Private Investigation

Business Email Compromise Kenya: How Digital Forensics Uncovers Fake Invoices & CEO Fraud

Business Email Compromise Kenya · Digital Forensics The Wire Instruction Came From Your Supplier. Except It Didn’t. Business Email Compromise in Kenya rarely looks like a hack. It looks like an ordinary email, from an ordinary sender, asking for something an ordinary sender would ask for — until forensic analysis of the header tells a different story. 3Authentication checks every header must pass 90 DaysTypical M365 audit log window before evidence degrades 106AEvidence Act standard for email admissibility In short Business Email Compromise (BEC) in Kenya is proven, not assumed. Digital forensic examiners recover and analyze the full raw email header — not just what appears on screen — to establish whether a message was spoofed from outside the organisation or sent from a genuinely compromised Microsoft 365 mailbox. That distinction determines who is liable, what a bank can act on, and what a court will accept as evidence. Banks & Financial Institutions Corporates & Finance Teams Law Firms & Litigators Why Business Email Compromise Is Kenya’s Costliest Quiet Fraud Business Email Compromise doesn’t trip antivirus software or trigger a firewall alert. It exploits trust between two humans who already do business with each other — a supplier and a client, a CFO and a bookkeeper, a law firm and its escrow client. That’s what makes Business Email Compromise in Kenya so difficult for finance teams to catch in the moment, and why forensic reconstruction after the fact is so often the only route back to the truth — and to any recoverable funds. Three patterns account for most of the BEC matters instructed to forensic examiners in Kenya: 🧾 Fake Invoice Fraud A genuine supplier relationship is hijacked mid-transaction. New “updated” bank details arrive on an invoice that looks identical to every previous one — because the template, logo and reference numbers were copied from a real, intercepted email. 🧑‍💼 CEO Fraud An urgent instruction, apparently from a senior executive, requests an unusual same-day transfer — deliberately timed for when the real executive is travelling or unreachable to verify by phone. 💰 Payroll & Account Diversion HR or payroll receives a request, apparently from an employee, to update salary bank details — quietly redirecting future payroll to an account the employee never opened. “The logo is real. The signature block is real. The one thing that isn’t real is the path the email actually travelled to reach the inbox.” Spoofing vs. Compromise: Two Different Crimes, Two Different Evidence Trails Every BEC case forensically resolves into one of two categories, and the distinction changes everything about liability and recovery: Email Spoofing The attacker never accessed the real account. Instead, they forge the “From” name and address so the message displays as if it came from a trusted sender, while it was actually sent through an entirely different mail server. Spoofing leaves its fingerprints in authentication results and the header’s server path — the account itself was never touched. Account Compromise Here, the attacker genuinely logged into the real mailbox, usually via a phished password or a stolen session token. The email genuinely