Background Check

Employee Fraud and Internal Corporate Investigations in Kenya

Employee Fraud and Internal Corporate Investigations in Kenya Independent forensic investigations into fraud, collusion and data theft inside your organisation, run so the evidence holds up at the disciplinary hearing, in the Employment and Labour Relations Court and in a criminal case. Instruct Us on Your Matter Call +254 100 177 094 Reviewed by Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd. Last updated 1 October 2026. Quick answer An internal corporate investigation establishes what an employee or group of employees did, how, and with whose help, using evidence collected lawfully and kept in a verifiable chain of custody. Ultimate Forensic Consultants secures and analyses devices, email, system logs, payment and procurement records and documents, then reports to your board, audit committee, HR or legal team. The report supports dismissal, criminal referral and civil recovery. We are independent of the people under investigation, and we do not decide guilt: that remains the employer’s decision after a fair hearing. The schemes we investigate, and where the evidence sits Internal fraud rarely announces itself. It shows up as small anomalies in records that someone with access can control. Each scheme leaves a different trail. Scheme Typical warning signs Where we look Payroll fraud and ghost employees Staff who cannot be physically verified, duplicate bank accounts, unexplained allowances or overtime Payroll system logs, bank details against HR files, approval trails, ID and document verification Procurement fraud and kickbacks Repeat awards to one supplier, inflated prices, split orders, new vendors with no history Vendor master data, tender files, supplier registration and ownership, communications between buyers and suppliers Fictitious suppliers and false invoices Vendors sharing addresses, phone numbers or bank accounts with staff Link analysis of vendors, staff and bank accounts, invoice metadata and document examination Expense and claims fraud Recycled receipts, altered amounts, claims for unattended events Receipt forensics, email and calendar records, mobile money and card statements Cash skimming and lapping Unreconciled receipts, delayed banking, customer complaints about unrecorded payments Till and ledger data, bank deposits, CCTV, M-Pesa and Paybill reconciliations Stock theft and inventory manipulation Write-offs that repeat, shrinkage that tracks one shift or one storekeeper Stock system audit logs, gate and CCTV records, dispatch documents Data theft and IP leakage Bulk downloads before resignation, files sent to personal email or cloud, a rival launching a copy of your product Forensic images of laptops and phones, email and cloud logs, USB and printing history Conflict of interest and insider-assisted external fraud Undisclosed ownership of a supplier, staff tipping outsiders, repeated losses at one branch Company registry records, communications, system access logs, SIM and mobile money links where relevant Run it properly: five rules that protect your case Most internal fraud cases are weakened by how the employer handled them, not by the fraud. These are the rules we build every engagement around. Secure evidence before anyone is confronted Once a suspect is alerted, files are deleted and phones are