Malawi’s State Oil Company Wired US$403,605 to a Stranger

MALAWI · DOING BUSINESS

Malawi’s state oil company has admitted wiring US$403,605 to criminals after forged emails quietly changed a supplier’s bank details. The loss surfaced only when the genuine supplier asked where its money was, and this week police arrested two of the company’s most senior officials.

How the NOCMA fraud worked

The method was ordinary, which is exactly what makes it worth reading. Security specialists call this kind of crime business email compromise, which simply means criminals imitate a trusted email partner and persuade a company to send money to a new account.

An email that appeared to come from the supplier said the firm’s banking details had changed, and named a new account at Bank of America. Forged banking documents were supplied to support the request.

On 29 April the National Oil Company of Malawi, known as NOCMA, instructed the National Bank of Malawi to send the payment. The money went.

There was no break-in at the company’s own systems in the account given publicly. The attack targeted the correspondence between two organisations, which is usually the softest surface available.

What the money was for

The invoice covered loading and clearing services at the Mozambican port of Nacala, one of the routes by which landlocked Malawi imports its fuel. NOCMA says the payment related to the MT Flora, a vessel that carried 15.1 million litres of fuel bought under a government-to-government deal, in which the state buys fuel directly from another government instead of through open tenders.

The services themselves were real, and had been provided between 13 August 2025 and January 2026. So the supplier was real, the debt was real, and only the destination account was not.

Malawi is landlocked, so almost every litre of its fuel arrives through a port in Mozambique or Tanzania and then travels overland. The handling agents in those ports are unavoidable business partners.

Nobody noticed for a fortnight, then nobody said anything for three months

The fraud surfaced when the genuine representative of Mozhandling contacted the company to ask about the outstanding payment. That was roughly two weeks after the transfer, in mid-May.

The case did not become public until 24 August, when Malawian outlets reported it. No source has explained the three-month gap between discovery and disclosure, and it is the part of this story most worth asking about.

Three months is long enough for stolen money to move through a chain of banks in several countries. Recovery prospects fall sharply with every week of delay in this kind of case.

The company’s position has moved

Initially the company said the matter was under investigation by the Malawi Police Service and Bank of America as a suspected fraudulent payment. Management also conceded that the breach was enabled by gaps left when the government-to-government fuel procurement model was introduced before the necessary controls were in place.

Days later its public relations officer, Raymond Likambale, said the supplier’s bank had confirmed receipt of the funds. If hacking occurred, he said, it happened on the supplier’s side, not NOCMA’s.

Those two positions are difficult to hold at once, and the company has not reconciled them publicly. NOCMA also said it had returned to an open tender system and was auditing its payment-verification process, which is the right instinct if it is followed through.

Arrests, and the pressure that preceded them

On 25 August the Human Rights Defenders Coalition, a Malawian civil society grouping, called for the immediate suspension of every official who verified, approved or processed the payment. It also asked for an independent investigation, publication of the findings and regular updates on efforts to recover the money.

On the evening of 26 August, police deputy national spokesman Alfred Chimthere confirmed the arrest of Miklas Reuben, 54, the deputy chief executive, and Thokozani Jacob Sesani, 49, the senior operations manager. They are expected to face charges including negligence by a public officer in preserving money and misuse of public office, and to appear in court soon.

Police said the money went to an account in the name of Moniray Mozhandlings Lda, a name strikingly similar to the genuine supplier, to cover loading and clearing charges at the Mozambican ports of Beira and Nacala. Investigations continue, and no money has been reported recovered.

A prominent social commentator, Onjezani Kenani, publicly suggested the theft required inside help, though no evidence of collusion has been produced. That is an assertion, and at this stage nothing more.

Why this belongs on an investor’s desk

Business email compromise is now among the most common ways money leaves an institution, and it defeats controls designed for a different era. The defence is procedural and almost embarrassingly simple: never change a supplier’s bank details on the strength of an email, and confirm by a channel you established first.

For anyone trading with state entities in frontier markets, the useful signal is not that a fraud happened but how the institution behaved afterwards. On that measure the record here is mixed: a prompt police referral, then a public contradiction, then arrests three months on.

Frontier-market counterparty risk is often discussed as though it were mainly about politics. Rather more of it is about whether an organisation checks a bank account before wiring to it.

Frequently asked questions

This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error

LatAm Markets: Live Signals → — real-time movers, turnover leaders and FX across Latin America.