National Oil Company of Malawi (Nocma) Limited has declared that it will not make a second payment of $403 615.63 (about K700 million) to a Mozambican service provider after hackers diverted the payment.
The State fuel importer insists that it acted strictly on instructions given by the service provider, Moz Handlings LDA and that liability for the fraud lies with the supplier.
It emerged that the money was diverted in April after criminals infiltrated e-mail communications between Nocma and Moz Handlings LDA, which provides shipping agency and clearing services at the Mozambican Indian Ocean port of Nacala under the Government-to-Government (G2G) arrangement conceived in 2024 by former president Lazarus Chakwera’s administration.
Documents The Nation has seen show that Nocma chief executive officer Engineer Emmanuel Matapa reported the matter to the Malawi Police Service on May 15 this year.
In its latest position, Nocma said it has fulfilled its obligation and will not pay twice.
“We paid Moz Handlings LDA once and we have proof of that payment. We did not make a second payment, and we stand by our position that the amount due to them was already paid,” said Matapa in a statement made available to The Nation. “We cannot be expected to pay the same amount twice simply because their email was compromised. The responsibility for the compromised email and the fraudulent change of banking instructions cannot be transferred to us when we had already made the payment to the account details that had been provided to us.”
Correspondence The Nation has seen shows that fraudsters hacked Moz Handlings LDA’s email on March 17 2026 and impersonated its sales assistant Patricia Maria Jose, using patricia.maria@mozhandling.com instead of the genuine patricia.maria@mozhandlings.com.
Using the bogus e-mail, the hackers on March 21 requested Nocma to use new bank details of an account at Bank of America. Nocma processed the payment on April 28 through National Bank of Malawi (NBM) after its officers certified invoices sent from the compromised e-mail.
Nocma further alleged that Moz Handlings LDA is now “shrewdly seeking a second payment through a claim that the initial payment did not reach it”.
Efforts to get a comment from Moz Handlings LDA managing director Eder Pele proved futile by press time. Calls and messages sent to his known number went unanswered.
The correspondence further shows that the fraudsters supplied invoices and bank instructions that convinced Nocma staff to process the payment without suspicion.
Nocma reported the incident to police on May 15 after Moz Handlings LDA enquired about the payment.
Problem genesis
Following the government’s decision in November 2024 to transition from the Open Tender System (OTS) to G2G fuel procurement, Nocma was designated to play a central role in the importation of petroleum products.
Nocma says the arrangement introduced new contractual, financial, shipping and clearing processes involving multiple international suppliers and service providers before these procedures were fully developed and institutionalised.
In this regard, Nocma says it engaged Moz Handlings to provide shipping agency, product handling and customs clearing services at the Port of Nacala.
Based on documentation of the summary of invoices from Moz Handlings, the said payment is spread from August 13 2025 to January 28 2026.
Minutes of the 86th ordinary meeting of the Nocma board of directors show that following completion of the relevant operations, Moz Handlings issued invoices and a statement of account in January 2026.
In the letter to police dated May 15, Matapa said between January 28 2026 and March 16 2026, Nocma senior operations officer (Supplies) Jacob Sesani was communicating with Moz Handlings sales assistant, Patricia Maria Jose, by e-mail.
He said: “However, from 17th March 2026, a cyber-criminal hacked the e-mail correspondence between Jacob and Patricia and blocked Moz Handling Services LDA from communicating with Nocma Ltd.
“The hacker impersonated Patricia Maria Jose and continued to communicate to Nocma employees using the bogus e-mail address patricia.maria@mozhandling.com.”
The letter notes that the address was subtly different from the one previously used by Jose, which was patricia.maria@mozhandlings.com.
The hackers’ letter shows the beneficiary bank being Bank of America, account number 237055126003 under Moniray Mozhandlings LDA, with Swift BIC BOFAUS3NXXX and IBAN number 237055126003.
Later on April 15, Bank of America, through Christene Petersen, an officer responsible for Global Treasury, Merchant and Estate Operations, issued a letter to Moz Handlings Services LDA confirming the existence of the account number. Moz Handlings LDA account is held at Access Bank in Mozambique.
Nocma further told police that after the hackers took over communication, they sent legitimate Moz Handling Services invoices, statement of account and a letter obtained from the hacked emails.
“The hacker indicated that the account details printed at the foot of their invoices should not be used as they were subject to an audit and hence, the funds could not be accessed if payment was made to the same,” reads the letter.
Transfer of the funds at the NBM Capital City Service Centre followed instructions the same day in a letter from Nocma’s finance manager (management accounting) Dingiswayo Sambo and business development manager Sam Ulaya.
A correspondence from the bank also shows that the money was credited into that account the same day.
Red flag arises
The fraud only came to light days later.
Further correspondence shows that on May 4, Pele called Sesani informing him that their e-mails were not going through and were returning as undelivered mail.
Pele confirmed that the payment they were expecting from Nocma did not reflect in their account.
Said Matapa: “In fact, it is Eder Pele who informed Nocma Ltd that the letter from the Bank of America instructing Nocma Ltd to pay through the account at Bank of America had not originated from Moz Handling Services LDA.
“Against this background, Nocma Ltd believes that it has been defrauded money by an unknown cyber-attacker and we are requesting your Office to help us identify these cyber-criminals and subsequently help with recovery of the funds.”
Nocma has since engaged digital economic crime legal minds to pursue the issue and ensure that the parastatal incurs no financial loss, according to a well-placed source.
Police last week arrested Nocma deputy chief executive officer Micklas Reuben and Sesani who were involved in the payment process.
Human Rights Defenders Coalition (HRDC) chairperson Michael Kaiyatsa yesterday commended Nocma for coming out clear on what was going on.
He said while an ongoing investigation may require some information to remain confidential, it is important that the public be informed that a suspected fraud had occurred, that it was reported to the police and that efforts were underway to recover the money.
On his part, National Advocacy Platform chairperson Benedicto Kondowe said the police complaint acknowledges that Nocma was induced to transfer funds due to fraudulent communication and altered payment instructions.
