Forensic Accounting - Ultimate Forensic Consultants

How to Report Cybercrime in Kenya

Cybercrime Reporting Guide | Kenya | Updated 26 October 2026 How to Report Cybercrime in Kenya: DCI, KE-CIRT, Safaricom, ODPC and Court-Ready Evidence A step-by-step guide for victims, diaspora families, advocates and businesses: who to call, in what order, what to preserve, and what the law now says after the 2025 amendments and 2026 court rulings. By Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd | Reviewed against official sources on 26 October 2026 Quick answer To report cybercrime in Kenya, preserve your evidence, alert your bank or Safaricom at once, then report to the DCI through the toll-free line 0800 722 203, WhatsApp 0709 570 000, or any police station, where you can obtain an OB number. Report hacking, scam websites and malware to the National KE-CIRT/CC at [email protected] or +254 703 042 700. Complain to the ODPC if your personal data was misused. In this guide Where to report, by type of incident The 8-step reporting process Evidence checklist Official channels directory What the law says in 2026 Making digital evidence admissible Playbooks for common scenarios What happens after you report Mistakes that weaken a case Frequently asked questions Kenya’s digital economy runs on mobile money, online banking and social platforms, and criminals follow the money. A June 2026 report from the National Computer and Cybercrimes Co-ordination Committee (NC4) described more than three billion cyberattacks in a single quarter, with Nairobi the national hotspot and cyber harassment among the leading reported offences in the Nyanza region. The Communications Authority’s own KE-CIRT/CC counted about 2.36 billion detected threat events between April and June 2026, down roughly 30 percent from the previous quarter but still enormous. Most victims lose the most valuable hours deciding who to tell. This guide removes that guesswork. It is written from a forensic investigator’s perspective: what you do in the first hour decides whether your money can be traced, whether an arrest is possible and whether your evidence will stand up in a Kenyan court. Where to report, by type of incident Several agencies share responsibility. Use this table to choose your first call, then follow the full process below. What happened Report first to Then M-Pesa fraud, fake M-Pesa messages, impersonation of Safaricom Safaricom: forward the message or number to 333, or use the Report Fraud option in the My One App DCI or nearest police station for an OB number SIM swap (your line suddenly loses signal) Your mobile operator and your bank, immediately Police report; unauthorised SIM swap is now a specific offence (s.42A) Bank card or online banking fraud Your bank’s fraud desk (use the number on your card) DCI report; keep the bank’s written acknowledgement Online shopping, job, land, investment or romance scam DCI (hotline, WhatsApp or station) KE-CIRT/CC for the scam website or account; platform report Hacked email, social media or business system; ransomware; defaced website National KE-CIRT/CC DCI for investigation and prosecution Cyber harassment, threats, sextortion, leaked intimate images DCI or nearest police station Platform takedown request; an advocate for urgent court orders Misuse or leak of personal data Office of the Data Protection Commissioner (ODPC) DCI if there is criminal conduct Child sexual abuse material or online exploitation of a child DCI immediately; Childline Kenya on 116 Do not forward or save the material You live abroad (diaspora, foreign law firm, foreign company) DCI WhatsApp 0709 570 000 (built for local and international reporting) Your home country’s police or fraud reporting service as well The 8-step process to report cybercrime in Kenya Stop the loss and secure your accountsDo not send more money, do not argue with the fraudster and do not “test” the scammer’s link again. Change passwords from a clean device, enable two-step verification and log out of all other sessions. Never share your M-Pesa PIN with anyone; Safaricom states it will never ask for it. Preserve evidence before anything disappearsScreenshot with the URL, date and time visible. Save the original messages, voice notes, emails and call logs. Do not delete the chat, block the number or uninstall the app yet. See the full checklist below. Alert your bank, Safaricom or mobile operator within minutesSpeed is the only real chance of freezing funds. Give the transaction code, amount, time and the receiving number or account. Be aware that where a recipient disputes a reversal, Safaricom has said the sender must engage the recipient or escalate through law enforcement, so do not rely on a reversal alone. Report to the DCI and obtain an OB numberUse the toll-free line, the WhatsApp channel or a police station. In practice, the hotline and WhatsApp channel are designed for anonymous intelligence; if you want a case opened, an OB number and a police abstract (often needed by banks and insurers), you will need to identify yourself and record a statement. Report technical incidents to the National KE-CIRT/CCEmail [email protected], call +254 703 042 700 or +254 730 172 700, or use the www.ke-cirt.go.ke portal. This is the right channel for malicious websites, phishing campaigns, malware, account compromise and attacks on organisations. Lodge an ODPC complaint if personal data is involvedIf a company or institution misused or exposed your personal data, a data subject can file a complaint with the Office of the Data Protection Commissioner through its online complaint form. Complaints are for natural persons (or someone they authorise), not for companies. Report the account or content to the platformUse the in-app report tools on Facebook, Instagram, X, TikTok, WhatsApp and Telegram to request removal or suspension. Quote your OB number. Platform reporting does not replace a police report; it limits ongoing harm. Follow up in writing and escalate if neededNote the investigating officer’s name and file reference. Follow up politely every one to two weeks. If the matter involves significant sums, a company, or a foreign party, instruct an advocate and a digital forensic expert early so that evidence is acquired properly. Evidence checklist: what to bring when you report Investigators can only act on what you

