How a Swedish Investor Lost Millions in a Sh3 Billion Fake Ambulance Tender Scam Orchestrated Inside the Office of the President

It was the second visit that sealed the trap. On the morning of March 10, 2026, a Swedish timber and machinery exporter named Talar Yousef Zaitoun walked into Harambee House, the gazetted seat of the Kenyan presidency in the heart of Nairobi, for what he believed would be the final formality on a contract to supply 500 ambulances to the Government of Kenya.

He had flown in from Stockholm with his brother Hatim.

He had already wired nearly half a million dollars across multiple tranches from a sister company in China to an Ecobank Kenya account in Nairobi. He had received what appeared to be a legitimate pre-qualification certificate confirming his firm, Jokara AB, had won a tender worth over USD 36 million.

And he had been received twice at Kenya’s most symbolically fortified address by men who presented themselves as senior government officials.

What Zaitoun did not know was that the entire edifice had been constructed from fraudulent documents, impersonated officials, and a criminal syndicate operating with the brazen confidence that comes from using Kenya’s presidential address as scenery for a con.

When detectives from the Directorate of Criminal Investigations moved in on the 12th floor of Harambee House that morning, they arrested seven people mid-negotiation.

The drama was extraordinary not merely because of its scale but because of its location.

The suspects had been caught inside what the police would later describe in court documents as “a government premises that houses, among others, the office of the Cabinet Secretary, Ministry of Interior and Coordination of National Government, and the Office of the President, and which is gazetted as a protected government installation.”

The seven arrested are Micheal Musyoki Ngumbi, Evans Simotwo, Geoffrey Were Odondi, Allan Mutahi Kariuki, Purity Njeri Njamiu, Jared Muniaro Masinde, and Kororia Simatwa.

They were presented in a Nairobi court on a miscellaneous application and remanded for five days pending preparation of prosecution files, with a case mention set for March 17.

Police had sought 14 days. A lawyer who is said to have received funds on behalf of the syndicate remains at large and is actively being sought.

The Architecture of the Con

The plot began on January 10, 2026, when Zaitoun, whose Stockholm-based Jokara AB exports timber and machinery to African markets, received a WhatsApp message from a person identifying himself as Stanley Ndawula using a Ugandan phone number requesting a product catalogue.

The following day, a second contact reached him from a Kenyan number.

This was Geoffrey Were, who introduced himself as a consultant at a firm called Interlog Corporate and presented himself as a facilitator of business between the Government of Kenya and private foreign companies. Were dangled a government tender to supply ambulances.

On January 19, Were told Zaitoun that Kenya was seeking to procure ambulances. Zaitoun submitted a quotation on January 31, proposing Toyota Hiace High Roof ambulances at USD 65,500 per unit.

He was invited to Nairobi. He arrived on January 26 aboard a Turkish Airlines flight at Jomo Kenyatta International Airport, was received by Were and a driver named Nicho, and was accommodated at the Radisson Blu Hotel Arboretum until January 30.

On January 27, Zaitoun was taken to Harambee House for a meeting with several individuals, including Michael and Geoffrey, who identified themselves as representatives of the National Treasury and the Ministry of Health.

He was told the total contract value was USD 36,025,000 and that he was required to provide either a performance bond or insurance coverage before signing.

He opted for a 3 percent insurance coverage fee, amounting to USD 1,080,750.

He was also told there was a 2 percent ledger fee of USD 360,250 to be shared between him and the government, and he was presented with two pre-qualification options: USD 90,000 for a single government contract over five years, or USD 110,000 for multiple contracts within the same period. He chose the latter.

The money began flowing on January 30, wired from Lianyungang Chanta International Wood Co. Ltd, a sister company in China, to an Ecobank Kenya account held in the name of the wanted lawyer.

Zaitoun was issued invoices, a certificate of incorporation, company search records, and identification documents purportedly belonging to a law firm.

He received a pre-qualification certificate.

But even then, doubt crept in: the award date on the certificate showed October 22, 2025, months before the tender discussions had begun.

The suspects explained, smoothly, that such certificates were routinely backdated.

Even after Zaitoun returned to Sweden, the pressure continued. The syndicate insisted more insurance fees were outstanding, claiming the government had already paid its portion.

On February 1, he transferred an additional USD 48,392, USD 51,607, and USD 80,000. On February 25, further transfers followed of USD 55,285.22, USD 55,438.30, and USD 69,275.95. By the time suspicion hardened into certainty, independent due diligence had confirmed the pre-qualification certificate was fraudulent.

The total amount extracted from Zaitoun stands at USD 470,750, equivalent to approximately Sh60.8 million.

He returned to Kenya on March 9 with his brother Hatim, was received again at the airport by Geoffrey and the same driver, taken to Radisson Blu Hotel, and escorted the following morning to Harambee House for what would become the arrest meeting.

