Diaspora Forensic Services

Sim swap fraud in Kenya

Digital & Cyber Forensics · Kenya The Fraud That Happens Faster Than You Can Call Your Bank. A SIM swap doesn’t announce itself. It arrives as a dead signal bar, then a silence where your OTPs used to be. By the time most victims understand what happened, the forensic window is already closing. 106AEvidence Act admissibility standard CMCA 2018Identity theft & unauthorised access <30 daysBefore telco record quality degrades In short A SIM swap is proven with three independent records, not one: the telco’s porting log and cell-site data, the victim’s device forensics, and the mobile money or bank transaction trail. None of these live on the phone the victim is holding — which is why most victims believe the evidence is gone. It usually isn’t, if an examiner is instructed quickly. Why SIM Swap Is a Forensic Problem, Not Just a Fraud Problem Most fraud leaves a fingerprint on the device it happened on. A SIM swap doesn’t. The victim’s phone is often untouched — the compromise happens upstream, at the telco, when a fraudster convinces an agent or exploits a porting process to move the victim’s number onto a SIM they control. From that moment, every OTP, every banking alert, every M-Pesa confirmation goes to the attacker instead. This is precisely why SIM swap cases are misunderstood by victims and, often, by the legal teams instructed to recover their losses. The instinct is to examine the phone. The evidence, in fact, sits in three separate custody chains — the mobile network operator, the financial institution, and whatever secondary device or account the attacker touched — and a forensic examiner’s job is to reconstruct all three into one timeline that satisfies Section 106A of the Evidence Act (Cap. 80). “The victim didn’t lose their phone. They lost control of who their phone believed they were.” Anatomy of a SIM Swap: What Actually Happens, Minute by Minute Reconstructed Attack Sequence Six Stages, Usually Under an Hour This sequence is drawn from the typology of SIM swap matters examined across Kenyan recovery and criminal proceedings. It is the reconstruction an examiner builds after the fact — not a warning about method. Stage 1 Target Profiling The attacker gathers enough personal detail — often from a prior data leak or social engineering — to pass identity verification for a line swap. Evidence: none yet Stage 2 The Porting Request A swap or replacement SIM request is filed against the victim’s line, at an agent outlet or through a channel with weaker verification. Evidence: telco porting log, agent ID, timestamp Stage 3 Signal Loss The victim’s genuine SIM goes dark. This is usually the only signal the victim experiences directly — and it is frequently dismissed as a network fault. Evidence: victim’s own device log, network deregistration event Stage 4 Account Takeover OTPs and password reset links now route to the attacker’s SIM. Banking apps, M-Pesa, and email accounts are reset in sequence. Evidence: bank/telco OTP delivery logs, login IP and device fingerprints Stage 5 Extraction Funds move — typically through mobile money to a chain