How to Report Cybercrime in Kenya Read More »

Employee Fraud and Internal Corporate Investigations in Kenya

Employee Fraud and Internal Corporate Investigations in Kenya Independent forensic investigations into fraud, collusion and data theft inside your organisation, run so the evidence holds up at the disciplinary hearing, in the Employment and Labour Relations Court and in a criminal case. Instruct Us on Your Matter Call +254 100 177 094 Reviewed by Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd. Last updated 1 October 2026. Quick answer An internal corporate investigation establishes what an employee or group of employees did, how, and with whose help, using evidence collected lawfully and kept in a verifiable chain of custody. Ultimate Forensic Consultants secures and analyses devices, email, system logs, payment and procurement records and documents, then reports to your board, audit committee, HR or legal team. The report supports dismissal, criminal referral and civil recovery. We are independent of the people under investigation, and we do not decide guilt: that remains the employer’s decision after a fair hearing. The schemes we investigate, and where the evidence sits Internal fraud rarely announces itself. It shows up as small anomalies in records that someone with access can control. Each scheme leaves a different trail. Scheme Typical warning signs Where we look Payroll fraud and ghost employees Staff who cannot be physically verified, duplicate bank accounts, unexplained allowances or overtime Payroll system logs, bank details against HR files, approval trails, ID and document verification Procurement fraud and kickbacks Repeat awards to one supplier, inflated prices, split orders, new vendors with no history Vendor master data, tender files, supplier registration and ownership, communications between buyers and suppliers Fictitious suppliers and false invoices Vendors sharing addresses, phone numbers or bank accounts with staff Link analysis of vendors, staff and bank accounts, invoice metadata and document examination Expense and claims fraud Recycled receipts, altered amounts, claims for unattended events Receipt forensics, email and calendar records, mobile money and card statements Cash skimming and lapping Unreconciled receipts, delayed banking, customer complaints about unrecorded payments Till and ledger data, bank deposits, CCTV, M-Pesa and Paybill reconciliations Stock theft and inventory manipulation Write-offs that repeat, shrinkage that tracks one shift or one storekeeper Stock system audit logs, gate and CCTV records, dispatch documents Data theft and IP leakage Bulk downloads before resignation, files sent to personal email or cloud, a rival launching a copy of your product Forensic images of laptops and phones, email and cloud logs, USB and printing history Conflict of interest and insider-assisted external fraud Undisclosed ownership of a supplier, staff tipping outsiders, repeated losses at one branch Company registry records, communications, system access logs, SIM and mobile money links where relevant Run it properly: five rules that protect your case Most internal fraud cases are weakened by how the employer handled them, not by the fraud. These are the rules we build every engagement around. Secure evidence before anyone is confronted Once a suspect is alerted, files are deleted and phones are reset. We image devices and preserve logs first, quietly. Investigate independently Anyone implicated, or reporting to someone implicated, stays out of the investigation. We report to the board, audit committee or counsel. Collect lawfully and proportionately Access to devices, email and personal data must follow your policies and the Data Protection Act. Unlawfully obtained evidence creates a second problem. Keep the chain of custody Every device and file is logged, hashed and documented, so the evidence can be authenticated under Sections 106A and 106B of the Evidence Act. Give the employee a fair hearing Dismissal that skips notice and a hearing can be found unfair even where the fraud is real. Our report feeds the process. It does not replace it. What UFC delivers Digital evidence acquisition Forensic imaging of laptops, phones, servers and cloud accounts, with recovery of deleted files and messages. Transaction and document analysis Tracing payments and approvals, and forensic examination of invoices, contracts, signatures and altered records. Link and relationship analysis Connecting staff, vendors, bank accounts, phone numbers and companies to expose collusion and undisclosed interests. Structured interviews Planned, documented interviews of witnesses and subjects, conducted without coercion and recorded properly. Asset tracing and recovery support Identifying where diverted funds went, to support civil recovery, freezing applications and settlement negotiations. Report, hearing and court support A clear findings report for the disciplinary panel, a referral pack for the police or EACC, and expert testimony in court. Two illustrative cases: ghost employees and inventory manipulation These scenarios are composites of patterns we see in Kenyan organisations. Names, sectors and figures are changed or indicative, and they are not reports of a specific client’s matter. Payroll fraud: ghost employees on a multi-site payroll What was suspected A manufacturer with several sites noticed that payroll cost was rising faster than headcount. Finance and HR each suspected the other’s records. What we examined Payroll master data and audit logs, HR personnel files, physical verification of staff at each site, bank and mobile money details of every payee, and a forensic image of the payroll officer’s workstation. What the record showed A group of payees could not be verified as real people, with no attendance records and no supervisor who knew them. Several shared the same bank account or phone number. Their records were created and edited after hours under one officer’s login, and approvals came from a supervisor whose credentials were being used by someone else. How the money moved Net pay for the ghost payees was paid into a small set of accounts. Link analysis tied those accounts to a relative of the payroll officer. What the report supported A fair disciplinary hearing, a criminal referral with a complete evidence pack and a civil recovery claim. It also set out the control failures: no segregation of duties, shared credentials and no periodic headcount verification. Inventory manipulation: write-offs that followed one storekeeper What was suspected A distributor saw repeated “damaged goods” write-offs at one warehouse that did not match supplier returns or insurance claims. What we examined Stock system adjustment logs,