came from the real account — the evidence trail instead lives in sign-in logs, new mailbox rules, and permission changes inside Microsoft 365, not in the header’s authentication fields. Header Analysis: Reading What the Inbox Doesn’t Show You Every email carries a raw header most people never see — a technical record of every server it passed through and every authentication check it was subjected to. This is the primary forensic artifact in a spoofing investigation. Anatomy of a Spoofed Header What the Reader Sees vs. What the Header Actually Records A simplified, illustrative header — annotated the way an examiner reads it during a Business Email Compromise investigation in Kenya. From:Finance Director <[email protected]> Reply-To:[email protected] MISMATCH Return-Path:[email protected] DOMAIN Received:from unlisted-smtp-relay (unverified) by …UNRECOGNISED SERVER SPF:softfailFAIL DKIM:noneFAIL DMARC:fail, p=rejectFAIL FAIL Authentication check failed — strong spoofing indicator WARN Inconsistent but not conclusive alone PASS Consistent with genuine sender Three fields do most of the work in a spoofing determination. SPF (Sender Policy Framework) checks whether the sending server is authorised to send on behalf of that domain. DKIM (DomainKeys Identified Mail) verifies a cryptographic signature tied to the domain, which a spoofer cannot forge without access to the domain’s private key. DMARC tells receiving servers what to do when SPF or DKIM fail — and its own pass/fail result, together with the alignment between the visible “From” and the technical “Return-Path,” is often the single clearest indicator an examiner presents to a court or a bank’s fraud team. A subtly misspelled domain — an extra letter, a swapped character, a different top-level domain — is one of the most common spoofing techniques precisely because it survives a quick visual read. Forensic analysis compares every domain reference in the header character-by-character, which is where these near-identical impersonations are caught. Microsoft 365 Investigations: What to Pull When the Mailbox Itself Was Compromised When the evidence points to genuine account compromise rather than spoofing, the investigation moves from the header into Microsoft 365’s own audit and security infrastructure. AUDIT LOG Unified Audit Log: records mailbox access, file access, and administrative actions — the primary timeline for establishing exactly when compromise occurred and what the attacker did with access. INBOX RULES Malicious forwarding rules: attackers frequently create a hidden rule that silently forwards or deletes specific incoming emails — commonly used to intercept invoice replies and hide them from the real account owner. SIGN-IN LOGS Azure AD sign-in records: reveal login location, device, and “impossible travel” patterns — a login from Nairobi followed minutes later by one from an unrelated country is a strong compromise indicator. PERMISSIONS Mailbox delegate & permission changes: attackers sometimes grant themselves or another mailbox ongoing access rather than repeatedly logging in — a change examiners specifically check for. Where This Sits in Kenyan Law Computer Misuse & Cybercrimes Act 2018: unauthorised access to a mailbox and forgery of an electronic message both form distinct criminal grounds under

