The National Oil Company of Malawi Limited (NOCMA) has lost US$403,605, equivalent to about K700 million, after cybercriminals impersonated a Mozambican port-handling company and redirected the funds to a fraudulent bank account.

NOCMA has confirmed the incident in a statement issued today, saying the Malawi Police Service and Bank of America are investigating the matter and working to trace the diverted funds.

According to the state-owned fuel importer, the fraudsters intercepted email communications from Mozhandling Limited, a company contracted to handle fuel shipments through the Port of Nacala in Mozambique.

The criminals allegedly submitted forged banking details to NOCMA, claiming that Mozhandling had opened a new account with Bank of America.

Believing the communication to be genuine, NOCMA instructed the National Bank of Malawi on April 29, 2026, to transfer US$403,605 to the fraudulent account.

The fraud was discovered about two weeks later when a legitimate representative of Mozhandling contacted NOCMA over the outstanding payment, prompting the company to report the matter to the police.

NOCMA management has acknowledged that the financial loss exposed weaknesses in its payment verification controls, which emerged during the introduction of the Government-to-Government (G2G) fuel procurement model before comprehensive operational and cybersecurity procedures were fully established.

The company says that following the return to the Open Tender System (OTS), it has begun auditing its payment verification mechanisms and is cooperating with law enforcement agencies as investigations continue.