of intermediary accounts or agent tills designed to fragment the trail quickly. Evidence: M-Pesa/bank transaction records, agent till mapping Stage 6 Discovery The victim regains signal — often hours later — to a phone with no missed alerts and accounts already drained. This is where most cases begin. It should be Stage 1. How a Forensic Examiner Traces It Reconstruction works backward from Stage 6 to Stage 2 — each stage confirmed by an independent, third-party record rather than the victim’s own account of events. 01 Call Detail Record (CDR) Analysis Cross-references the moment the genuine SIM deregistered against the network against the moment the replacement SIM activated — establishing the precise swap window. 02 Porting & Agent Audit Trail Examines the identification documents, agent code, and outlet used for the swap request — frequently the weakest link and the basis for a negligence claim against the telco. 03 OTP & Login Fingerprinting Maps every OTP delivery, password reset, and login event to a device and IP address — distinguishing the victim’s genuine activity from the attacker’s. 04 Mobile Money & Bank Transaction Mapping Follows the extracted funds through agent tills and intermediary accounts, producing the structured financial timeline Kenyan courts expect in recovery proceedings. 05 Victim Device Verification Confirms the victim’s own device holds no evidence of compromise — closing off a common defence argument that the victim authorised the transactions themselves. 06 Unified Evidentiary Timeline All five records are merged into one Order 18-compliant report, with each of the three Section 106A conditions addressed against every record relied upon. Where This Sits in Kenyan Law Computer Misuse & Cybercrimes Act 2018: unauthorised access and identity theft provisions form the criminal basis for prosecuting the swap itself. Evidence Act (Cap. 80), ss. 106A–106C: each of the telco, banking, and mobile money records must independently satisfy the “regular use, functioning properly, ordinary course of activity” test before a court will rely on it. Data Protection Act 2019: governs how examiners lawfully obtain and process the personal data within telco and financial records during reconstruction. Illustrative Matter · Nairobi · Recovery Litigation KES 2.3M Moved in 41 Minutes — Traced to an Agent Outlet Swap A victim’s line went silent mid-afternoon; by the time signal returned, KES 2.3 million had moved from a bank account through four mobile money agents. UFC’s CDR analysis pinpointed the exact deregistration and re-registration window, and porting-log examination identified the outlet and agent code used for the swap — evidence the telco’s own verification process had failed at that specific point. Financial timeline and porting failure documented for recovery proceedings against the telco and receiving accounts. Frequently Asked Questions Can a SIM swap be proven after the money is already gone? Yes, in most cases. The evidence does not live on the victim’s phone — it lives with the telco (porting requests, agent ID, cell-site data) and the receiving financial trail. Forensic

