MPs have called for a police investigation into a company run by Jennifer Arcuri, the US businesswoman at the centre of conflict of interest row involving the prime minister, if a government review finds that it used deception to obtain a £100,000 grant.

The Department of Digital, Culture, Media and Sport (DCMS) is conducting a review of how it awarded Arcuri’s company Hacker House the money under a scheme aimed at fostering UK cyberskills, amid questions over the company’s tenuous links to the UK.

At a hearing on Wednesday, members of the DCMS select committee urged the culture secretary, Nicky Morgan, to refer the company to the police if it found that the money had been obtained fraudulently.

Two Labour MPs on the committee, Jo Stevens and Paul Farrelly, pointed out that the company appeared to have bogus links to the UK after it emerged that it was registered to a “virtual office” in central London and that the UK phone number that it used rings through to the US, where Arcuri and the company’s other director are now based.

Stevens asked: “If either or both of those pieces of information on the application form are found to have been false, will you be referring all of the evidence to the police?”

Morgan said: “I can’t make that assumption at the moment. But the whole point of having a government internal audit service looking at this is to make sure that we take it seriously.”

She said the review would look at how many Hacker House employees were genuinely based in the UK.

Farrelly pointed out that the company’s LinkedIn page appeared to list a bogus UK-based employee under the name “Annie T”, whose profile picture was illustrated with a stock image downloaded from Pinterest. He handed Morgan a copy of the page. “We will look at it with interest,” Morgan said.

Farrelly said: “This doesn’t just seem to be technical breaches of the Companies Act or DCMS bidding criteria, but actually obtaining money by deception.”

He asked Morgan whether she planned to refer the matter to the police if the review found “false representations” had been made. Morgan said: “I’m not going to prejudge the review.”

In a letter to the committee, Morgan denied that Boris Johnson had any link to the awarding of the grant, which was made from the cyberskills immediate impact fund (CSIIF). She said: “Any notion of the prime minister influencing – whether directly or indirectly – any aspect of the due diligence, assessment and award of any grant funding made through the CSIIF is simply not true.”

Morgan said she had not seen Arcuri’s application for the grant but said she doubted whether Arcuri had mentioned the prime minister’s name in it. She agreed to publish the application after the completion of the review, which is expected at the end of October.

She pointed out that as part of the grant, Hacker House had a target to help 50 UK residents gain employment in cybersecurity roles. Since the money was awarded in February it had helped 11 UK residents to gain such places.

Arcuri says the grant was obtained on merit and has denied any wrongdoing. She told ITV: “My company is based in the UK. And it’s never not been in the UK. Never.”

She said DCMS approached Hacker House before awarding the grant. “They came to us and said: ‘Hey, we have this pot of money.’ And I said: ‘Wow, you have a pot of money to do exactly as we are doing with the technology we were building. Why wouldn’t you fund us?’”