Police assert in their court affidavit that investigators are examining how meetings designed for criminal purposes were held inside a gazetted protected installation, and say senior government officials may have been involved, some of whom could be difficult to trace due to their busy schedules.

A Pattern Written in CCTV Footage

The ambulance tender scandal is not the first time criminal operators have used the physical prestige of Kenya’s presidential address to lend credibility to fraud.

The most notorious precedent came in February 2020, when former Sports Cabinet Secretary Rashid Echesa, then recently fired by President Uhuru Kenyatta, walked two foreign arms dealers into Harambee House Annex, the building directly across Harambee Avenue that houses the Office of the Deputy President.

The foreigners were Kozlowski Stanley Bruno, an American, and Mamdough Mostafa Amer, an Egyptian. They represented a firm called Eco Advanced Technologies and had been promised a Sh39 billion tender to supply the Kenya Defence Forces with military surveillance equipment.

Echesa and his associates, including a man passing himself off as a military general identified as Daniel Otieno Omondi, had already extracted Sh11.5 million from the foreigners as consultancy fees before the deal unravelled. Detectives descended on Harambee House Annex to review CCTV footage, interview security personnel, and investigate how individuals with no official standing had been allowed access to the second-highest office in the republic.

The then-Deputy President, William Ruto, acknowledged publicly that the 23-minute meeting had indeed taken place in his premises but denied any knowledge of it, calling the scandal a “choreographed smear campaign” by political competitors.

That case carried a further, darker dimension.

The sergeant who had been on duty at Harambee House Annex when Echesa brought in the foreigners, John Kipyegon Kenei, was found dead a week after the arrests. The then-DCI director linked Kenei’s death to the arms scandal, alleging he had been killed to suppress evidence.

Echesa was eventually acquitted in December 2021 after a magistrate ruled that the CCTV footage presented in evidence did not show him committing an offence. No one was convicted.

The arms scandal was itself not an isolated episode at the Annex. Earlier, in 2018 and again in 2020, a separate syndicate ran a fake laptop tender operation using the Harambee House Annex address.

A woman known to victims as “Ms Muhoro,” whose real name was Joy Wangari Kamau, posed as a procurement officer or project manager at the DP’s office, bringing in businesspeople who believed they had won government contracts.

One complainant, Charles Musinga, told a Milimani court that he and business partners had delivered 2,800 laptops worth approximately Sh180 million after signing what they believed was a legitimate contract at the Annex.

A parallel victim, Charles Gathii, lost Sh116 million through a related operation. Kamau repeatedly evaded arrest, with courts issuing multiple warrants against her. At least eight individuals were ultimately charged across the various laptop tender prosecutions.

Nor was the fraud confined to the Annex. In a separate case, a woman named Grace Mwarania Waigumu was arrested after police alleged she had been posing as an official at the Office of the President in Harambee House itself, defrauding victims through fake Jubilee party campaign materials tenders.

One complainant, Abdiwahab Adan Ibrahim, lost Sh23.9 million. Others lost millions more. The Standard reported she promised victims their money would be returned with interest after the government paid out.

The Procurement Impunity Complex

What makes Harambee House a recurring venue for this genus of fraud is the intersection of access, prestige, and institutional weakness.

The address carries an almost mystical authority in the minds of investors, particularly those from overseas unfamiliar with the granular mechanics of Kenyan public procurement law.

The idea that a government representative would invite a foreign investor to the President’s own building for a tender meeting is not, on its face, implausible in a country where ministers routinely meet investors, and where the distinction between political favour and formal procurement process has historically been blurred.

That blurring has deep institutional roots.

The Anglo-Leasing scandal, which surfaced in 2002 and reverberated for nearly two decades, involved at least 13 phantom companies awarded security-related government contracts worth hundreds of millions of dollars.

The contracts were signed through the Office of the President under then-President Mwai Kibaki’s administration.

Anti-corruption czar John Githongo exposed the scheme in a dossier published in 2005 and later concluded that the conspiracy reached the very top of government.

Only one person was ever convicted. The Pandora Papers subsequently revealed offshore trails involving suspects named in the Githongo report, with shell companies moving millions years after the initial exposé.

The pattern of near-impunity is not merely historical.

The Kenya Human Rights Commission noted in early 2024 that the current administration had presided over the dismissal of corruption cases involving senior figures, including Rigathi Gachagua, former Deputy President, facing money laundering allegations involving Sh7.2 billion.

Henry Rotich, the former Treasury Cabinet Secretary whose charges related to the Sh63 billion Arror and Kimwarer dams fraud were dismissed under circumstances widely criticised as prosecution-abetted acquittal, was within 56 days of the acquittal appointed as a senior advisor in the Office of President Ruto. KHRC publicly called on Ruto to revoke the appointment.

