Publication date: October 30, 2026
A convincing investment operation does not always need to invent an entirely new financial company. Sometimes, the more effective approach is to borrow the identity of an existing business, imitate its professional image, and use another familiar financial institution’s name to make a withdrawal demand appear legitimate.
A recent alert from the Washington State Department of Financial Institutions (DFI) describes an alleged investment impersonation scheme involving the names Rockland Securities, LLC, Bank of Singapore, and an investment application called Skysphere.
The complaint, published on October 26, 2026, describes an investor who encountered a work-from-home advertisement on Facebook and was subsequently contacted through WhatsApp by an individual identifying herself as Eva Merkel. She claimed to be an investment adviser at Rockland Securities.
The investor reportedly transferred approximately $23,505 through Cash App and Western Union after being promised high returns through the Skysphere application.
When the investor attempted to withdraw the funds, the operation reportedly claimed that the money had been sent to the Bank of Singapore. An entity appearing to impersonate that bank then demanded an additional $3,038 in purported taxes before the funds could be released.
The investor did not pay the additional charge and has reportedly been unable to recover the investment.
DFI states that the allegations and reported losses have not been independently verified. Its alert does, however, provide an important case study in company impersonation, payment tracing, and the use of fabricated financial institutions or bank identities in advance-fee schemes.
How the alleged Rockland Securities operation began
According to the DFI complaint, the investor first encountered the opportunity through a Facebook advertisement promoting a work-from-home job.
The interaction then moved to WhatsApp, where an individual named Eva Merkel reportedly claimed to be an investment adviser at Rockland Securities.
The investor was encouraged to invest using an application called Skysphere, with the opportunity presented as a way to earn high returns.
The reported sequence included:
- An initial connection through a Facebook work-from-home advertisement.
- Follow-up communication through WhatsApp.
- An individual claiming to represent Rockland Securities.
- Investment instructions involving the Skysphere application.
- Approximately $23,505 transferred through Cash App and Western Union.
- A later withdrawal dispute involving a purported transfer to the Bank of Singapore.
- An additional demand for $3,038 described as taxes.
The sequence is important because it shows how a seemingly ordinary job or investment introduction can develop into a financial solicitation.
The use of familiar company names can also make it harder for an investor to distinguish a genuine financial business from an operation merely claiming to represent it.
The difference between a legitimate company and an impersonator
One of the most important details in the DFI alert is that the company calling itself Rockland Securities appears to be impersonating the legitimate Rockland Securities, LLC.
This distinction must be understood clearly.
An impersonation complaint does not establish that the legitimate company participated in the alleged activity. A fraudulent operation may use another company’s name, address, branding, or publicly available corporate information without authorization.
That is why simply searching for a company name is not enough.
An investigator should establish whether the person making the investment offer can be connected to the actual legal entity.
Useful checks include:
Exact legal name: Compare the name used in messages with the name shown in official company records and regulatory databases.
Contact information: Check whether the email addresses, phone numbers, website domains, and physical addresses match independently published company details.
Employee verification: Contact the legitimate business through a telephone number or email address obtained independently. Do not use contact information supplied by the person promoting the investment.
Regulatory status: Verify whether the individual and legal entity are authorized to conduct the financial activities being offered.
Payment beneficiaries: Compare the names on Cash App, Western Union receipts, and any other payment records with the claimed business.
A matching company name does not prove that a financial solicitation is genuine. The connection must be independently established.
Why the Bank of Singapore reference is significant
The second identity used in the reported arrangement makes this complaint especially important.
According to DFI, when the investor attempted to withdraw the funds, the purported Rockland Securities operation said the money had been sent to the Bank of Singapore.
The investor then encountered an entity that appeared to be impersonating the Bank of Singapore and was told to pay $3,038 in taxes before the money could be released.
This creates a separate investigative question: was the supposed bank actually involved in the transaction, or was its name being used to make another payment demand appear credible?
The complaint describes the latter as an apparent impersonation.
