When Code Becomes Corruption

The Office of the Special Prosecutor (OSP), established under Act 959 (Office of the Special Prosecutor Act, 2017), is widely understood as an anti-corruption agency. But in the digital age, corruption no longer requires brown envelopes in parking lots. It happens in SQL injections, payroll backdoors, forged PDFs, and manipulated databases.

The OSP's mandate extends into the digital realm — particularly when corruption is cyber-enabled or involves digital evidence.

Course Learning Objectives

1. Explain the OSP's mandate in the context of cyber-enabled corruption and digital evidence.
2. Identify and prevent ghost-name payroll fraud, electronic document forgery, and cyber-laundering.
3. Design and operationalise access controls, data integrity safeguards, and incident response protocols.
4. Detect system loopholes before they become pathways for systemic fraud or OSP investigation.

The Four Pillars — Applied to Digital Corruption

The OSP Does Not Operate in a Vacuum

Ghana's digital corruption fight involves multiple agencies.

The Legal Framework for Digital Compliance in Ghana

Before We Examine the Mechanics — Understand What Is at Stake

Module 1 Complete

You understand the OSP's digital mandate, the agencies it works with, the laws that bind your organisation, and the human cost of failure. Module 2 maps the threat landscape.

What Is a Ghost Employee?

A ghost employee is a fictitious or non-existent individual added to a payroll system to divert salaries. In the digital age, this is no longer about manual ledger entries — it is about database manipulation, compromised biometric systems, and collusion between HR and IT staff.

How It Works Digitally

1. An insider with payroll system access creates a fake employee profile.
2. The profile passes weak validation (no biometric check, no supervisor verification).
3. Salaries are deposited into a mobile money wallet or bank account controlled by the fraudster.
4. The ghost "employee" never shows up for work, but the system shows perfect attendance.

What Is Cyber-Laundering?

Cyber-laundering is the use of digital channels to conceal the origins of illegally obtained money. In Ghana, this increasingly involves:

The Most Dangerous Threat Is Internal

An IT administrator with privileged access can:

• Create undetectable backdoor accounts.
• Alter audit logs to conceal unauthorised transactions.
• Exfiltrate sensitive data for extortion or sale.
• Disable security controls during "maintenance windows".

The Fraud Triangle in Digital Corruption

The Red Flags

👔 For the CIO

1. Isolate the system. Immediately revoke the suspected HR officer's access to the payroll database and all related systems. Do not delete their account yet — preserve the audit trail.
2. Preserve evidence. Create forensic images of the payroll database, access logs, and user creation timestamps before they can be altered.
3. Engage external digital forensics. If your internal team is compromised, bring in an independent firm. The CID Cybercrime Unit can assist if criminal prosecution is anticipated.
4. Report to leadership. Brief the CEO and Board Audit Committee. This is not an HR issue — it is a material fraud.
5. Prepare for regulatory engagement. If public funds are involved, be ready to report to the OSP, EOCO, or the Auditor-General.

🔐 For the IT Security Manager

1. Run a full access audit. Identify every account created or modified by the suspect in the last 24 months. Cross-reference with onboarding records.
2. Check for backdoors. Search for hidden admin accounts, scheduled scripts, or unauthorised database triggers that might recreate ghost names after deletion.
3. Analyse network logs. Did the suspect access the system from unusual locations or times? Remote sessions outside business hours?
4. Verify biometric integration. If the system should validate against NIA/Ghana Card data, why did these 12 profiles bypass it? Was the API disabled? Was there a "manual override"?
5. Implement emergency controls. Require dual authorisation for all new payroll entries. Disable "manual override" pending investigation.

📋 For the Compliance Executive

1. Quantify the loss. Calculate total salaries paid to ghost names over their existence, including statutory payments (SSNIT, taxes) diverted or underpaid.
2. Review banking arrangements. Individual accounts or bulk mobile money wallets? Bulk wallets make ghost-name fraud easier.
3. Assess criminal liability. Consult legal counsel on whether to report to Ghana Police (CID), EOCO, or OSP. Determining factor: purely internal theft, or collusion with public officials?
4. Initiate disciplinary action. Suspend the involved HR officer pending investigation. Ensure due process.
5. Strengthen controls. Mandate Ghana Card + biometric verification for all new hires. Implement a monthly "ghost hunt" cross-checking payroll against physical headcount, email active directory, and access control logs.