At the Office of the Deputy President, the OCCRP and Africa Uncensored have separately documented contracts awarded to companies with ties to serving politicians, including a USD 1.1 million contract to supply honorary medals awarded from the DP’s office in 2016 to Atticon Limited, a company linked to Mithika Linturi, then a senator. Linturi, who denied wrongdoing, was briefly detained after the story was published. Former employees alleged his companies had bid against each other to create the illusion of competition.

The Charges and the Trail

The charges against the seven arrested in the ambulance tender case span conspiracy to defraud under Section 317 of the Penal Code, obtaining by false pretences under Section 313, and multiple counts under the Proceeds of Crime and Anti-Money Laundering Act, including acquisition, use, and possession of proceeds of crime under Section 4 read with Section 16(1). Police described the offences as involving “forged documents, impersonation of government officials and fake legal entities” designed to convince the Swedish businessman that he had secured a legitimate government contract.

The financial trail threads across continents.

The money originated from a company registered in Lianyungang, China, was wired to an Ecobank Kenya account in Nairobi held by the wanted lawyer, and was dispersed across at least eight transactions between January 30 and February 25, 2026.

Investigators are said to be following the money trail to determine how it was distributed and what role, if any, is played by individuals still inside government. The police affidavit is explicit that the probe has not concluded and that “several other persons, yet to be apprehended, whether government officials or otherwise, may have been involved.”

The involvement of a lawyer as the recipient of the funds adds a significant dimension to the case.

Under Kenya’s Anti-Money Laundering framework, legal practitioners handling client funds are subject to enhanced due diligence obligations.

The use of an advocate’s account to receive proceeds of a fraud, if proven, would expose the legal professional to serious criminal liability under the Proceeds of Crime and Anti-Money Laundering Act, as well as potential disciplinary proceedings before the Law Society of Kenya.

The fact that the lawyer remains at large and is being actively sought by investigators suggests the financial trail has not yet been fully mapped.

Police are also investigating the security breach dimension of the case: how a criminal syndicate obtained repeated access to one of the most tightly secured government buildings in the country to conduct meetings with a foreign investor over a period of weeks.

That question, investigators say, requires statements from senior government officials who may have been present or aware, and who may require special scheduling to interview.

The Ambulance Sector: A History of Vulnerability

The choice of ambulances as the tender vehicle is not incidental. Emergency medical procurement has been a recurring site of fraud in Kenya.

The KEMSA scandal under the Kenyatta administration saw the state medical supplies agency lose close to Ksh8 billion in procurement irregularities during the COVID-19 pandemic, including for medical equipment.

More recently, Kenya’s Social Health Authority has faced public accountability questions over procurement transparency as the government rolls out its flagship universal health coverage programme, the SHA.

A tender for 500 ambulances priced at USD 65,500 per unit, totalling over USD 32.75 million, is not an absurd-sounding figure in a market where genuine government ambulance procurement programmes have historically involved hundreds of units at comparable price points.

That surface plausibility is precisely what makes such fabrications work. The con only collapses when a victim with the means and the determination to conduct independent due diligence pushes hard enough. Zaitoun was such a victim: he returned to Kenya specifically to confront the discrepancies and was at the meeting table when police walked in.

A Structural Problem Without a Structural Solution

What the ambulance tender case, the arms deal, the laptop tenders, and the impersonator fraud share is not merely opportunism.

They represent the exploitation of a structural ambiguity at the heart of Kenyan public procurement: the historic entanglement of political favour and formal process that has made it credible, to foreign investors in particular, that a government contract might be secured not through the Public Procurement and Asset Disposal Act portal but through a private meeting at a powerful address.

President Kenyatta ordered in 2018 that all government tender notices and contract awards be published on the Public Procurement Information Portal operated by the Public Procurement Regulatory Authority.

The directive has not ended the problem.

Five years after that instruction, the OCCRP and Africa Uncensored were still documenting politically connected companies securing inflated contracts through loopholes in the IFMIS system that the Auditor General had publicly described as being “deliberately manipulated to hide information.”

The U.S. Trade Representative’s 2024 report on Foreign Trade Barriers noted that American firms were losing Kenyan government contracts to foreign firms willing to pay bribes, with senior officials specifically demanding facilitation payments.

The arrests at Harambee House on March 10, 2026, are dramatic. They are also, on the arc of Kenya’s institutional history with this class of fraud, unlikely to be the last. The seven suspects will appear before court on March 17.

The lawyer remains at large.

Investigators say more arrests are coming. Whether accountability follows or the pattern of acquittals and dropped cases reasserts itself, as it has so many times before, is the question that will define whether this case is a turning point or merely another chapter in a very long story.