A legitimate bank should not be assumed to be involved simply because someone uses its name in a message, payment instruction, or document.
Investigators should look for independent evidence of the alleged bank transfer, including:
- A genuine bank transaction reference.
- The sending and receiving financial institutions.
- The legal name of the beneficiary.
- An official bank statement or transfer confirmation.
- Independent confirmation from the bank through its verified contact channels.
- The original message claiming that the funds had been transferred.
A screenshot supplied by an alleged adviser is not sufficient proof that money reached a real bank account.
The additional tax demand: a possible advance-fee warning sign
The reported $3,038 demand is another central feature of the complaint.
The investor was told that the funds could not be withdrawn until a purported tax payment was made.
This type of demand deserves careful scrutiny because a platform or intermediary may use the language of taxes, compliance, account verification, or financial clearance to request additional money from someone who is already trying to retrieve an investment.
There is an important distinction between a genuine tax obligation and a payment demanded by an unidentified person claiming to control access to an investment balance.
Tax obligations depend on the applicable law and the individual’s circumstances. They should not be accepted merely because an online platform or supposed bank representative says a payment is required.
Before paying any such demand, investors should establish:
- Which legal entity is requesting the payment?
- What law or contractual provision supposedly requires it?
- Who receives the money?
- Is the payment being made to an official tax authority or a private account?
- Can the claimed obligation be verified independently?
- Why can the amount not be deducted from the available balance, if such a balance genuinely exists?
In the reported case, the investor declined to pay the additional $3,038 and remained unable to recover the funds.
No one should send another payment simply because an online representative describes it as the final step in a withdrawal process.
Following the money: Cash App and Western Union records
Unlike cases in which the initial investment is sent directly to a cryptocurrency wallet, the DFI complaint identifies Cash App and Western Union as the reported payment methods.
This changes the starting point for an investigation.
The first task is to establish precisely where the money was sent, who received it, and whether the transfers can be connected to the individuals or businesses making the investment representations.
Cash App records
Preserve the transaction history, recipient details, payment identifiers, timestamps, and any associated messages.
If a payment was made through Cash App, contact its official support and report the suspected fraud. Provide the original transaction information and follow the company’s instructions.
Western Union records
Retain the original receipts, tracking numbers, recipient names, transfer dates, and amounts.
Where available, request information about the transfer status and the options for reporting a suspected fraudulent payment.
Build a unified timeline
The two payment methods should be reviewed together.
An investigator should create a chronological record connecting each payment to the instruction that prompted it.
For example, if a WhatsApp message directed the investor to send a particular amount through Cash App, that message should be matched to the corresponding payment record.
The same process should be followed for Western Union transactions.
This helps distinguish the actual money transferred from any profits or balances displayed inside the Skysphere application.
Investigating the Skysphere application
The application named in the complaint is another important source of evidence.
A trading application may display account balances, investment returns, transactions, and withdrawal options. However, the appearance of these features does not establish that the underlying assets exist or that the application is operated by the company it claims to represent.
A useful examination should preserve:
- The application’s name and version, where available.
- The website or download address used to obtain it.
- Registration and account-verification emails.
- Account screenshots and displayed balances.
- Deposit and withdrawal histories.
- Messages explaining the investment strategy.
- Any documents describing the relationship with Rockland Securities.
- Any messages referring to the Bank of Singapore.
The investigator should also establish whether the application is still accessible and whether the original website or download page can be independently examined.
If the application is no longer available, records already held by the investor may still be useful.
For more information about protecting these materials, see Cyb3rsect’s Digital Evidence Preservation guide. Insert the live internal link to that article before publication.
How to verify a financial firm before investing
This complaint demonstrates why investors should verify the exact identity of anyone offering financial services.
For US investors, several official resources can help.
FINRA BrokerCheck: Allows investors to research registered brokers and brokerage firms.
SEC Investment Adviser Public Disclosure: Provides information about investment advisers and their registration filings.
