National Bank of Malawi wired funds to fake account in Nocma cyber‑fraud case

The National Oil Company of Malawi (Nocma) has been left red‑faced after cyber‑criminals tricked the state fuel importer into wiring $403,605 (about K700 million) straight into a fraudulent account — in what insiders are calling one of the most embarrassing digital heists in Malawi’s public sector.

According to Nocma, the scammers impersonated Mozhandling Limited, a Mozambican firm responsible for handling fuel shipments through the Port of Nacala.

The fraudsters intercepted official emails, forged banking documents, and coolly informed Nocma that the company had “opened a new account” with Bank of America.

Believing the communication was genuine, Nocma instructed the National Bank of Malawi on April 29, 2026 to transfer the funds — unknowingly sending the money directly into the hands of criminals.

The scam only came to light two weeks later, when the real Mozhandling contacted Nocma demanding payment.

Shocked officials immediately alerted the Malawi Police Service, while Bank of America opened its own investigation to trace the diverted funds.

But the fallout is already raising serious questions about Nocma’s internal controls.

Management has admitted that the financial breach was made possible by loopholes created during the chaotic rollout of the Government‑to‑Government (G2G) fuel procurement model, which was introduced before proper cybersecurity and operational systems were in place.

Analysts say the blunder exposes a dangerous lack of digital vigilance at a time when state agencies are increasingly targeted by sophisticated cyber‑criminals.

Nocma now says it has reverted to the Open Tender System (OTS) and is urgently auditing its payment‑verification processes.

The company is also cooperating with law enforcement as investigators scramble to recover the missing funds.

The scandal deepened further when it emerged that Nocma had asked the Ministry of Lands and Housing Development to pay warehouse rentals, despite already budgeting for them under its Other Recurrent Transactions (ORT) — a misstep that forced the Commission to quietly withdraw a related court case.

For a company entrusted with safeguarding Malawi’s fuel security, the cyber‑heist has become a humiliating reminder of how quickly millions can vanish when digital defences fail.