Someone Used Your Company's Name to Commit Fraud. You Are Not the Victim.

The document that reached me was one page long.

A statement for the company's website. Criminals are using our name to sell jobs. We charge no fees. We authorize no agents. We reserve the right to pursue legal responsibility.

It was a competent draft. It was not the reason I had been called.

The real question came near the end of the conversation, almost as an afterthought. The people who had paid were already at the police station. Should the company file its own report as well — and if it did, would anyone tell it what the investigation had found?

The client is a large group company. Its name, and its parent's name, had been used by strangers presenting themselves as brokers, intermediaries, people who knew someone inside. There was a fee, payable quickly, payable to an individual. The offers never came.

None of this is unusual. It is one of the most common corporate encounters with the Chinese criminal process, and one of the least understood. It requires no carelessness on the company's part — only a name a stranger can borrow: a hospital, a bank, a listed manufacturer. The fraud is committed against individuals, in the company's name, and the company finds out last.

The instinct in the room is always the same. Publish the statement. Then file our own report, so that we become part of the case and can find out what is going on.

A statement manages the public. It does not manage the investigation.

The question nobody put in writing

The company was not asking about reporting procedure. It was asking one thing, in the way clients ask what they would rather not say out loud: if someone inside this organization is helping these people, when will we know?

That question never appears in the public statement. It is the reason the meeting happens.

So the legal question is not whether to publish a statement. It is what position a company holds in a PRC criminal investigation into a fraud committed in its name, and whether filing its own report improves it.

The short answer. Companies whose names are misused in a fraud stay outside the criminal case. They may report the offense, and usually they should. But reporting does not make a company a victim, a party or a participant, and having its name used confers no right to know what the investigation finds. Cooperation with the investigators is compulsory; access to what they learn is not.

The people who paid own the case. The company owns the consequences.

Reporter, Complainant, Victim: Why the Company Is Not a Party

Chinese criminal procedure separates three roles that English collapses into "the person who called the police."

Under the Criminal Procedure Law of the People's Republic of China (2018 Amendment, effective October 26, 2018), Article 110, any entity that discovers criminal facts has both the right and the duty to report them. That makes it a reporter. Someone whose own person or property has been harmed holds a stronger right under the same article, to lodge a complaint. A victim is something else again: a party to the proceedings, under the definition in Article 108.

The notification rules show what the difference is worth. If the authorities decline to open a case, Article 112 obliges them to give reasons to the complainant, who may seek reconsideration. Nothing obliges anyone to tell a reporter how an investigation is going once one opens. And under Article 46, even a genuine victim cannot appoint an agent ad litem until the case is transferred to the procuratorate for review for prosecution — until, that is, the investigation has finished.

The rights attached to victim status are trial rights. The company's exposure is not at trial. It is during the investigation, in the months when nobody has to tell it anything.

Apply this to the client. The money left the pockets of the people who paid it. They are the victims. The company appears in the story and nowhere in the case.

By the time victim status would do a company any good, the investigation is already over.

What a report actually buys you

Reporting is not futile. It is simply not what clients think they are buying.

When a public security organ accepts a report, the Provisions on the Procedures for Handling Criminal Cases by Public Security Organs (Ministry of Public Security Order No. 159, 2020 Revision, effective September 1, 2020) require it to accept the matter immediately and take a signed statement (Article 169), then register the case and hand the reporter a case acceptance receipt (Article 171).

So the company receives a piece of paper confirming that it reported something, on a date it can prove. That is useful — for the board, the regulator, the auditors, the file showing the company acted the day it learned.

What it is not is a channel. No case number to call, no officer assigned to the company, no entitlement to know whether an arrest has been made or whether a confession named an employee. Foreign general counsel underestimate this more than any other feature of the Chinese criminal process, because in most common law systems a report produces a reference number, a named officer and a reasonable expectation of a return call. What a company hears here is that the case is under investigation and the details cannot be discussed — the officer doing the job correctly, not stonewalling.

What I tell clients: file the report because it is the right thing to do and because it documents the company's response. Do not file it in order to be told things.

Reporting creates a record. It does not create standing.

The information runs one way

The company's obligation to give information is compulsory. Article 54 empowers the courts, procuratorates and public security organs to collect evidence from relevant entities and individuals, who must provide it truthfully. When the police ask for employment contracts, recruitment records, access logs or internal messages, cooperation is a legal duty, not goodwill.

The company's ability to receive information is discretionary. Nothing obliges an investigator to tell a non-party anything at all.

Any strategy built on the assumption that the two are reciprocal will fail.

Cooperation is owed. Access is not.

How you will actually find out

Here is the part no statute will tell you, and it is why the debate about filing a second report is usually a distraction.

If insiders are involved, the investigation will come to you. It has to. To prove that an employee sold access, took a referral fee or leaked a recruitment shortlist, an investigator needs material that exists only inside the company: the employment contract, the job description and reporting line, the interview records, the door access and system logs, the internal chat history, the payroll and reimbursement records. Those requests arrive under Article 54, and they arrive at the company.

So the information a company is waiting for does reach it. It simply arrives in the shape of a question rather than an answer.

The signal is not what the police tell you. The signal is what the police ask you for.

A general request for recruitment procedures and public announcements is consistent with an investigation into outsiders using the company's name. A request for one named employee's file, one department's access records and one defined period of internal messages is a different question being asked, and it is being asked about you.