reset. We image devices and preserve logs first, quietly. Investigate independently Anyone implicated, or reporting to someone implicated, stays out of the investigation. We report to the board, audit committee or counsel. Collect lawfully and proportionately Access to devices, email and personal data must follow your policies and the Data Protection Act. Unlawfully obtained evidence creates a second problem. Keep the chain of custody Every device and file is logged, hashed and documented, so the evidence can be authenticated under Sections 106A and 106B of the Evidence Act. Give the employee a fair hearing Dismissal that skips notice and a hearing can be found unfair even where the fraud is real. Our report feeds the process. It does not replace it. What UFC delivers Digital evidence acquisition Forensic imaging of laptops, phones, servers and cloud accounts, with recovery of deleted files and messages. Transaction and document analysis Tracing payments and approvals, and forensic examination of invoices, contracts, signatures and altered records. Link and relationship analysis Connecting staff, vendors, bank accounts, phone numbers and companies to expose collusion and undisclosed interests. Structured interviews Planned, documented interviews of witnesses and subjects, conducted without coercion and recorded properly. Asset tracing and recovery support Identifying where diverted funds went, to support civil recovery, freezing applications and settlement negotiations. Report, hearing and court support A clear findings report for the disciplinary panel, a referral pack for the police or EACC, and expert testimony in court. Two illustrative cases: ghost employees and inventory manipulation These scenarios are composites of patterns we see in Kenyan organisations. Names, sectors and figures are changed or indicative, and they are not reports of a specific client’s matter. Payroll fraud: ghost employees on a multi-site payroll What was suspected A manufacturer with several sites noticed that payroll cost was rising faster than headcount. Finance and HR each suspected the other’s records. What we examined Payroll master data and audit logs, HR personnel files, physical verification of staff at each site, bank and mobile money details of every payee, and a forensic image of the payroll officer’s workstation. What the record showed A group of payees could not be verified as real people, with no attendance records and no supervisor who knew them. Several shared the same bank account or phone number. Their records were created and edited after hours under one officer’s login, and approvals came from a supervisor whose credentials were being used by someone else. How the money moved Net pay for the ghost payees was paid into a small set of accounts. Link analysis tied those accounts to a relative of the payroll officer. What the report supported A fair disciplinary hearing, a criminal referral with a complete evidence pack and a civil recovery claim. It also set out the control failures: no segregation of duties, shared credentials and no periodic headcount verification. Inventory manipulation: write-offs that followed one storekeeper What was suspected A distributor saw repeated “damaged goods” write-offs at one warehouse that did not match supplier returns or insurance claims. What we examined Stock system adjustment logs,

