Sri Lanka's Computer Emergency Readiness Team (SLCERT) has issued an urgent public warning about a highly sophisticated financial scam that is actively targeting unsuspecting citizens across the country. Fraudsters are reportedly impersonating bank officials and financial institution representatives to gain access to victims' savings accounts and fixed deposits, draining hard-earned money in a matter of minutes. Authorities are urging every Sri Lankan with a bank account to remain vigilant and take immediate precautions to protect their financial assets.
How the Scam Works
The scam follows a carefully orchestrated pattern designed to exploit trust and create panic. Fraudsters typically initiate contact through phone calls, text messages, or even messaging applications such as WhatsApp and Viber. They pose convincingly as representatives from well-known banks, the Central Bank of Sri Lanka, or other reputable financial institutions.
During the conversation, the scammer informs the victim that their account has been flagged for suspicious activity, that their fixed deposit is at risk of being frozen, or that urgent verification is required to prevent account suspension. The sense of urgency is deliberately manufactured to pressure victims into acting quickly without thinking critically. Once the victim is sufficiently alarmed, the fraudster requests sensitive information including account numbers, one-time passwords (OTPs), PINs, and internet banking credentials.
In some reported cases, victims were even directed to fraudulent websites that closely mimic the official portals of legitimate banks. These fake websites capture login credentials in real time, giving scammers instant access to bank accounts. Within moments, funds are transferred out — often to multiple accounts to make tracing difficult — and the victim is left with nothing.
Who Is Being Targeted?
While anyone with a bank account is potentially at risk, SLCERT has noted that certain groups appear to be disproportionately targeted. Senior citizens, who may be less familiar with digital fraud tactics, are among the most vulnerable. Additionally, individuals holding large fixed deposits or those who have recently conducted significant banking transactions are being specifically singled out by these criminal networks.
The scam is not limited to any single region of Sri Lanka. Reports have emerged from Colombo, Kandy, Galle, and several other provinces, indicating that this is a coordinated, nationwide operation rather than isolated incidents. The sophistication of the approach suggests that organized criminal groups with significant resources are behind the scheme.
SLCERT's Official Warning and Recommendations
SLCERT has made it absolutely clear that no legitimate bank, financial institution, or government authority will ever call a customer and ask for passwords, OTPs, or full account details over the phone or through a messaging application. This is a fundamental rule of banking security that every citizen should memorize and share with family members.
The agency has issued the following key recommendations to help the public protect themselves:
Never share OTPs or PINs: One-time passwords and personal identification numbers are strictly confidential. No genuine bank employee will ever ask for these details under any circumstances, regardless of the reason given.
Verify before you act: If you receive a suspicious call from someone claiming to represent your bank, hang up immediately and call your bank directly using the official number printed on your bank card or listed on the bank's official website. Do not use any number provided by the caller.
Avoid clicking suspicious links: Do not click on links sent via SMS, WhatsApp, or email that claim to direct you to your bank's website. Always type the official URL directly into your browser.
Enable account alerts: Activate SMS and email notifications for all transactions on your accounts. This allows you to detect unauthorized activity immediately and report it before further damage is done.
Report suspicious activity immediately: If you believe you have been targeted or have fallen victim to this scam, contact your bank's fraud department without delay and report the incident to SLCERT through their official channels.
The Broader Economic Impact
Financial scams of this nature carry consequences that extend far beyond individual victims. When public confidence in the banking system erodes, people become reluctant to maintain savings in formal financial institutions, which undermines economic stability at a national level. Sri Lanka, which is still navigating a path toward economic recovery, cannot afford widespread distrust in its financial sector. Every successful scam not only devastates a family's financial security but also chips away at the broader economic resilience the country is working hard to rebuild.
Stay Alert and Spread Awareness
SLCERT's warning serves as a critical reminder that cybercriminals are becoming increasingly sophisticated and relentless in their pursuit of financial gain. The best defense remains an informed and alert public. Share this warning with elderly relatives, neighbors, and colleagues who may not be aware of these tactics. A single conversation could prevent a devastating financial loss. Protecting your savings starts with awareness — do not let fraudsters win.