrawal requests, error messages, and payment demands.

Do not assume that an application is legitimate because it is available through a download link or has a professional interface.

3. Collect payment records

In this case, the reported payments involved Cash App and Western Union.

Relevant records may include:

• Cash App transaction confirmations.
• Western Union transfer receipts and tracking numbers.
• Recipient names and account identifiers.
• Dates, amounts, and payment references.
• Messages explaining why each transfer was requested.

Contact the payment providers promptly to ask whether any transfer can be stopped, recalled, or reviewed. The possibility of intervention depends on the payment method, timing, and circumstances.

4. Identify the actual destination of funds

If cryptocurrency was involved, obtain the transaction hashes, blockchain network, sending address, receiving address, and transaction timestamps.

A blockchain investigation may help establish where funds moved after a transfer and whether they passed through other identifiable addresses or services.

However, tracing a transaction does not automatically identify the person controlling a wallet or establish that funds can be recovered.

For more information, Cyb3rsect’s How to Trace a Cryptocurrency Wallet guide explains the basic investigative process.

5. Verify the people and institutions independently

Check whether the alleged adviser is registered or authorized to provide the service being offered.

Washington DFI specifically recommends using FINRA BrokerCheck to review investment professionals and their registration status. Investors should also contact any named financial institution directly through independently verified contact information.

Do not use telephone numbers, links, or email addresses supplied solely by the person promoting the investment.

What should someone do after discovering a suspected impersonation scheme?

Anyone who believes they have been targeted should act quickly, but avoid making decisions under pressure.

First, stop sending additional money. Do not pay a new tax, release fee, verification charge, or security deposit simply because an alleged adviser claims it is the final requirement.

Second, contact the payment providers. Explain that the transfers may have been connected to an investment impersonation scheme and ask about available dispute, recall, or fraud-reporting procedures.

Third, report the incident. Washington DFI recommends reporting suspected cases to the FBI. Washington residents can also submit a complaint to DFI. People elsewhere should contact their own state or local securities regulator.

Fourth, preserve all available evidence. Keep the original messages, payment records, application details, and transaction information. Avoid deleting accounts or conversations before relevant records have been secured.

Finally, be cautious of recovery offers. People who have already lost money may become targets for a second approach from someone claiming to be a recovery specialist, blockchain investigator, government agent, or financial institution representative.

A request for an upfront payment in exchange for guaranteed recovery should be treated with serious caution. No legitimate investigator can promise that funds will be recovered simply by tracing a transaction.

Cyb3rsect’s Crypto Recovery Scam Investigation guide provides additional information about identifying these follow-on schemes.

How Cyb3rsect approaches digital investment investigations

Cases involving alleged impersonation require more than a quick review of a website or a search for a company name.

A useful investigation examines how the opportunity was introduced, who communicated with the investor, which payment methods were used, what the platform displayed, and what happened when the customer requested a withdrawal.

Depending on the available evidence, an investigation may involve:

• Reviewing websites, applications, and digital communications.
• Establishing a timeline of events and payment instructions.
• Organizing transaction records and supporting documentation.
• Reviewing cryptocurrency transactions where relevant.
• Identifying inconsistencies between platform claims and independently verifiable records.
• Preparing an organized evidence package for appropriate reporting channels.

Cyb3rsect focuses on digital evidence review, online platform investigations, and cryptocurrency-related investigative support. The purpose is to help people understand the available evidence and identify practical next steps.

An investigation cannot guarantee that a platform operator will be identified or that transferred funds will be returned. The outcome depends on the evidence, the payment route, and whether relevant funds or accounts remain accessible.

Final thoughts: verify the identity behind the investment, not just the name

The Rockland Securities and Skysphere alert highlights how an investment opportunity can become convincing when it combines a work-from-home advertisement, an alleged financial adviser, a digital trading application, and the names of established financial institutions.

The reported demand for an additional tax payment before withdrawal is particularly important. Once an investor is told that their money is available but must send more funds to access it, the situation deserves independent scrutiny.

The legitimate Rockland Securities, LLC and Bank of Singapore should not be confused with the entities that Washington DFI says appeared to be impersonating them. The alert does not establish that either legitimate institution participated in the reported activity.

The wider lesson is straightforward: verify every adviser, company, application, payment destination, and withdrawal requirement independently. Preserve evidence as soon as concerns arise, and do not allow pressure or promises of unusually high returns to replace proper checks.

For anyone dealing with a suspicious investment platform, Cyb3rsect can help review the available digital evidence and explain possible investigative next steps.

Contact Cyb3rsect

If you have encountered a suspicious investment application, an alleged financial adviser using a company’s identity, unexplained withdrawal restrictions, or demands for additional payments, preserving the available evidence is an important first step.

Visit Cyb3rsect.com to learn more about digital investigation and cryptocurrency-related investigative support.