NOCMA Fraud: Malawi Loses US$403,605 To Fake Email

(MENAFN- The Rio Times) MALAWI · DOING BUSINESS

Key Facts

- The loss: Malawi's state oil company paid US$403,605, about K700 million, to an account controlled by fraudsters.

- How: Forged emails posed as a fuel supplier and announced new bank details at a major US bank.

- Who was impersonated: Mozhandling Limited, the Mozambican firm that handles Malawi's fuel shipments at the port of Nacala.

- The dates: The transfer was ordered on 29 April 2026 and surfaced about two weeks later, when the real supplier asked for its money.

- Made public: The case only became public on 24 August, more than three months after it was discovered.

- Arrests: On 26 August police detained deputy chief executive Miklas Reuben and senior operations manager Thokozani Jacob Sesani.

Malawi's state oil company has admitted wiring US$403,605 to criminals after forged emails quietly changed a supplier's bank details. The loss surfaced only when the genuine supplier asked where its money was, and this week police arrested two of the company's most senior officials.

One-stop referenceCompany IntelligenceEvery listed company in Latin America - financials, ownership and structure for 1,450+ companies across 26 exchanges, in one place the directory → RTAsk Rio TimesLatin American markets, currencies and companies full Ask Rio Times → Open the full Ask Rio Times → RTAsk Rio TimesLatin American markets, currencies and companies a question, or type your own - the answer appears right here the full Ask Rio Times → How the NOCMA fraud worked

The method was ordinary, which is exactly what makes it worth reading. Security specialists call this kind of crime business email compromise, which simply means criminals imitate a trusted email partner and persuade a company to send money to a new account.

An email that appeared to come from the supplier said the firm's banking details had changed, and named a new account at Bank of America. Forged banking documents were supplied to support the request.

On 29 April the National Oil Company of Malawi, known as NOCMA, instructed the National Bank of Malawi to send the payment. The money went.

There was no break-in at the company's own systems in the account given publicly. The attack targeted the correspondence between two organisations, which is usually the softest surface available.

What the money was for

The invoice covered loading and clearing services at the Mozambican port of Nacala, one of the routes by which landlocked Malawi imports its fuel. NOCMA says the payment related to the MT Flora, a vessel that carried 15.1 million litres of fuel bought under a government-to-government deal, in which the state buys fuel directly from another government instead of through open tenders.

The services themselves were real, and had been provided between 13 August 2025 and January 2026. So the supplier was real, the debt was real, and only the destination account was not.

Malawi is landlocked, so almost every litre of its fuel arrives through a port in Mozambique or Tanzania and then travels overland. The handling agents in those ports are unavoidable business partners.

Nobody noticed for a fortnight, then nobody said anything for three months

The fraud surfaced when the genuine representative of Mozhandling contacted the company to ask about the outstanding payment. That was roughly two weeks after the transfer, in mid-May.

The case did not become public until 24 August, when Malawian outlets reported it. No source has explained the three-month gap between discovery and disclosure, and it is the part of this story most worth asking about.

Three months is long enough for stolen money to move through a chain of banks in several countries. Recovery prospects fall sharply with every week of delay in this kind of case.

The company's position has moved

Initially the company said the matter was under investigation by the Malawi Police Service and Bank of America as a suspected fraudulent payment. Management also conceded that the breach was enabled by gaps left when the government-to-government fuel procurement model was introduced before the necessary controls were in place.

Days later its public relations officer, Raymond Likambale, said the supplier's bank had confirmed receipt of the funds. If hacking occurred, he said, it happened on the supplier's side, not NOCMA's.

Those two positions are difficult to hold at once, and the company has not reconciled them publicly. NOCMA also said it had returned to an open tender system and was auditing its payment-verification process, which is the right instinct if it is followed through.

Arrests, and the pressure that preceded them

On 25 August the Human Rights Defenders Coalition, a Malawian civil society grouping, called for the immediate suspension of every official who verified, approved or processed the payment. It also asked for an independent investigation, publication of the findings and regular updates on efforts to recover the money.

On the evening of 26 August, police deputy national spokesman Alfred Chimthere confirmed the arrest of Miklas Reuben, 54, the deputy chief executive, and Thokozani Jacob Sesani, 49, the senior operations manager. They are expected to face charges including negligence by a public officer in preserving money and misuse of public office, and to appear in court soon.

Police said the money went to an account in the name of Moniray Mozhandlings Lda, a name strikingly similar to the genuine supplier, to cover loading and clearing charges at the Mozambican ports of Beira and Nacala. Investigations continue, and no money has been reported recovered.

A prominent social commentator, Onjezani Kenani, publicly suggested the theft required inside help, though no evidence of collusion has been produced. That is an assertion, and at this stage nothing more.

Why this belongs on an investor's desk

Business email compromise is now among the most common ways money leaves an institution, and it defeats controls designed for a different era. The defence is procedural and almost embarrassingly simple: never change a supplier's bank details on the strength of an email, and confirm by a channel you established first.

For anyone trading with state entities in frontier markets, the useful signal is not that a fraud happened but how the institution behaved afterwards. On that measure the record here is mixed: a prompt police referral, then a public contradiction, then arrests three months on.

Frontier-market counterparty risk is often discussed as though it were mainly about politics. Rather more of it is about whether an organisation checks a bank account before wiring to it.

Frequently asked questions

How much did Malawi's NOCMA lose?

US$403,605, about K700 million. Police documents cited after the arrests give a marginally different exact figure of US$403,615.63.

How did the fraud happen?

Forged emails posing as the supplier Mozhandling Limited announced new bank details at Bank of America, supported by forged documents. The transfer was instructed on 29 April 2026.

Has anyone been arrested?

Yes. Deputy chief executive Miklas Reuben and senior operations manager Thokozani Jacob Sesani were arrested on 26 August 2026, on suspicion of negligence by a public officer and misuse of public office.

Has the money been recovered?

No recovery has been reported. The company said the matter was being investigated with the Malawi Police Service and Bank of America.

Sources

Malawi Police Service, arrest statement of 26 August 2026 (official channel) · Malawi 24, 24 August 2026 · Malawi 24, 26 August 2026 · Nyasa Times, 27 August 2026 · The Times of Malawi, 25 August 2026 · Malawi Guardian on the HRDC demands

Connected Coverage

Payment plumbing keeps producing stories across the region, from Mozambique halving what its residents can spend abroad by card to payment failures pushing up import costs at Ghana's ports.

This article was produced by The Rio Times' automated newsroom system. How we use AI · Report an error

In depth

Oil and energy in Latin America 2026

Part of our ongoing coverage

Africa: The New Scramble - the great-power contest over the continent.

More from Southern Africa

LatAm Markets: Live Signals → - real-time movers, turnover leaders and FX across Latin America.

Read More from The Rio Times

Zimbabwean CBZ Puts US$100 Million Into a Highway, Repaid by Tolls A Hundred Days In, Congo's Ebola Outbreak Is Still Getting Bigger Nairobi's Small Importers Say a New Customs Floor Will Finish Them

MENAFN27082026007421016031ID1111586273