State financial regulators: Can help determine whether an individual or business is authorized to provide relevant services in a particular state.
Company contact verification: A genuine company should be contacted through independently sourced contact information, not through the details supplied by an unsolicited online representative.
A business registration does not automatically authorize a company to provide investment services. Likewise, a person claiming to be an adviser should not be treated as licensed without verification.
Investors should also be cautious when an investment opportunity begins with a work-from-home advertisement but quickly turns into a request to transfer personal funds.
What to do if you have already transferred money
If you believe you have been affected by a similar arrangement, take steps to preserve the evidence and report the matter promptly.
1. Stop additional payments. Do not pay another purported tax, release charge, verification fee, or account-unlocking deposit without independent verification.
2. Preserve all messages. Save complete WhatsApp conversations, Facebook advertisements, profile details, phone numbers, and any documents received.
3. Collect payment records. Download Cash App transaction histories and preserve Western Union receipts and tracking details.
4. Contact the payment providers. Report the suspected fraud through their official channels and ask what options may remain available.
5. Report the impersonation. Contact the relevant state financial regulator and law-enforcement authorities. For US victims, the FBI’s Internet Crime Complaint Center (IC3) is an additional reporting channel.
6. Verify the legitimate businesses independently. If a real company or bank’s identity appears to have been used, contact it through its official website or independently verified contact details.
A report should clearly distinguish what the investor personally experienced from what an adviser or application claimed.
Watch out for recovery scams
A second fraud can follow the first.
After someone reports an investment loss, they may receive messages from individuals claiming to be investigators, ethical hackers, government representatives, bank employees, or recovery specialists.
Some may claim that the money has already been located and that a fee is required to release it.
Be cautious of anyone promising guaranteed recovery or demanding additional payments before explaining what evidence supports the claim.
Do not share bank passwords, one-time authentication codes, wallet seed phrases, or private keys. Do not install remote-access software at the request of an unknown person.
Cyb3rsect’s Crypto Recovery Scam Investigation guide provides further guidance on identifying these follow-up approaches. Add the live internal link to that article here.
How Cyb3rsect approaches impersonation and investment investigations
An investment impersonation case often involves more than one website or individual. The investigation may need to examine the original advertisement, the communications that followed, the application used to display investment activity, and the actual payment recipients.
Cyb3rsect focuses on reviewing the available digital evidence and organizing investigative leads.
Depending on the records available, this may involve:
- Reviewing website and application information.
- Examining company and adviser identity claims.
- Organizing Facebook and WhatsApp communications.
- Reviewing Cash App and Western Union payment records supplied by the client.
- Comparing payment recipients with the claimed business identities.
- Examining withdrawal instructions and purported tax demands.
- Preparing a structured timeline and evidence summary.
The objective is to establish what the available evidence supports and identify appropriate next steps. An investigation cannot guarantee that funds will be recovered or that an unidentified individual can be conclusively identified.
Final thoughts
The Rockland Securities and Bank of Singapore impersonation complaint is a reminder that a familiar financial name does not guarantee that an investment opportunity is genuine.
The Washington DFI alert describes an investor who reportedly transferred approximately $23,505 through Cash App and Western Union after being approached through a Facebook work-from-home advertisement. When the investor tried to withdraw the funds, the operation reportedly invoked the Bank of Singapore’s name and demanded another $3,038 in purported taxes.
The complaint remains an allegation, and DFI states that the reported facts and losses have not been independently verified.
For investors, the central lesson is to verify the identity of every business involved in an investment transaction. A company name, an application, a bank reference, or a professional-looking message should never replace independent verification.
For people who believe they have been affected, preserving the original communications and payment records is an important first step toward understanding what happened.
Cyb3rsect — digital evidence review, online impersonation investigations, and cryptocurrency transaction analysis.
If you are dealing with a suspected investment impersonation incident, contact Cyb3rsect to discuss the available evidence and possible investigative next steps.