Business Email Compromise Kenya: How Digital Forensics Uncovers Fake Invoices & CEO Fraud Read More »

Computer & Hard Drive Forensics in Kenya: How Forensic Imaging Proves Backdated Documents and Data Theft

Digital & Cyber Forensics · Kenya The File Says January. The Drive Says Otherwise. Anyone can change the date on a document. Almost no one can change what the file system quietly recorded underneath it. That gap is where computer and hard drive forensics does its work. 4Timestamps cross-examined per file 0Alterations made to the original drive SHA-256Hash standard verifying image integrity In short Computer and hard drive forensics never examines the original device. A write-blocked, hash-verified image is captured first, and every finding — deleted files, backdated documents, exfiltrated data — is drawn from that image. This is what allows the original to be handed straight back to its owner while the analysis proceeds, and what makes the findings defensible if the opposing side challenges how the evidence was handled. Why the Original Drive Is Never Touched The most common way digital evidence gets thrown out in a Kenyan court isn’t a bad finding — it’s a bad process. If an examiner works directly on the original computer, opposing counsel only needs to raise one question: how do we know nothing was altered? Forensic imaging exists to remove that question entirely. A write-blocker is a hardware device that physically permits data to be read off a drive while making it impossible to write anything back to it — not even an operating system’s routine background writes. Once attached, the examiner captures a complete, bit-for-bit copy of the drive, including deleted and unallocated space the owner can no longer see through normal use. All analysis happens on that copy. “You cannot argue with a hash value. Either the image matches the original, or it doesn’t — there is no middle ground for a court to weigh.” The Imaging Chain Evidence Integrity Process Five Steps Before Analysis Even Begins This sequence is what a chain-of-custody log actually documents — and what an opposing expert will look for gaps in first. 1 Write-Blocker Attached The drive is connected through hardware that permits reading only — no write commands can reach it. 2 Bit-for-Bit Image Captured Every sector is copied, including deleted and unallocated space — not just visible files. 3 Hash Value Generated A SHA-256 fingerprint is calculated for the original and the image, immediately after capture. 4 Hash Verified Match Original and image hashes are compared — an exact match proves the copy is forensically identical. 5 Original Sealed & Returned The source drive is logged and returned to its owner. All further work happens only on the verified image. Proving a Backdated Document A document’s visible “created” date is something almost any user can edit or spoof. What’s far harder to falsify consistently is the constellation of timestamps the file system itself maintains — commonly referred to by examiners as MACE metadata. Reconstructing a genuine timeline means comparing all four against each other and against other artifacts on the drive: recent-file lists, print spool records, backup snapshots, and system event logs from around the claimed date. M Modified Last time the file’s content was changed A Accessed Last time the file was opened or read C Created When the file first appeared on this drive E Entry Modified Last change to the file’s own metadata record A document that was genuinely drafted on the claimed date will show these four timestamps in a pattern consistent with normal editing. A document that was written recently and then dated backward almost always shows an inconsistency somewhere in that pattern — a created date that postdates a modified date, for instance, or a file that was “created” in one location but whose surrounding system artifacts place it somewhere else entirely. Data Exfiltration: What an Employee’s Drive Actually Reveals When a departing employee is suspected of taking client lists, source code, or commercial records, the drive rarely has to be searched blindly — it already keeps a record of what left it. USB Removable device history: the registry retains a record of every USB drive ever connected, including serial numbers and the first and last time each was plugged in. RECENT Recently accessed files: shortcuts and jump lists reveal exactly which files were opened in the days before resignation, even if the files themselves were later deleted. CLOUD Sync and upload artifacts: local cache folders for cloud storage clients often retain evidence of what was uploaded, even after the account is logged out. DELETED Unallocated space recovery: deleting a file removes its directory entry, not the underlying data — recoverable until that space is overwritten by new files. Where This Sits in Kenyan Law Evidence Act (Cap. 80), ss. 106A–106C: the forensic image and its findings must meet the same “regular use, no unauthorised interference” standard as any other electronic record before a court will admit it. Computer Misuse & Cybercrimes Act 2018: unauthorised access to an employer’s system, or unauthorised copying of protected data, forms the criminal basis where exfiltration crosses into a prosecutable offence. Employment Act, 2007: forensic findings of exfiltration or policy breach frequently underpin the fairness of a summary dismissal, which is why documented, defensible process matters as much as the finding itself. Illustrative Matter · Nairobi · Corporate Instruction A Resignation Letter, Backdated by Eleven Days A departing finance manager produced a resignation letter dated to before a disputed transaction was authorised. Forensic imaging of the laptop showed the document’s file-system creation timestamp postdated the transaction by several days, while the visible “date” field in the document text had been manually altered. Recent-file artifacts further placed the document’s drafting session on a specific afternoon, corroborated by login records for that session. Timestamp inconsistency and drafting-session evidence documented for the client’s legal team ahead of tribunal proceedings. Frequently Asked Questions Does forensic imaging require shutting down or taking away the original computer? No. A write-blocked bit-for-bit image can usually be captured on-site, with the original device returned to service the same day. Every subsequent examination happens on the image, never the original — which is what keeps the original

Computer & Hard Drive Forensics in Kenya: How Forensic Imaging Proves Backdated Documents and Data Theft Read More »