Module 2 Complete

You have mapped the digital fraud landscape and worked through your first full response protocol. Modules 3–8 each present one more scenario.

The Red Flags

🔐 For the IT Security Manager

1. Analyse the PDF forensically. Use tools like ExifTool or PDF metadata analysers to check creation date and software used; author name and modification history; embedded fonts and images (forgeries often use different fonts than originals).
2. Trace the email headers. Examine the full header to identify the true originating IP address, not just the displayed sender.
3. Check for malware. The PDF or attachment may contain malware designed to harvest credentials. Scan with updated endpoint protection.
4. Verify the domain. Check WHOIS records for @techsol-gh.com. When was it registered? By whom? It was likely registered recently for this scam.

📋 For the Compliance Executive

1. Do not process the payment. Issue a formal hold.
2. Contact the genuine vendor using known, verified contact details — not the ones on the suspicious invoice.
3. Document everything. Preserve the email, PDF, and all communications. This is evidence.
4. Report to law enforcement. If the amount is significant or the fraudster is persistent, report to the CID Cybercrime Unit. If the fraud involves a public procurement process, report to the OSP.
5. Issue a company-wide alert. This is likely a Business Email Compromise (BEC) attack. Other departments may have received similar forged invoices.

👔 For the CIO

1. Review email security. Are your gateways detecting typosquatting domains? Implement DMARC, SPF, and DKIM to prevent email spoofing.
2. Strengthen payment controls. Implement a "verified vendor master file" that cannot be altered without dual approval and direct vendor confirmation.
3. Train finance staff. Verify invoice metadata, question urgent payment demands, and always confirm bank changes via phone using known numbers.

The Red Flags

🔐 For the IT Security Manager

1. Immediately freeze all accounts. Contact the bank's fraud hotline and mobile money providers to freeze the corporate account and trace the receiving wallets.
2. Preserve logs. Capture all email logs, phone records, and network traffic from the CFO's devices for the 48 hours preceding the incident.
3. Check for SIM swap. Contact the telecom provider to determine if the CFO's SIM was swapped or cloned — a common precursor to mobile money fraud.
4. Scan for malware. The CFO's phone or laptop may be compromised. Conduct a full forensic scan.
5. Check for data exfiltration. Did the attacker gain access to other corporate data? Review DLP (Data Loss Prevention) logs.

📋 For the Compliance Executive

1. Report to the bank immediately. File a formal fraud report. Request transaction traces for all 50+ receiving wallets.
2. File a police report. Report to the CID Cybercrime Unit. For amounts over GHS 100,000, also notify EOCO.
3. Assess regulatory reporting. If customer or employee personal data was compromised, notify the Data Protection Commission within a reasonable time under Act 843.
4. Notify insurers. If you have cyber insurance or fidelity bonds, initiate the claims process.
5. Do not negotiate with the fraudster without law enforcement involvement.

👔 For the CIO

1. Implement MFA immediately. All financial transactions must require multi-factor authentication that does not rely solely on SMS (vulnerable to SIM swap). Use app-based authenticators or hardware tokens.
2. Review privileged access. Who has access to the CFO's calendar, transaction history, or contact list? This information may have been harvested internally.
3. Conduct a social-engineering drill. Test staff susceptibility to vishing (voice phishing) and smishing (SMS phishing).
4. Establish a verification protocol. No payment instruction received via email or phone alone is valid. It must be confirmed through a second, independent channel.

The Red Flags

👔 For the CIO

1. Activate the Incident Response Plan immediately. Isolate affected systems from the network to prevent lateral movement. Do not shut down systems if it will destroy forensic evidence.
2. Do not pay the ransom yet. Paying does not guarantee decryption and may invite future attacks. It may also violate anti-money laundering laws if the attackers are sanctioned entities.
3. Engage a cybersecurity incident response firm. They can assess the ransomware strain, determine if a decryption tool exists, and negotiate if necessary.
4. Preserve evidence. Capture memory dumps, network traffic logs, and disk images before cleanup. The CID Cybercrime Unit or private forensics firms will need these.
5. Assess CII obligations. If your organisation operates CII, you must report the incident to the Cyber Security Authority (CSA) under Act 1038.

