Malawi Freedom Network 
By Malawi Freedom Network
August 25, 2026
LILONGWE, Malawi — The National Oil Company of Malawi Limited (NOCMA) is investigating a suspected cyber-fraud incident in which US$403,605 — approximately K700 million — was transferred to a fraudulent bank account after criminals allegedly impersonated Mozhandling Limited, a company providing services linked to Malawi’s fuel imports through the Port of Nacala in Mozambique.
NOCMA has confirmed that the matter has been reported to the Malawi Police Service, while banks involved in the transaction, including Bank of America, are working to trace the diverted funds.
The case has raised serious questions about payment verification procedures and the protection of public funds, particularly because the money was transferred after NOCMA received communication advising that its service provider had changed its banking details.
How the alleged fraud happened
According to NOCMA’s account, the company had an outstanding payment of US$403,605 to Mozhandling Limited for services connected to the handling and movement of petroleum products through Nacala between August 13, 2025 and January 2026.
NOCMA said it had previously made an initial payment to Mozhandling, leaving the US$403,605 balance outstanding.
The company subsequently received several email communications from a person identified as Patricia Maria, who was following up on the outstanding payment on behalf of Mozhandling.
However, in March 2026, NOCMA received another communication purporting to be from Maria informing the company that Mozhandling had changed its banking arrangements.
The communication reportedly provided new bank account details at Bank of America, together with documentation purportedly confirming the new account.
NOCMA said it relied on the information and documentation it received and instructed its bankers, National Bank of Malawi, to process the payment.
The US$403,605 payment was made on April 29, 2026.
The fraud was discovered two weeks later
The suspected fraud was only uncovered approximately two weeks after the transfer.
NOCMA said the genuine Mozhandling representative contacted the company again to follow up on the outstanding payment.
NOCMA informed her that the money had already been paid.
It was then that the company realised that the banking instructions it had acted upon may have been fraudulent.
Related stories: Nocma Loses K700 Million in Cyber Fraud After Hackers Impersonate Mozambican Firm
The development triggered investigations involving the Malawi Police Service and financial institutions as authorities attempt to establish how the fraudulent communication was generated, how the perpetrators obtained or intercepted the relevant correspondence and whether the money can be recovered.
Serious questions over financial controls
The incident has already triggered questions about NOCMA’s internal financial controls.
Human Rights Defenders Coalition chairperson Michael Kaiyatsa said the key concern was not simply that fraud allegedly occurred, but how a payment of such magnitude could be redirected through a change in banking details without being independently verified before the money was released.
Centre for Social Transparency and Accountability executive director Willy Kambwandira similarly questioned the controls surrounding the transaction, arguing that a change of banking details involving such a large payment should require rigorous independent verification and senior-level authorisation.
The questions are particularly significant because the transaction involved public funds and an international service provider.
Link to Malawi’s fuel procurement changes
NOCMA has linked the circumstances surrounding the payment to changes introduced after Malawi moved from the Open Tender System (OTS) to a Government-to-Government (G2G) fuel procurement arrangement in November 2024.
Under the new arrangement, NOCMA assumed a central role in fuel importation and became involved in additional logistical requirements, including shipping, clearing, port handling and transportation.
NOCMA says the new system introduced additional contractual and financial processes before all operational and cybersecurity procedures had been fully developed and institutionalised.
The company has since returned to the Open Tender System and says it is auditing its payment-verification procedures.
Will the K700 million be recovered?
That is now one of the biggest questions surrounding the case.
NOCMA says investigations are underway with the Malawi Police Service and relevant financial institutions to trace the funds.
At this stage, there is no confirmed public indication that the entire US$403,605 has been recovered.
Authorities will also need to establish exactly how the alleged fraud was carried out, whether the criminals gained access to email communications belonging to or involving Mozhandling, and whether anyone inside or outside the organisations involved assisted the perpetrators.
Importantly, no individual has been publicly established as responsible for the alleged fraud, and the investigation remains ongoing.
A warning for Malawi’s public institutions
The NOCMA case highlights the growing risks faced by organisations that conduct large-value transactions through email.
Related stories:NOCMA Begins 10-Year Inspection and Maintenance of Blantyre Fuel Storage Tanks
A seemingly legitimate request to change a supplier’s bank account can potentially redirect millions if it is not independently verified through a trusted communication channel.
For public institutions handling taxpayers’ money, the incident raises a broader question: should a supplier’s banking details ever be changed solely on the basis of email correspondence and supporting documents?
Financial and cybersecurity specialists generally recommend independent verification of changes to payment instructions, particularly for large international transfers.
The case also comes at a time when cyber-enabled financial fraud is becoming increasingly sophisticated, making strong internal controls and verification procedures essential for government institutions.
What happens next?
The Malawi Police Service and financial institutions are expected to continue tracing the funds and investigating the circumstances surrounding the transfer.
NOCMA’s internal review will also be closely watched, particularly regarding how the fraudulent banking instructions were received, verified and approved.
For Malawians, the central issue is straightforward: US$403,605 of public money was transferred to an account that NOCMA now says was fraudulent.
The country will now want answers on who was behind the alleged fraud, how the deception bypassed NOCMA’s controls, whether the money can be recovered and whether anyone will ultimately be held accountable.
NOCMA says it is cooperating with investigators as efforts continue to trace the diverted funds.
