In November 2025 an app appeared on a Chinese Android app store bearing my employer’s name. It invited people to invest in energy-related projects and promised elevated returns.
We found out almost a year later, when the victims came to our office.
Why we missed it
Because we were not looking.
My company operates in China strictly with large local and national partners. We don’t sell anything to individuals. So we don’t monitor retail channels, app stores, or the forums where a fake investment app gets discussed. A few media outlets flagged the app as a scam during that period; we didn’t see those either, because nobody whose job it is to watch those channels was pointed at them.
“We don’t sell to individuals” was being treated as a monitoring policy. It wasn’t one.
The trigger
On the first of October, at the start of the Golden Week holiday, the scammers’ app stopped working. I can’t say whether they shut it down or it collapsed. What followed was that some victims began showing up at our office asking us to explain.
We didn’t let them in. We waited for the police to investigate with us.
The response
What followed was a crash course in crisis management for a company whose reflex is B2B: a rapid internal investigation, a PR agency engaged in crisis mode, and coordination between our China team and the legal and communication divisions at our headquarters. We assembled it in the middle of the event. None of it was rehearsed.
Where it landed
For now the topic has calmed down. Nobody treats us as the instigator of the fraud; at worst we were a brand whose name was stolen. Hundreds of people lost money, in sums that reach into the tens of millions of RMB. They are the real victims.
There’s a quieter, secondary injury. We asked to be recognised as victims in our own right, because our name and brand were damaged. The local police declined to register the complaint.
What this taught me
- Brand impersonation is a fraud vector even with no retail presence. The scammers didn’t need us to sell anything; they needed a name people trusted.
- “We don’t serve individuals” is not a monitoring policy. If your brand is recognisable, someone will wear it to defraud people you never meet.
- Assemble the playbook before the crisis. A PR agency, headquarters legal, and local communications are three things you want pre-named, not discovered mid-event.
- Cross-border coordination is its own skill. A local agency plus headquarters legal and communications is the combination that worked for us.
A checklist for anyone who finds their company’s name on a product they didn’t build:
- Treat it as a security incident.
- Don’t engage the victims directly at your premises; let law enforcement lead.
- Stand up a small incident team across legal, communications, and IT.
- Monitor, in writing, what is attributed to your brand and by whom.
- Decide early what your claim is (victim, witness, or uninvolved) and who is authorised to say it.