A simple greeting on Instagram may seem harmless, but for many Sri Lankans, that single word has become the first step toward a devastating extortion nightmare. The Sri Lanka Computer Emergency Readiness Team (SLCERT) has issued an urgent public warning after uncovering a large-scale, organised online extortion scam that is actively targeting Sri Lankan citizens through social media platforms, particularly Instagram. Authorities are urging the public to exercise extreme caution when interacting with unknown individuals online, as cybercriminals are using increasingly sophisticated tactics to trap and blackmail unsuspecting victims.
How the Scam Begins: The Innocent 'Hi'
The scheme typically starts with something entirely ordinary — a friendly message from a stranger on Instagram. The sender often presents themselves as an attractive, friendly individual, sometimes posing as a foreign national or a well-travelled professional. The initial conversation is light, warm, and seemingly innocent. Victims report that these scammers are highly skilled at building rapport quickly, making the interaction feel natural and genuine from the very first exchange.
Over the course of several conversations, the scammer gradually steers the discussion toward more personal and intimate territory. They may express romantic interest, shower the victim with compliments, and create a false sense of emotional connection. This phase of the scam is commonly known as "love bombing" — a psychological manipulation technique designed to lower the victim's guard and build misplaced trust within a short period of time.
The Trap Is Set: Intimate Content and Blackmail
Once a sufficient level of trust has been established, the scammer encourages the victim to share intimate photographs or participate in video calls of a private nature. In some cases, victims are manipulated into believing they are in a genuine romantic relationship before any explicit content is requested. In other instances, scammers use pre-recorded videos or deepfake technology to create the illusion of mutual participation, while secretly recording the victim's responses.
The moment any compromising content is obtained, the scammer's tone changes dramatically. Victims are suddenly confronted with threats — pay a specified sum of money, or the intimate material will be shared with their family members, friends, colleagues, or posted publicly on social media. The amounts demanded can range from a few thousand rupees to hundreds of thousands, and the pressure applied is relentless and psychologically overwhelming.
An Organised Criminal Operation
SLCERT's investigation has revealed that this is not the work of isolated individuals acting alone. The extortion network operates in an organised and coordinated manner, with different individuals playing specific roles — from initiating contact and grooming victims to handling financial transactions and carrying out threats. The operation spans across multiple countries, making it significantly more difficult for local law enforcement to trace and dismantle.
Fake profiles are created with stolen photographs, fabricated backstories, and convincing social media histories to appear legitimate. Scammers are trained to identify vulnerable targets, including individuals who appear lonely, recently single, or emotionally distressed based on their public social media activity. Sri Lanka, with its rapidly growing internet user base and increasing social media engagement, has become a primary target for these criminal networks.
The Psychological Impact on Victims
Beyond the financial losses, the emotional and psychological damage caused by these scams is profound. Many victims experience intense shame, anxiety, and depression following the extortion. Fear of social stigma often prevents them from reporting the crime to authorities, which in turn allows scammers to continue their operations with little consequence. SLCERT has emphasised that victims should not feel embarrassed or ashamed, as these criminals are highly skilled manipulators who exploit basic human emotions.
Families have been torn apart, careers have been jeopardised, and in the most tragic cases, victims have experienced severe mental health crises as a result of these targeted attacks. The human cost of this scam extends far beyond monetary loss.
How to Protect Yourself: SLCERT's Key Recommendations
SLCERT has outlined several critical steps that Sri Lankans can take to protect themselves from falling victim to this growing threat. First and foremost, never share intimate photographs or participate in explicit video calls with individuals you have not met in person and thoroughly verified. Be highly suspicious of anyone who expresses romantic interest unusually quickly or who steers conversations toward personal or private topics early in an interaction.
Review and tighten your social media privacy settings to limit what strangers can view on your profile. Avoid accepting friend or follow requests from unknown individuals, particularly those with limited post history or suspiciously perfect profile photos. If you receive any threatening messages demanding money, do not pay — payment rarely stops the demands and often encourages further extortion.
Report Immediately and Seek Help
SLCERT strongly urges anyone who has been targeted by this scam to report the incident immediately. Victims can contact SLCERT directly through their official channels or file a complaint with the Sri Lanka Police Cybercrime Division. Prompt reporting not only helps authorities track and dismantle these criminal networks but also increases the chances of preventing further harm to others.
In an era where a single Instagram message can spiral into a life-altering crisis, awareness and caution remain the most powerful tools available. SLCERT's warning is clear — think before you respond, protect your privacy, and never let a stranger's 'Hi' become your worst nightmare.