In my experience, the shift between those two kinds of request is the earliest reliable indication a company gets that the internal-participation question is live, and it usually arrives well before anything reporting could have produced. I would be cautious about reading too much into a single document request, and more cautious still about reacting to one in a way the investigators can see. But the requests have to be logged centrally, reviewed by one person and read as a series. Most companies route them to HR, answer each one politely, and never look at them side by side.

You will not be told. You will be asked.

The letter, not the second report

Everything after that insight is about being ready for the question when it comes.

Where the real objective is a working relationship with the case handler, the practical instrument is not another report. What I draft instead is a short letter to the handling unit, signed and chopped, doing three things: recording that the company takes the matter seriously, offering its recruitment records, personnel materials and internal cooperation, and asking to be contacted if the investigation touches its own personnel or needs its assistance. One named person as the contact, with a direct line.

This is practice, not law, and I would not promise a client it will produce information. What it does is make the company easy to work with at the moment the investigator needs something. Investigators are not looking for another legal analysis from the company. They are looking for someone who can produce the requested documents this week rather than next month, without a memorandum attached. A single competent contact is worth more to an investigating officer than a second report.

The letter also fixes the date on which the company offered full cooperation. If someone inside the organization later turns out to have been involved, the distance between the company and that person is measured partly by what the company did before it knew.

The letter does not buy information. It buys the first call.

When the company really is the victim

None of this means a company can never be a party. It means the fraud against the people who paid is the wrong door.

Where the conduct goes beyond borrowing the name, into fabricating and spreading false facts that damage the company's business reputation and cause heavy losses or otherwise serious circumstances, that is a separate offense under Article 221 of the Criminal Law of the People's Republic of China — and the company is the victim of that offense, with a complainant's rights attached. The threshold is high and the burden of proving loss real, so it is rarely the answer in an impersonation case.

The ordinary route is civil. Under the Civil Code of the People's Republic of China (adopted 2020, effective January 1, 2021), a legal person holds rights in its own name (Article 1013), and no organization or individual may infringe them by interference, misappropriation or passing off (Article 1014). A civil action belongs to the company, moves on its timetable, and ends in a judgment it can publish. Slower, less satisfying, and usually the only proceeding the company will ever control.

Criminal law protects the people who paid. Civil law protects the name.

The planning point

The mistake I see most often is treating impersonation fraud as a public-relations problem. It is a governance problem wearing a public-relations costume. The criminal investigation belongs to someone else and proceeds without the company's involvement or consent. What the company controls is narrow but decisive: whether its recruitment process leaves room for an insider to sell what it appears to sell, whether requests from investigators are read by one person as a pattern instead of by four departments as errands, and whether it already knows what investigators would find if they looked inside. A company that can answer that last question is managing a risk. A company that cannot is waiting to be informed.

Practitioner's Note

The choice put to the board is usually framed as procedural: do we file or not. It is not a procedural choice, because both answers produce the same procedural position — an entity outside the case, cooperating with an investigation it cannot see. What I advised in this matter was to publish, to report, to write to the handling unit, and then to stop expecting any of those three things to produce information.

Boards tend to assume the risk ended when the fraudsters disappeared with the money. The governance question begins at exactly that point, because that is when the company stops being able to see what is happening and has to rely on what it already knows about itself. The exposure was never really the fraud. It was whatever inside the organization made the fraud plausible.

Criminal procedure decides who owns the investigation. Governance decides whether the company will be surprised by it.

Key takeaways

• Reporting a crime and being a victim are different legal concepts under PRC criminal procedure, and only the second confers party rights.
• A company whose name is misused to defraud third parties is normally a reporter, not a victim: the loss was suffered by the people who paid.
• Filing a police report documents the company's response but creates no right to information about the investigation.
• The company's duty to produce evidence is compulsory; the investigators' duty to tell the company anything does not exist.
• What the police ask a company for reveals more about the direction of an investigation than anything the police will say.
• Impersonation fraud is a governance exposure rather than a communications one, because the company's real risk is what an investigation would find inside it.

Questions clients ask

Should we file our own police report if criminals used our company's name?

Yes. File it to document the company's response, not because it creates any right to information.

Can the company obtain the investigation file, or updates on progress?

No. A company that is not a party has no route into the file and no entitlement to updates.

The police have asked for one employee's personnel file. What does that mean?

That the question has narrowed. Requests about recruitment procedure point outward; requests aimed at a named individual, a single department or a defined period point inward. Log every request centrally and read them together.

---

This article discusses general principles of PRC law and does not constitute legal advice on any particular matter.

Legal authorities cited

• Criminal Procedure Law of the People's Republic of China (2018 Amendment, effective October 26, 2018), Articles 46, 54, 108, 110, 112
• Provisions on the Procedures for Handling Criminal Cases by Public Security Organs (Ministry of Public Security Order No. 159, 2020 Revision, effective September 1, 2020), Articles 169, 171
• Criminal Law of the People's Republic of China (1997, as subsequently amended), Article 221
• Civil Code of the People's Republic of China (adopted 2020, effective January 1, 2021), Articles 1013, 1014

Related Reading

• A Lawyer Helped His Client Open a Bank Account. It Cost Him His License and Nine Months in Prison.

More on this area of practice: Commercial Disputes.

Last reviewed: August 1, 2026