Sim swap fraud in Kenya

Digital & Cyber Forensics · Kenya The Fraud That Happens Faster Than You Can Call Your Bank. A SIM swap doesn’t announce itself. It arrives as a dead signal bar, then a silence where your OTPs used to be. By the time most victims understand what happened, the forensic window is already closing. 106AEvidence Act admissibility standard CMCA 2018Identity theft & unauthorised access <30 daysBefore telco record quality degrades In short A SIM swap is proven with three independent records, not one: the telco’s porting log and cell-site data, the victim’s device forensics, and the mobile money or bank transaction trail. None of these live on the phone the victim is holding — which is why most victims believe the evidence is gone. It usually isn’t, if an examiner is instructed quickly. Why SIM Swap Is a Forensic Problem, Not Just a Fraud Problem Most fraud leaves a fingerprint on the device it happened on. A SIM swap doesn’t. The victim’s phone is often untouched — the compromise happens upstream, at the telco, when a fraudster convinces an agent or exploits a porting process to move the victim’s number onto a SIM they control. From that moment, every OTP, every banking alert, every M-Pesa confirmation goes to the attacker instead. This is precisely why SIM swap cases are misunderstood by victims and, often, by the legal teams instructed to recover their losses. The instinct is to examine the phone. The evidence, in fact, sits in three separate custody chains — the mobile network operator, the financial institution, and whatever secondary device or account the attacker touched — and a forensic examiner’s job is to reconstruct all three into one timeline that satisfies Section 106A of the Evidence Act (Cap. 80). “The victim didn’t lose their phone. They lost control of who their phone believed they were.” Anatomy of a SIM Swap: What Actually Happens, Minute by Minute Reconstructed Attack Sequence Six Stages, Usually Under an Hour This sequence is drawn from the typology of SIM swap matters examined across Kenyan recovery and criminal proceedings. It is the reconstruction an examiner builds after the fact — not a warning about method. Stage 1 Target Profiling The attacker gathers enough personal detail — often from a prior data leak or social engineering — to pass identity verification for a line swap. Evidence: none yet Stage 2 The Porting Request A swap or replacement SIM request is filed against the victim’s line, at an agent outlet or through a channel with weaker verification. Evidence: telco porting log, agent ID, timestamp Stage 3 Signal Loss The victim’s genuine SIM goes dark. This is usually the only signal the victim experiences directly — and it is frequently dismissed as a network fault. Evidence: victim’s own device log, network deregistration event Stage 4 Account Takeover OTPs and password reset links now route to the attacker’s SIM. Banking apps, M-Pesa, and email accounts are reset in sequence. Evidence: bank/telco OTP delivery logs, login IP and device fingerprints Stage 5 Extraction Funds move — typically through mobile money to a chain of intermediary accounts or agent tills designed to fragment the trail quickly. Evidence: M-Pesa/bank transaction records, agent till mapping Stage 6 Discovery The victim regains signal — often hours later — to a phone with no missed alerts and accounts already drained. This is where most cases begin. It should be Stage 1. How a Forensic Examiner Traces It Reconstruction works backward from Stage 6 to Stage 2 — each stage confirmed by an independent, third-party record rather than the victim’s own account of events. 01 Call Detail Record (CDR) Analysis Cross-references the moment the genuine SIM deregistered against the network against the moment the replacement SIM activated — establishing the precise swap window. 02 Porting & Agent Audit Trail Examines the identification documents, agent code, and outlet used for the swap request — frequently the weakest link and the basis for a negligence claim against the telco. 03 OTP & Login Fingerprinting Maps every OTP delivery, password reset, and login event to a device and IP address — distinguishing the victim’s genuine activity from the attacker’s. 04 Mobile Money & Bank Transaction Mapping Follows the extracted funds through agent tills and intermediary accounts, producing the structured financial timeline Kenyan courts expect in recovery proceedings. 05 Victim Device Verification Confirms the victim’s own device holds no evidence of compromise — closing off a common defence argument that the victim authorised the transactions themselves. 06 Unified Evidentiary Timeline All five records are merged into one Order 18-compliant report, with each of the three Section 106A conditions addressed against every record relied upon. Where This Sits in Kenyan Law Computer Misuse & Cybercrimes Act 2018: unauthorised access and identity theft provisions form the criminal basis for prosecuting the swap itself. Evidence Act (Cap. 80), ss. 106A–106C: each of the telco, banking, and mobile money records must independently satisfy the “regular use, functioning properly, ordinary course of activity” test before a court will rely on it. Data Protection Act 2019: governs how examiners lawfully obtain and process the personal data within telco and financial records during reconstruction. Illustrative Matter · Nairobi · Recovery Litigation KES 2.3M Moved in 41 Minutes — Traced to an Agent Outlet Swap A victim’s line went silent mid-afternoon; by the time signal returned, KES 2.3 million had moved from a bank account through four mobile money agents. UFC’s CDR analysis pinpointed the exact deregistration and re-registration window, and porting-log examination identified the outlet and agent code used for the swap — evidence the telco’s own verification process had failed at that specific point. Financial timeline and porting failure documented for recovery proceedings against the telco and receiving accounts. Frequently Asked Questions Can a SIM swap be proven after the money is already gone? Yes, in most cases. The evidence does not live on the victim’s phone — it lives with the telco (porting requests, agent ID, cell-site data) and the receiving financial trail. Forensic

Sim swap fraud in Kenya Read More »