Nocma loses US$403,605 to cyber fraud via Mozambican firm impersonation

The National Oil Company of Malawi Limited (Nocma) has fallen victim to a sophisticated cyber fraud scheme, resulting in the loss of US$403,605 (approximately 700 million Malawi Kwacha). The incident involved criminals intercepting electronic communications from Mozhandling Limited, a Mozambican company responsible for fuel shipment handling at the Port of Nacala.

Acting as imposters, the fraudsters sent forged banking instructions to Nocma, claiming that Mozhandling had opened a new account with Bank of America. Relying on these fraudulent details, Nocma instructed the National Bank of Malawi to transfer the funds on April 29, 2026. The deception was only uncovered two weeks later when the legitimate representative of Mozhandling contacted Nocma regarding the unpaid invoice.

Nocma has acknowledged that weaknesses in internal controls contributed to the loss, noting that vulnerabilities emerged during the implementation of a Government-to-Government (G2G) fuel procurement model. The Malawi Police Service has launched an investigation to trace the diverted funds and identify the perpetrators.