🔐 For the IT Security Manager

1. Identify the attack vector. Phishing email? Unpatched vulnerability? Compromised remote desktop protocol (RDP)? Close the entry point immediately.
2. Check backup integrity. Verify that offline backups are clean and restorable. If backups are also encrypted, the attack had inside knowledge or long dwell time.
3. Scan for persistence. Ransomware actors often leave backdoors. Check for new user accounts, scheduled tasks, or remote access tools.
4. Coordinate with legal. Determine if you have a legal obligation to report the breach to affected parties, regulators, or law enforcement.

📋 For the Compliance Executive

1. Assess data breach notification obligations. Under Act 843, notify the Data Protection Commission and affected data subjects "as soon as reasonably practicable."
2. Evaluate corruption exposure. If the leaked data reveals irregularities in public contracts, ghost names, or inflated invoices, you must self-disclose to the OSP before the data becomes public. Proactive disclosure demonstrates good faith.
3. Review cyber insurance. Initiate claims. Document all response costs.
4. Prepare public communications. If the breach becomes public, control the narrative with transparency.
5. Post-incident audit. Commission an independent forensic audit of the attack and your cybersecurity posture. Share results with the Board.

The Red Flags

🔐 For the IT Security Manager

1. Do not confront the DBA alone. This could trigger data destruction or escalation. Coordinate with HR and legal first.
2. Preserve forensic evidence silently. Capture all SQL query logs from the service account; network traffic to and from the DBA's workstation; USB device connection logs; email and chat logs.
3. Disable the service account during a planned "system maintenance" window to avoid alerting the DBA.
4. Check for additional backdoors. Search for other unauthorised accounts, SSH keys, or VPN configurations.
5. Review the DBA's access history. What other systems did they touch? Did they access systems outside their job scope?

👔 For the CIO

1. Suspend the DBA's access immediately. Place them on administrative leave pending investigation.
2. Engage external forensics. Given the DBA's sophistication, internal staff may miss evidence. The CID Cybercrime Unit or a certified digital forensics firm should handle the investigation.
3. Assess data exposure. Which records were extracted? How many employees, vendors, or customers are affected? This determines breach notification and regulatory obligations.
4. Review the hiring process. How was this DBA vetted? Were background and reference checks conducted?
5. Implement "zero trust" architecture. No user should have standing access to all systems. Use just-in-time (JIT) access — elevated privileges granted only for specific tasks and automatically revoked.

📋 For the Compliance Executive

1. Quantify the risk. If payroll data was stolen, are ghost names being created? If vendor data was stolen, are fake invoices being generated?
2. Notify affected parties. If personal data was compromised, comply with Act 843 breach notification requirements.
3. Report to law enforcement. File a report with the CID Cybercrime Unit. If the data was used to facilitate fraud involving public funds, report to the OSP.
4. Review insurance coverage. Fidelity insurance may cover losses from employee dishonesty.
5. Strengthen the insider threat programme. User behaviour analytics (UBA) to detect anomalies; mandatory vacation policies for privileged IT staff; separation of duties (no single DBA can create accounts AND modify audit logs).

The Red Flags

🔐 For the IT Security Manager

1. Immediately disable the compromised account and force a password reset for all procurement portal users.
2. Analyse the access logs. When did the foreign IP first access the portal? How long was the dwell time? What data was viewed or modified?
3. Check for credential compromise. Was the officer's password weak or reused from a breached site? Implement passwordless authentication or MFA for the portal.
4. Scan the portal for malware. The attackers may have planted a web shell to maintain access.
5. Verify portal security. Is it patched? Does it have WAF (Web Application Firewall) protection? When was the last penetration test?