Employee Fraud and Internal Corporate Investigations in Kenya Read More »

Fake TikTok Accounts Targeting Kenyan Brands | How to Stop Them

Brand Protection · TikTok Fake TikTok Accounts Are Targeting Kenyan Brands — Here’s How to Get Them Removed A practical guide to spotting, evidencing, and reporting brand impersonation on TikTok, with the legal options available under Kenyan law. 📅 Updated June 2026 🕐 8 min read ✍️ Ultimate Forensic Consultants If your business has any presence on TikTok — or even if it doesn’t — there’s a real chance someone else is already pretending to be you on the platform. TikTok’s growth in Kenya has been fast enough that brand impersonation has outpaced most businesses’ ability to monitor for it, and the accounts doing the impersonating aren’t always obvious at a glance. Quick Answer To get a fake TikTok account impersonating your brand removed, report it in-app under “Pretending to be someone” for straightforward impersonation, or file TikTok’s dedicated trademark infringement form if your logo or registered mark is involved — this routes the case to TikTok’s IP review team rather than general moderation. Capture full screenshots of the profile, its videos, and any direct messages before submitting any report, since evidence often becomes inaccessible once a report is actioned. If customers were defrauded, the matter can also be reported to Kenya’s DCI Cybercrime Unit under Section 29 of the Computer Misuse and Cybercrimes Act, 2018. 📰 According to a public statement reported by Kenyans.co.ke in May 2025, the National Transport and Safety Authority had to warn Kenyans about a fake TikTok account using its name, which the authority itself described as a scheme to defraud followers — an account that had already gathered more than 8,600 followers before anyone formally flagged it. If a national government agency can be impersonated at that scale before detection, smaller businesses are at least as exposed, usually with far less capacity to respond quickly. Why TikTok Specifically Is a Growing Risk for Kenyan Brands TikTok occupies a different position than Facebook or Instagram in the brand-impersonation landscape, for a few reasons worth understanding before you build a response plan. First, the audience skews younger and faster-moving — content spreads through the algorithm rather than through a follower’s existing network, which means a fake account can reach thousands of people who have never seen your real brand before, with no way to compare. Second, the platform’s most common scam formats — fake giveaways, “instant earnings” offers, romance-style approaches, and bogus brand-deal messages — are specifically built around urgency and trust, which makes a convincing fake business account more dangerous per-follower than on other platforms. Third, TikTok Shop adds a commerce layer that Instagram and Facebook don’t have in the same way, meaning impersonation isn’t always just reputational — it can be a direct financial scam wearing your brand’s name. The Four TikTok Impersonation Patterns Showing Up Most in Kenya 01 Cloned Business Accounts A near-identical account using your logo, brand name, and stolen product or service photos — often messaging your actual followers directly to redirect them toward a scam offer or fraudulent payment request. 02 Fake Giveaway & “Instant Earnings” Videos Accounts using a recognisable brand name to promise unrealistic returns or free products in exchange for an upfront M-Pesa payment or personal details. 03 Counterfeit Listings on TikTok Shop Products listed using your brand name, packaging, or photos, sold by an account with no actual connection to your business. 04 Fake Verification & Partnership Offers Messages claiming to offer TikTok verification, brand partnerships, or paid collaborations — usually designed to harvest credentials or extract a “processing fee.” How to Actually Report a Fake Account on TikTok TikTok’s in-app reporting tool splits impersonation reports into three categories, and choosing the right one matters for how fast — and how seriously — your report gets handled. Pretending to be someone Use when the account is directly impersonating your brand or a specific person — especially if you can reference your own verified or established account as the real one. Fraud & scams Use when the account is actively collecting payments or running a scam, whether or not it involves your specific trademark. IP violation Use for cases involving your logo, registered trademark, or copyrighted content — this routes the report to TikTok’s dedicated IP review team rather than general community moderation. For straightforward impersonation and fraud cases, selecting the right category and submitting is usually enough to get a review started. Trademark and copyright cases take longer, since TikTok routes them through separate dedicated forms that require more detailed proof of ownership — but they also tend to carry more weight once submitted correctly, because they’re reviewed against documented rights rather than general community guidelines. For counterfeit products specifically sold through TikTok Shop, the report path is different again: it runs through the platform’s IP Protection Centre rather than the standard account-report flow, and brand owners can file directly if they hold a registered trademark. What to Do Before You Report a Fake TikTok Account — Not After The single most common mistake brands make is reporting a fake account the moment they find it, without capturing evidence first. Once TikTok actions a report — whether by removing the account or simply restricting it — the content, message history, and follower-facing claims often become unavailable. If the case later needs to support a police report, a civil claim, or even a stronger escalation within TikTok itself, that evidence is gone. Before submitting any report, capture: A full screenshot of the profile page, including the bio, profile photo, and follower count Screenshots of at least two or three posted videos showing the misuse of your branding or claims The exact account handle and profile URL Any direct messages sent to followers or customers, if accessible The date and time you observed the account Where TikTok Impersonation Becomes a Legal Matter, Not Just a Platform Issue A successful platform takedown solves the immediate visibility problem. It does not, on its own, address what happens if customers were actually defrauded, or if the impersonation involved unauthorised

Fake TikTok Accounts Targeting Kenyan Brands | How to Stop Them Read More »

