How to Verify a Business Is Legit in Kenya Before You Pay

You found a business with a nice Facebook page, a confident salesperson, and a price that works for you. Before you hand over any money, there's a real process for checking whether that business is who it says it is. Most Kenyans who get burned skip every step of it, not because the steps are hard, but because nobody ever laid them out in order. Here's the order that actually catches a fake before your money does. ## Step one: ask for the KRA PIN, and don't let the question feel awkward A genuine business expects to be asked for its KRA PIN. It's printed on invoices, used for every tax filing, and tied to a specific entity, whether that's a registered company, a partnership, or a sole proprietor operating under their own name. If a business hesitates, changes the subject, or says "we'll sort that out later," treat that as information. A business with nothing to hide gives you the PIN without a story attached. Once you have it, KRA's iTax platform lets you check a PIN's validity and whether the holder has a current tax compliance certificate. This won't tell you the business is honest, but it confirms the entity exists in KRA's system under the name you were given, which is the baseline a scam often can't clear. ## Step two: search the actual company registration This is the step almost nobody takes, and it's the one that matters most for anything above a small, cash-on-delivery amount. The Business Registration Service runs company and business name searches through eCitizen, at brs.ecitizen.go.ke. You'll need an eCitizen account, set up with a national ID or passport and verified by OTP, and then you can search by the exact registered name or, better, the registration number if you have it. Company names repeat across Kenya more than you'd expect, so the number is the identifier that actually pins down one specific entity rather than three similarly-named ones. A full search can pull up the CR12, the document that lists current directors and shareholders. If a salesperson claims to be "a director" of a company, the CR12 either backs that up or it doesn't. There's a small fee for a full search, so this step is worth reserving for amounts where it matters: a six-figure deposit on a car or a renovation contract, not a KES 2,000 dinner reservation. If the business isn't a registered company at all but a sole proprietorship trading under a business name, the same eCitizen BRS portal handles that search too, just under the business names register rather than the companies register. Either way, the principle holds: a name on a sign is a claim, and the registry is where that claim gets checked. ## Step three: ask to see the county business permit, and actually read it Every legally operating business in Kenya is supposed to hold a Single Business Permit from the county it operates in, usually displayed somewhere visible at the premises. If you're dealing with someone at their shop or office, look for it. If you're dealing with someone who has no fixed premises at all, that's not automatically a red flag, since plenty of legitimate traders and service providers operate mobile. It does mean the registration and PIN checks above carry more weight, because there's no physical location backing up the claim. When you do see a permit, check that the business name on it matches the name you were given, and that it hasn't expired. A permit for a business that closed two years ago, still taped to the wall because nobody took it down, tells you something too. ## A quick, free check almost nobody bothers with: search the phone number itself Before spending money or time on the steps above, take thirty seconds and search the business's phone number on its own, in quotes, alongside words like "scam" or "fraud." Scammers frequently reuse the same SIM across several fake listings under different business names once one gets reported, and a search can surface complaints from people who already got burned by that exact number. It won't always turn up anything, since plenty of real first-time scams leave no digital trace yet, but when it does turn something up, it saves you every other step on this list. ## Look at how old the online presence actually is A Facebook or Instagram page can be built in an afternoon, complete with stolen product photos and a handful of paid-for likes. Check the page's creation date, visible in its "Page Transparency" section on Facebook, and look at how the posting history reads. A page created three weeks ago with twenty posts all published on the same two days is a different story from one with years of genuine, uneven posting activity, replies to real customer comments, and photos that look like they were actually taken at the business rather than lifted from a supplier's catalogue. ## The red flags that matter more than any single document Documents can be forged or borrowed from someone else's business. Behavior is harder to fake under pressure, and a few patterns show up again and again in reports from people who lost money. Pressure to pay the full amount upfront, especially before any work has started or any goods have been delivered, is the single most common thread in Kenyan scam reports. A legitimate business dealing in larger amounts is usually willing to structure payment around milestones, part now and part on delivery or completion, because it isn't worried about you walking away once work has started. Pressure to decide immediately, often paired with a story about limited stock or a deal expiring today, exists to stop you from doing exactly what this article is telling you to do: check first, pay second. A real business selling a real product rarely needs an answer in the next ten minutes. Evasive or inconsistent answers about licensing, registration, or how long the business has been operating are worth probing directly. Ask the same question two different ways, a few minutes apart. Someone telling the truth answers it the same way both times, because it's just true. Someone making it up tends to drift. ## Where to send the money, and why it's not a small detail Pay into a business account, not a personal M-Pesa number or personal bank account, whenever the business claims to be a registered entity. If the "business" only ever asks for money sent to a personal Safaricom line in someone's own name, that mismatch is worth questioning out loud. Ask why, and listen closely to the answer. Whatever payment method you use, keep the record. An M-Pesa message is itself evidence. It timestamps the transaction, names the recipient, and confirms the amount, and it's the first thing you'll need if you ever have to raise a dispute with Safaricom, file a police report, or take a claim to a county consumer affairs desk. Screenshot it the same day you send it, not after something's already gone wrong, and keep it somewhere you won't lose it. ## If you've already paid and it's starting to feel wrong Act fast rather than waiting to see if things improve on their own. Safaricom has a dispute process for M-Pesa transactions sent in error or under false pretences, reachable through *234# or Safaricom customer care, though it works far better with a fresh transaction than one you let sit for weeks. For larger amounts, a report to your nearest police station creates a paper trail that matters even if a quick resolution isn't realistic, and the Directorate of Criminal Investigations handles cyber-enabled fraud specifically. Consumer complaints against a registered business can also go to the county's trade or consumer affairs office, which is one more reason the registration check in step two is worth doing: it's hard to file a complaint against a business you can't actually identify. ## Where phone verification fits in, and where it doesn't This is also where a service like Listing254 is useful, and where it's honestly limited. Our Verified badge means an admin actually dialed the phone number on a listing and confirmed a real business answered, not a document upload and not a self-reported checkbox. That rules out one specific kind of fake: a listing where the phone number is dead, disconnected, or answered by someone with no idea what you're talking about. What it doesn't do is replace the registration and permit checks above. A phone call confirms someone picks up and claims to run the business you're looking at. It doesn't pull a CR12, and it doesn't check KRA compliance. Treat it as one solid layer in a stack, not the whole wall. For anything beyond a routine, low-value purchase, phone verification plus a BRS search plus a look at the county permit gets you most of the way to knowing who you're actually dealing with. For everything else, your own judgment about pressure tactics and evasive answers will catch more than any single document ever will.