📋 For the Compliance Executive

1. Freeze all payments to the three suspicious vendors immediately.
2. Conduct vendor due diligence. Are these companies registered with the Registrar-General's Department? Check tax clearance certificates. Visit the registered address.
3. Trace the funds. Where did the GHS 1.8 million go after reaching the vendor bank account? Request bank cooperation through legal channels.
4. Report to law enforcement. This is organised fraud. Report to CID and EOCO. If public funds are involved, report to the OSP.
5. Review vendor onboarding controls. Mandatory physical verification of new vendors; dual approval for vendor creation; automatic flagging of similar names/addresses/bank accounts; quarterly vendor master file audits.

👔 For the CIO

1. Assess third-party risk. Your vendor portal is a supply chain vulnerability. Conduct a security assessment of all third-party platforms with access to your financial systems.
2. Implement network segmentation. The vendor portal should not have direct access to your ERP or payroll systems.
3. Enhance monitoring. Deploy SIEM (Security Information and Event Management) to detect anomalous login patterns, especially from foreign IPs.
4. Require security certifications. Vendors handling your data must demonstrate compliance with Act 1038 and Act 843.

The Red Flags

👔 For the CIO

1. Educate the C-suite immediately. Deepfake threats target senior leadership. Their public videos, photos, and voice recordings can be used to create convincing fakes.
2. Implement out-of-band verification. No financial instruction received via video, voice, or email alone is valid. It must be confirmed through a second channel (a call to a known number, or in-person confirmation).
3. Deploy deepfake detection tools. Audio and video analysis tools can detect synthetic media, though this technology is still maturing.
4. Limit executive digital exposure. Reduce publicly available high-resolution video and audio of senior leaders that can train deepfake models.

🔐 For the IT Security Manager

1. Analyse the call metadata. How was the WhatsApp call routed? From the CEO's actual number, or a spoofed one? Check SIM swap records with the telecom provider.
2. Preserve the video. It is evidence. Deepfake analysis can sometimes identify the AI model used or artefacts inconsistent with genuine video.
3. Scan the Chief Accountant's device. The attacker may have compromised it to learn about the upcoming board meeting.
4. Review email and calendar access. How did the attacker know the CEO was travelling or in meetings? This suggests prior reconnaissance.

📋 For the Compliance Executive

1. Attempt to recall the funds. Contact the bank immediately. If the funds have moved, initiate a fraud trace.
2. File a police report. Report to the CID Cybercrime Unit. Deepfake fraud is a criminal offence under Act 29 and Act 772.
3. Review payment authorisation limits. The Chief Accountant should not have unilateral authority to transfer GHS 800,000. Implement dual control for all transfers above a defined threshold.
4. Update the fraud risk register. Deepfake attacks are an emerging threat. Update policies, training, and insurance coverage.
5. Conduct organisation-wide training. Show staff examples of deepfake calls. Teach them to ask questions only the real person would know, request a callback on a known number, and never bypass approval processes based on "urgency."

Guardians of the Digital Republic

You have completed a rigorous journey through digital compliance, cyber-corruption, and data integrity. You understand that the OSP's mandate extends into the digital realm. You can identify ghost names, forged documents, cyber-laundering, and insider threats. You have step-by-step protocols for realistic scenarios. You have role-specific toolkits.

The 6-Pillar Framework

Sustainable digital integrity requires a holistic framework. No single control or individual is sufficient.

Your Next Steps

1. Audit your payroll system this month for ghost-name indicators (duplicate mobile money numbers, missing Ghana Cards, no biometric data).
2. Review all legacy system connections and decommission those that are unnecessary.
3. Test your incident response plan with a tabletop exercise involving ransomware and insider threats.
4. Implement out-of-band verification for all financial transactions above your defined threshold.
5. Register with the Data Protection Commission if you have not; appoint a certified data protection supervisor if you are a large data controller.
6. Report cyber-enabled corruption to the OSP when public officials or public funds are involved.

🎉 Congratulations — All 8 Modules Complete!

You have completed the YAC-OSP Digital Compliance, Cyber-Corruption and Data Integrity course. You are now ready for the final assessment. Score 16 out of 20 or higher to earn your certificate.