Employee Fraud and Internal Corporate Investigations in Kenya Read More »

Business Email Compromise Kenya: How Digital Forensics Uncovers Fake Invoices & CEO Fraud

Business Email Compromise Kenya · Digital Forensics The Wire Instruction Came From Your Supplier. Except It Didn’t. Business Email Compromise in Kenya rarely looks like a hack. It looks like an ordinary email, from an ordinary sender, asking for something an ordinary sender would ask for — until forensic analysis of the header tells a different story. 3Authentication checks every header must pass 90 DaysTypical M365 audit log window before evidence degrades 106AEvidence Act standard for email admissibility In short Business Email Compromise (BEC) in Kenya is proven, not assumed. Digital forensic examiners recover and analyze the full raw email header — not just what appears on screen — to establish whether a message was spoofed from outside the organisation or sent from a genuinely compromised Microsoft 365 mailbox. That distinction determines who is liable, what a bank can act on, and what a court will accept as evidence. Banks & Financial Institutions Corporates & Finance Teams Law Firms & Litigators Why Business Email Compromise Is Kenya’s Costliest Quiet Fraud Business Email Compromise doesn’t trip antivirus software or trigger a firewall alert. It exploits trust between two humans who already do business with each other — a supplier and a client, a CFO and a bookkeeper, a law firm and its escrow client. That’s what makes Business Email Compromise in Kenya so difficult for finance teams to catch in the moment, and why forensic reconstruction after the fact is so often the only route back to the truth — and to any recoverable funds. Three patterns account for most of the BEC matters instructed to forensic examiners in Kenya: 🧾 Fake Invoice Fraud A genuine supplier relationship is hijacked mid-transaction. New “updated” bank details arrive on an invoice that looks identical to every previous one — because the template, logo and reference numbers were copied from a real, intercepted email. 🧑‍💼 CEO Fraud An urgent instruction, apparently from a senior executive, requests an unusual same-day transfer — deliberately timed for when the real executive is travelling or unreachable to verify by phone. 💰 Payroll & Account Diversion HR or payroll receives a request, apparently from an employee, to update salary bank details — quietly redirecting future payroll to an account the employee never opened. “The logo is real. The signature block is real. The one thing that isn’t real is the path the email actually travelled to reach the inbox.” Spoofing vs. Compromise: Two Different Crimes, Two Different Evidence Trails Every BEC case forensically resolves into one of two categories, and the distinction changes everything about liability and recovery: Email Spoofing The attacker never accessed the real account. Instead, they forge the “From” name and address so the message displays as if it came from a trusted sender, while it was actually sent through an entirely different mail server. Spoofing leaves its fingerprints in authentication results and the header’s server path — the account itself was never touched. Account Compromise Here, the attacker genuinely logged into the real mailbox, usually via a phished password or a stolen session token. The email genuinely came from the real account — the evidence trail instead lives in sign-in logs, new mailbox rules, and permission changes inside Microsoft 365, not in the header’s authentication fields. Header Analysis: Reading What the Inbox Doesn’t Show You Every email carries a raw header most people never see — a technical record of every server it passed through and every authentication check it was subjected to. This is the primary forensic artifact in a spoofing investigation. Anatomy of a Spoofed Header What the Reader Sees vs. What the Header Actually Records A simplified, illustrative header — annotated the way an examiner reads it during a Business Email Compromise investigation in Kenya. From:Finance Director <[email protected]> Reply-To:[email protected] MISMATCH Return-Path:[email protected] DOMAIN Received:from unlisted-smtp-relay (unverified) by …UNRECOGNISED SERVER SPF:softfailFAIL DKIM:noneFAIL DMARC:fail, p=rejectFAIL FAIL Authentication check failed — strong spoofing indicator WARN Inconsistent but not conclusive alone PASS Consistent with genuine sender Three fields do most of the work in a spoofing determination. SPF (Sender Policy Framework) checks whether the sending server is authorised to send on behalf of that domain. DKIM (DomainKeys Identified Mail) verifies a cryptographic signature tied to the domain, which a spoofer cannot forge without access to the domain’s private key. DMARC tells receiving servers what to do when SPF or DKIM fail — and its own pass/fail result, together with the alignment between the visible “From” and the technical “Return-Path,” is often the single clearest indicator an examiner presents to a court or a bank’s fraud team. A subtly misspelled domain — an extra letter, a swapped character, a different top-level domain — is one of the most common spoofing techniques precisely because it survives a quick visual read. Forensic analysis compares every domain reference in the header character-by-character, which is where these near-identical impersonations are caught. Microsoft 365 Investigations: What to Pull When the Mailbox Itself Was Compromised When the evidence points to genuine account compromise rather than spoofing, the investigation moves from the header into Microsoft 365’s own audit and security infrastructure. AUDIT LOG Unified Audit Log: records mailbox access, file access, and administrative actions — the primary timeline for establishing exactly when compromise occurred and what the attacker did with access. INBOX RULES Malicious forwarding rules: attackers frequently create a hidden rule that silently forwards or deletes specific incoming emails — commonly used to intercept invoice replies and hide them from the real account owner. SIGN-IN LOGS Azure AD sign-in records: reveal login location, device, and “impossible travel” patterns — a login from Nairobi followed minutes later by one from an unrelated country is a strong compromise indicator. PERMISSIONS Mailbox delegate & permission changes: attackers sometimes grant themselves or another mailbox ongoing access rather than repeatedly logging in — a change examiners specifically check for. Where This Sits in Kenyan Law Computer Misuse & Cybercrimes Act 2018: unauthorised access to a mailbox and forgery of an electronic message both form distinct criminal grounds under

Business Email Compromise Kenya: How Digital Forensics Uncovers Fake Invoices & CEO Fraud Read More »