The National Oil Company of Malawi (NOCMA) has lost $403,605 — about K700 million— to hackers who tricked the company into paying a fraudulent account.
In a statement released today, NOCMA confirmed the cyber heist and said the Malawi Police Service and Bank of America have launched investigations to try to recover the money.
According to NOCMA, fraudsters intercepted emails from Mozhandling Limited, a Mozambican firm contracted to handle fuel shipments through the Port of Nacala. The hackers sent fake banking details claiming the company had opened a new account with Bank of America.
Believing the email was genuine, NOCMA instructed the National Bank of Malawi on April 29, 2026 to wire $403,605 to the fake account.
The scam was only discovered *ltwo weeks later when the real Mozhandling representative contacted NOCMA demanding payment. NOCMA then reported the matter to police.
NOCMA management says the loss was caused by control loopholes that came with the Government-to-Government (G2G) fuel procurement model, which was introduced before full cybersecurity and operational procedures were in place.
The company says it has now returned to the Open Tender System (OTS) and is auditing its payment verification controls while working with law enforcement.