How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia

⚖️ Process Service 📅 Updated June 2026 🕐 12 min read ✍️ Ultimate Forensic Consultants How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia (2026 Guide) Quick Answer To serve court papers on someone living in Kenya from the UK, USA, Canada or Australia, engage a licensed Kenyan process server directly — you do not need to travel to Kenya. Email your documents and the recipient’s details to a licensed process server operating in Kenya. The server locates the individual, effects personal service anywhere in the country, and returns a sworn, commissioned Affidavit of Service to you by email. Kenya is not a signatory to the Hague Service Convention, so there is no Central Authority to route service through — private engagement of a licensed Kenyan process server is the standard, fastest, and most cost-effective route. Formal Letters Rogatory through the High Court are available but typically take six to eighteen months and are rarely necessary for private civil matters. Every year, hundreds of UK solicitors, US attorneys, Canadian law firms, and Australian family lawyers need to serve legal documents on a person living, working, or hiding in Kenya. So do thousands of Kenyan diaspora individuals — people in Manchester, Houston, Toronto, or Melbourne who need a spouse served with divorce papers, a sibling notified in a succession dispute, or a debtor reached for a judgment enforcement action. The problem they all run into is the same: Kenya has no Hague Convention mechanism, its court registry is not equipped to accept postal service instructions from foreign lawyers, and the average Kenyan advocate receiving a cold email from a UK solicitor may not know how to handle it. This guide explains — in practical, jurisdiction-specific terms — exactly how to get someone served in Kenya from abroad: what method to use, what information to provide, what the affidavit must contain, and what happens when the person is evasive or cannot be found at the last known address. Why Kenya Is Different: No Hague Convention, No Central Authority The starting point for any foreign lawyer trying to serve documents in another country is whether that country has signed the Hague Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters (1965). If it has, there is a Central Authority through which service is formally routed. Kenya has not acceded to the Hague Service Convention. This is confirmed by the Hague Conference on Private International Law’s status table and is acknowledged in practice by courts in the UK, USA, Canada, and Australia. There is no Kenyan Central Authority. Service cannot be routed through a government office the way it can in, for example, Germany or Japan. What Kenya does have is a well-established framework for both informal and formal service of foreign process under its own Civil Procedure Rules. Order 5, Rules 32–34 of the Civil Procedure Rules, 2010 (Legal Notice No. 151 of 2010) governs the service of foreign legal process in Kenya. The Rules allow the High Court’s Registrar to receive a request for service from a foreign court and arrange execution through its own machinery — but this formal channel is slow, bureaucratic, and designed for inter-court requests, not for private client instructions. ⚠️ Critical for Foreign Lawyers The absence of Hague Convention membership does not mean service in Kenya is difficult or unreliable. It means the formal channel (Letters Rogatory via the High Court) is rarely the right tool for private civil matters. Private engagement of a licensed Kenyan process server — informal service — is the standard route used by UK, US, Canadian, and Australian law firms for more than a decade, and Kenyan affidavits of service produced this way are routinely accepted by common-law courts abroad. The Two Routes: Informal Private Service vs. Letters Rogatory Foreign lawyers and diaspora clients instructing from abroad have two principal routes for serving documents on someone in Kenya. Understanding the difference — and knowing when to use each — determines whether your matter moves in days or months. Factor Informal Private Service Letters Rogatory (Formal) Route Directly engage a licensed Kenyan process server Foreign court issues letter to Kenyan High Court Registrar via diplomatic channel Timeframe Same day to 5 business days (typical) 6–18 months (typical) Cost Fixed-fee quote; no government fees High — diplomatic fees, translation costs, advocate fees at both ends Accepted by UK courts Yes — standard practice Yes, but rarely required Accepted by US federal courts Yes — widely accepted Yes Accepted by Canadian courts Yes Yes Accepted by Australian courts Yes — Family Court regularly accepts Yes, rarely needed When required Almost all private civil, family, and commercial matters Where specific court rules or opposing party challenges require formal route Affidavit returned Same day as service (scanned); originals couriered Certificate of service from High Court Registrar; weeks after service For the overwhelming majority of instructions received from UK solicitors, US attorneys, Canadian law firms, and Australian family lawyers, informal private service by a licensed Kenyan process server is the correct route. Letters Rogatory are appropriate where: (a) the specific foreign court’s rules expressly require formal judicial service; (b) the opposing party has successfully challenged informal service in a prior round; or (c) you are serving a foreign state entity or government body. For a detailed comparison of service methods under Kenyan law, see our Process Service in Kenya pillar guide including the full methods table under Order 5 CPR. Read the Pillar Guide → Step-by-Step: How to Instruct a Process Server in Kenya From Abroad The mechanics of instructing us from outside Kenya are deliberately straightforward. You do not need a Kenyan advocate to act as intermediary (though many international law firms route instructions through one). You do not need to travel. You do not need to translate your documents into Swahili. Gather your documents and recipient details Prepare PDF copies of the documents to be served. Compile everything you know about the

How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia Read More »