Sim swap fraud in Kenya Read More »

Fake TikTok Accounts Targeting Kenyan Brands | How to Stop Them

Brand Protection · TikTok Fake TikTok Accounts Are Targeting Kenyan Brands — Here’s How to Get Them Removed A practical guide to spotting, evidencing, and reporting brand impersonation on TikTok, with the legal options available under Kenyan law. 📅 Updated June 2026 🕐 8 min read ✍️ Ultimate Forensic Consultants If your business has any presence on TikTok — or even if it doesn’t — there’s a real chance someone else is already pretending to be you on the platform. TikTok’s growth in Kenya has been fast enough that brand impersonation has outpaced most businesses’ ability to monitor for it, and the accounts doing the impersonating aren’t always obvious at a glance. Quick Answer To get a fake TikTok account impersonating your brand removed, report it in-app under “Pretending to be someone” for straightforward impersonation, or file TikTok’s dedicated trademark infringement form if your logo or registered mark is involved — this routes the case to TikTok’s IP review team rather than general moderation. Capture full screenshots of the profile, its videos, and any direct messages before submitting any report, since evidence often becomes inaccessible once a report is actioned. If customers were defrauded, the matter can also be reported to Kenya’s DCI Cybercrime Unit under Section 29 of the Computer Misuse and Cybercrimes Act, 2018. 📰 According to a public statement reported by Kenyans.co.ke in May 2025, the National Transport and Safety Authority had to warn Kenyans about a fake TikTok account using its name, which the authority itself described as a scheme to defraud followers — an account that had already gathered more than 8,600 followers before anyone formally flagged it. If a national government agency can be impersonated at that scale before detection, smaller businesses are at least as exposed, usually with far less capacity to respond quickly. Why TikTok Specifically Is a Growing Risk for Kenyan Brands TikTok occupies a different position than Facebook or Instagram in the brand-impersonation landscape, for a few reasons worth understanding before you build a response plan. First, the audience skews younger and faster-moving — content spreads through the algorithm rather than through a follower’s existing network, which means a fake account can reach thousands of people who have never seen your real brand before, with no way to compare. Second, the platform’s most common scam formats — fake giveaways, “instant earnings” offers, romance-style approaches, and bogus brand-deal messages — are specifically built around urgency and trust, which makes a convincing fake business account more dangerous per-follower than on other platforms. Third, TikTok Shop adds a commerce layer that Instagram and Facebook don’t have in the same way, meaning impersonation isn’t always just reputational — it can be a direct financial scam wearing your brand’s name. The Four TikTok Impersonation Patterns Showing Up Most in Kenya 01 Cloned Business Accounts A near-identical account using your logo, brand name, and stolen product or service photos — often messaging your actual followers directly to redirect them toward a scam offer or fraudulent payment request. 02 Fake Giveaway & “Instant Earnings” Videos Accounts using a recognisable brand name to promise unrealistic returns or free products in exchange for an upfront M-Pesa payment or personal details. 03 Counterfeit Listings on TikTok Shop Products listed using your brand name, packaging, or photos, sold by an account with no actual connection to your business. 04 Fake Verification & Partnership Offers Messages claiming to offer TikTok verification, brand partnerships, or paid collaborations — usually designed to harvest credentials or extract a “processing fee.” How to Actually Report a Fake Account on TikTok TikTok’s in-app reporting tool splits impersonation reports into three categories, and choosing the right one matters for how fast — and how seriously — your report gets handled. Pretending to be someone Use when the account is directly impersonating your brand or a specific person — especially if you can reference your own verified or established account as the real one. Fraud & scams Use when the account is actively collecting payments or running a scam, whether or not it involves your specific trademark. IP violation Use for cases involving your logo, registered trademark, or copyrighted content — this routes the report to TikTok’s dedicated IP review team rather than general community moderation. For straightforward impersonation and fraud cases, selecting the right category and submitting is usually enough to get a review started. Trademark and copyright cases take longer, since TikTok routes them through separate dedicated forms that require more detailed proof of ownership — but they also tend to carry more weight once submitted correctly, because they’re reviewed against documented rights rather than general community guidelines. For counterfeit products specifically sold through TikTok Shop, the report path is different again: it runs through the platform’s IP Protection Centre rather than the standard account-report flow, and brand owners can file directly if they hold a registered trademark. What to Do Before You Report a Fake TikTok Account — Not After The single most common mistake brands make is reporting a fake account the moment they find it, without capturing evidence first. Once TikTok actions a report — whether by removing the account or simply restricting it — the content, message history, and follower-facing claims often become unavailable. If the case later needs to support a police report, a civil claim, or even a stronger escalation within TikTok itself, that evidence is gone. Before submitting any report, capture: A full screenshot of the profile page, including the bio, profile photo, and follower count Screenshots of at least two or three posted videos showing the misuse of your branding or claims The exact account handle and profile URL Any direct messages sent to followers or customers, if accessible The date and time you observed the account Where TikTok Impersonation Becomes a Legal Matter, Not Just a Platform Issue A successful platform takedown solves the immediate visibility problem. It does not, on its own, address what happens if customers were actually defrauded, or if the impersonation involved unauthorised

Fake TikTok Accounts Targeting Kenyan Brands | How to Stop Them Read More »

