Sri Lanka's national cybersecurity authority has sounded a serious alarm for depositors across the country. The Sri Lanka Computer Emergency Readiness Team (CERT), which serves as the National Centre for Cyber Security, has issued an urgent public warning after receiving multiple complaints about a sophisticated fraudulent scheme targeting individuals with fixed deposits (FDs). Criminals are impersonating officials from highly trusted institutions, including the Central Bank of Sri Lanka (CBSL) and the Police Financial Crimes Investigation Division (FCID), using forged official letterheads to deceive unsuspecting victims into surrendering their hard-earned savings.
How the Scam Works: A Step-by-Step Breakdown
Understanding the mechanics of this racket is the first step toward protecting yourself and your loved ones. According to CERT's official statement, the perpetrators follow a calculated and deliberate process designed to exploit trust, create panic, and ultimately extract money from victims.
The fraudsters begin by making initial contact with their targets, typically through phone calls or messages. During this first interaction, they pose as authoritative figures — officials from the Central Bank of Sri Lanka or officers from the FCID — lending immediate credibility to their approach. Most people naturally assume that a call from a central banking authority or a financial crimes unit must be legitimate and urgent.
To further establish false credibility, the racketeers send forged documents bearing the official letterheads of these respected institutions. These counterfeit letters are crafted to appear genuine, complete with logos, official-sounding language, and fabricated reference numbers. Victims who receive these documents are understandably convinced they are dealing with real government officials.
Once trust is established, the criminals apply psychological pressure. They typically inform victims that their fixed deposit accounts are somehow linked to illegal financial activity, money laundering investigations, or fraudulent transactions. The goal is to create fear and urgency, pushing victims to act quickly without pausing to verify the claims independently.
The Financial Trap: What Victims Are Asked to Do
After instilling fear and a false sense of urgency, the fraudsters present a seemingly straightforward "solution." Victims are instructed to transfer their fixed deposit funds to a so-called "safe" or "secure" government account, supposedly to protect their money during an ongoing investigation. In some cases, victims are told they must pay fees, taxes, or penalties to avoid legal consequences.
Once the transfer is made, the money is gone. The fraudsters disappear, the phone numbers become unreachable, and victims are left with devastating financial losses. In many reported cases, individuals have lost their entire life savings, retirement funds, or funds set aside for critical family needs such as medical care or education.
Why This Scam Is Particularly Dangerous
What makes this scheme especially alarming is the level of sophistication involved. Unlike crude phishing attempts, these criminals invest time and resources into creating convincing forgeries and adopting authoritative personas. They specifically target fixed deposit holders — a demographic that often includes retirees, senior citizens, and conservative investors who may be less familiar with cybercrime tactics but hold significant savings.
The impersonation of the Central Bank of Sri Lanka and the FCID is a deliberate choice. These are institutions that Sri Lankans associate with financial law enforcement and regulatory authority. Receiving communication from either body is likely to trigger compliance rather than suspicion, making victims far more vulnerable to manipulation.
CERT's Official Advice: How to Protect Yourself
Sri Lanka CERT has urged the public to remain vigilant and follow a set of clear protective measures to avoid falling victim to this scheme. Key recommendations include the following important steps every depositor should know.
Never transfer funds based on unsolicited calls or messages. No legitimate government institution, including the Central Bank of Sri Lanka or the FCID, will ask you to transfer your personal savings over a phone call or through a letter alone.
Verify independently before acting. If you receive any communication claiming to be from a government body, hang up and call the institution directly using contact numbers sourced from their official websites — not numbers provided by the caller.
Do not share personal or financial information. Legitimate officials will never ask for your account numbers, passwords, PINs, or OTPs over the phone or via message.
Report suspicious contact immediately. If you believe you have been targeted, report the incident to Sri Lanka CERT by visiting www.cert.gov.lk or contacting your nearest police station without delay.
Final Word: Stay Alert, Stay Safe
This growing threat serves as a stark reminder that financial fraud is evolving rapidly in Sri Lanka. Racketeers are becoming increasingly bold and technically capable, making public awareness the most powerful line of defence. Share this warning with family members, neighbours, and colleagues — particularly those who hold fixed deposits or may be less experienced with recognising scam tactics. Protecting your savings begins with staying informed and questioning any unsolicited communication that demands urgent financial action.