A convincing letterhead can be copied. A QR image can be pasted onto another document. Verification means checking the identifier through KRA's official service and comparing the returned basics with the person or business in front of you.
The check should be proportionate. Confirm what a transaction genuinely requires without collecting or circulating more tax information than necessary.
Why businesses verify a KRA PIN
A KRA PIN identifies a taxpayer in specified dealings. A business may need to confirm that a supplier's PIN is genuine and active before creating records, onboarding a vendor or completing a process that requires it.
The official PIN Checker returns limited basic details. It does not give a stranger permission to inspect private returns, income or account history.
Verification helps catch typing mistakes as well as deliberate fraud. One changed letter or digit can attach an invoice to the wrong taxpayer.
Do not treat possession of a PIN certificate as proof of identity, creditworthiness, ownership or authority to sign a contract. Match it with the appropriate business-registration, identity and mandate documents required for that transaction.
Use the official route to verify a KRA PIN
Start from KRA's official online-services page or the KRA section of eCitizen. Avoid a checker reached through an advert, forwarded short link or site with a similar-looking domain.
Confirm that the browser address belongs to KRA or the official eCitizen service and uses HTTPS. Type the PIN from the source document carefully.
KRA describes a genuine PIN as one generated by its domestic-tax system and shown in active status by the checker. Review the result rather than accepting a green colour or copied screenshot.
Record the date of verification and the minimal result needed for the file. If policy requires evidence, save or print the official result without exposing unrelated personal data.
Match the result with the supplier
Compare the registered name returned by the checker with the legal name on the invoice, contract and payment account. Trading names can differ from legal names, so ask for a clear written explanation and supporting registration evidence.
For a company, confirm that the person communicating with you is authorised to act for it. A genuine company PIN does not make every email using that name genuine.
Check the number character by character. Do not “correct” a failed result by guessing a similar PIN until one works.
If the name is unexpected or status is not suitable, pause onboarding. Ask the supplier to check its records through KRA. Do not tell the supplier to send an iTax password or private portal screenshot.
Understand a Tax Compliance Certificate
KRA describes a Tax Compliance Certificate, commonly called a TCC, as an official document issued when the applicable compliance requirements are met. It has a validity period and identifier that can be checked.
A TCC is not permanent. A PDF saved months ago may have expired, and a forged document can copy the appearance of a genuine one.
Use the current KRA certificate or licence checker to verify the number and status. Compare the returned taxpayer name and certificate details with the document provided.
Do not alter a certificate file or accept a cropped image that hides the number, date or holder. Ask for the full document through the organisation's agreed secure channel.
A checker result is one control, not the whole decision
A valid PIN confirms a narrow fact. It does not confirm that goods exist, a bank account belongs to the supplier or a salesperson has authority.
For vendor onboarding, combine tax verification with company-registration checks, physical or video verification where appropriate, bank-detail controls, references and a written contract.
For a changed bank account, contact a known authorised person through a previously verified number. Do not rely only on the email requesting the change.
High-value procurement should use separation of duties: one person enters details and another independently checks them. Fraud is easier when one hurried employee controls every step.
Protect the taxpayer's information
Collect only the identifiers the business needs. Store them in the vendor or customer record with access limited to relevant staff.
Do not post a supplier's PIN certificate in an open team chat. Avoid emailing it to a broad group when a controlled procurement folder exists.
Mask identifiers in presentations and training examples. Delete duplicate downloads from shared desktops and clear printouts from photocopiers.
If a consultant performs verification, define how documents are transmitted, stored and deleted. The business remains responsible for protecting records it requested.
Spot common red flags
Pause when:
- The checker returns a different legal name.
- The supplied number has missing or extra characters.
- The TCC is expired or the checker cannot confirm it.
- The document is cropped, blurry or visibly edited.
- A supplier refuses official verification but offers a portal screenshot.
- Bank details change at the same moment as tax details.
- A caller demands urgency and asks you to bypass normal approval.
One red flag is not an automatic accusation. It is a reason to stop, document the discrepancy and verify through an independent route.
What to do when the checker fails
First confirm the number was entered correctly and that you used the right checker. A PIN and a certificate number are different identifiers.
Try again from KRA's official online-services page rather than refreshing a saved link. Record the error and time if the service appears unavailable.
Ask the document owner to verify the record through their own KRA account or contact KRA. Do not ask for login access.
For an urgent transaction, follow the organisation's exception policy. A system outage should not cause staff to invent a result. Delay approval or use a documented alternative authorised by compliance leadership.
Keep a clean verification record
The file should state what was checked, which official tool was used, the date and the outcome. It should not contain an employee's opinions about the taxpayer.
Set a review date for documents that expire. Vendor information also needs rechecking when the legal entity or tax status changes.
Do not reuse one supplier's verification for a similarly named affiliate. Each legal entity needs its own match.
Where the business handles many suppliers, create a standard checklist and restrict who can mark a record verified. Audit a sample periodically.
Avoid fake KRA support
Use telephone numbers and email addresses published on KRA's official website. A social-media reply from an unverified account should not receive a tax document.
KRA staff or a checker do not need your M-PESA PIN, bank password or one-time code to verify a public identifier. Do not install remote-control software at a caller's request.
If a fake site captured credentials, change them through the official portal from a trusted device and contact KRA. Tell the organisation's security contact if business records may have been exposed.
Keep the suspicious URL and message as evidence, but do not forward it as a clickable link to a large group.
The safe verification checklist
To verify a KRA PIN or TCC:
- Start from KRA's official online-services page.
- Choose the correct checker.
- Enter the identifier exactly.
- Match the legal name and status with the source documents.
- Record the date and minimal result.
- Investigate mismatches through independent official contacts.
- Protect the document and limit internal access.
The purpose is not to collect a bigger file. It is to confirm the specific fact the transaction requires, using an official source and a record another authorised reviewer can understand.