How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia

⚖️ Process Service 📅 Updated June 2026 🕐 12 min read ✍️ Ultimate Forensic Consultants How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia (2026 Guide) Quick Answer To serve court papers on someone living in Kenya from the UK, USA, Canada or Australia, engage a licensed Kenyan process server directly — you do not need to travel to Kenya. Email your documents and the recipient’s details to a licensed process server operating in Kenya. The server locates the individual, effects personal service anywhere in the country, and returns a sworn, commissioned Affidavit of Service to you by email. Kenya is not a signatory to the Hague Service Convention, so there is no Central Authority to route service through — private engagement of a licensed Kenyan process server is the standard, fastest, and most cost-effective route. Formal Letters Rogatory through the High Court are available but typically take six to eighteen months and are rarely necessary for private civil matters. Every year, hundreds of UK solicitors, US attorneys, Canadian law firms, and Australian family lawyers need to serve legal documents on a person living, working, or hiding in Kenya. So do thousands of Kenyan diaspora individuals — people in Manchester, Houston, Toronto, or Melbourne who need a spouse served with divorce papers, a sibling notified in a succession dispute, or a debtor reached for a judgment enforcement action. The problem they all run into is the same: Kenya has no Hague Convention mechanism, its court registry is not equipped to accept postal service instructions from foreign lawyers, and the average Kenyan advocate receiving a cold email from a UK solicitor may not know how to handle it. This guide explains — in practical, jurisdiction-specific terms — exactly how to get someone served in Kenya from abroad: what method to use, what information to provide, what the affidavit must contain, and what happens when the person is evasive or cannot be found at the last known address. Why Kenya Is Different: No Hague Convention, No Central Authority The starting point for any foreign lawyer trying to serve documents in another country is whether that country has signed the Hague Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters (1965). If it has, there is a Central Authority through which service is formally routed. Kenya has not acceded to the Hague Service Convention. This is confirmed by the Hague Conference on Private International Law’s status table and is acknowledged in practice by courts in the UK, USA, Canada, and Australia. There is no Kenyan Central Authority. Service cannot be routed through a government office the way it can in, for example, Germany or Japan. What Kenya does have is a well-established framework for both informal and formal service of foreign process under its own Civil Procedure Rules. Order 5, Rules 32–34 of the Civil Procedure Rules, 2010 (Legal Notice No. 151 of 2010) governs the service of foreign legal process in Kenya. The Rules allow the High Court’s Registrar to receive a request for service from a foreign court and arrange execution through its own machinery — but this formal channel is slow, bureaucratic, and designed for inter-court requests, not for private client instructions. ⚠️ Critical for Foreign Lawyers The absence of Hague Convention membership does not mean service in Kenya is difficult or unreliable. It means the formal channel (Letters Rogatory via the High Court) is rarely the right tool for private civil matters. Private engagement of a licensed Kenyan process server — informal service — is the standard route used by UK, US, Canadian, and Australian law firms for more than a decade, and Kenyan affidavits of service produced this way are routinely accepted by common-law courts abroad. The Two Routes: Informal Private Service vs. Letters Rogatory Foreign lawyers and diaspora clients instructing from abroad have two principal routes for serving documents on someone in Kenya. Understanding the difference — and knowing when to use each — determines whether your matter moves in days or months. Factor Informal Private Service Letters Rogatory (Formal) Route Directly engage a licensed Kenyan process server Foreign court issues letter to Kenyan High Court Registrar via diplomatic channel Timeframe Same day to 5 business days (typical) 6–18 months (typical) Cost Fixed-fee quote; no government fees High — diplomatic fees, translation costs, advocate fees at both ends Accepted by UK courts Yes — standard practice Yes, but rarely required Accepted by US federal courts Yes — widely accepted Yes Accepted by Canadian courts Yes Yes Accepted by Australian courts Yes — Family Court regularly accepts Yes, rarely needed When required Almost all private civil, family, and commercial matters Where specific court rules or opposing party challenges require formal route Affidavit returned Same day as service (scanned); originals couriered Certificate of service from High Court Registrar; weeks after service For the overwhelming majority of instructions received from UK solicitors, US attorneys, Canadian law firms, and Australian family lawyers, informal private service by a licensed Kenyan process server is the correct route. Letters Rogatory are appropriate where: (a) the specific foreign court’s rules expressly require formal judicial service; (b) the opposing party has successfully challenged informal service in a prior round; or (c) you are serving a foreign state entity or government body. For a detailed comparison of service methods under Kenyan law, see our Process Service in Kenya pillar guide including the full methods table under Order 5 CPR. Read the Pillar Guide → Step-by-Step: How to Instruct a Process Server in Kenya From Abroad The mechanics of instructing us from outside Kenya are deliberately straightforward. You do not need a Kenyan advocate to act as intermediary (though many international law firms route instructions through one). You do not need to travel. You do not need to translate your documents into Swahili. Gather your documents and recipient details Prepare PDF copies of the documents to be served. Compile everything you know about the

How to Serve Court Papers on Someone in Kenya from the UK, USA, Canada or Australia Read More »