Sri Lanka Police have issued an urgent public warning about a growing wave of cybercrime targeting citizens through fake websites and fraudulent SMS messages that closely mimic the government's official GovPay payment platform. Authorities are urging all residents to exercise extreme caution when making online payments or responding to text messages that claim to be from government services, as scammers are becoming increasingly sophisticated in their methods of deception.
What Is the GovPay Scam?
GovPay is Sri Lanka's official government payment gateway, widely used by citizens to settle taxes, utility bills, fines, and various other state-related fees. Cybercriminals have now begun exploiting the platform's trusted reputation by creating counterfeit websites that look nearly identical to the genuine GovPay portal. These fake sites are designed to trick unsuspecting users into entering sensitive personal information, banking credentials, and payment card details, which are then harvested by fraudsters for financial theft and identity fraud.
In addition to fake websites, scammers are also sending deceptive SMS messages to mobile phone users across the country. These text messages often contain urgent language, claiming that a payment is overdue, a fine must be settled immediately, or that government benefits are pending collection. The messages include links that redirect recipients to fraudulent websites engineered to steal their data.
How to Identify a Fake GovPay Website
One of the most effective ways to protect yourself is learning how to distinguish a legitimate government website from a fraudulent one. Sri Lanka Police and cybersecurity experts advise the public to look out for the following warning signs:
Check the URL carefully: The official GovPay website uses a verified government domain. Any website with a slightly altered spelling, unusual characters, or a domain ending that differs from the official address should be treated with immediate suspicion. Scammers often use domains that look similar at a glance, such as replacing letters with numbers or adding extra words to the address.
Look for HTTPS and security certificates: While not a guarantee of legitimacy on its own, a secure connection indicated by a padlock icon in the browser bar is a basic requirement. However, users should not rely solely on this indicator, as fraudulent sites can also obtain basic SSL certificates.
Avoid clicking links in SMS messages: Legitimate government agencies in Sri Lanka will not ask citizens to click on links sent via SMS to make urgent payments. If you receive such a message, do not click the link. Instead, navigate directly to the official government website by typing the address into your browser manually.
Verify before you pay: If you are unsure whether a payment request is genuine, contact the relevant government department directly through their official contact numbers or visit in person to confirm.
Police Advice and Recommended Actions
Sri Lanka Police have strongly advised the public never to share banking passwords, one-time passwords (OTPs), credit or debit card numbers, or any personal identification details through websites accessed via SMS links or suspicious online portals. Authorities emphasize that government agencies will never request such sensitive information through unsolicited text messages.
Citizens who believe they may have already fallen victim to one of these scams are urged to act quickly. Immediately contact your bank or financial institution to report the incident and request that your accounts be secured. Change all passwords associated with online banking and government service portals without delay. Additionally, report the incident to the Sri Lanka Police Cybercrime Division so that authorities can investigate and take action against those responsible.
Police are also calling on the public to report any suspicious websites or SMS messages they encounter, even if they have not personally been affected. This community vigilance plays a crucial role in helping law enforcement identify and shut down fraudulent operations before more people are harmed.
The Growing Threat of Cybercrime in Sri Lanka
This latest warning reflects a broader and deeply concerning trend of rising cybercrime activity across Sri Lanka. As more citizens turn to digital platforms for government services and financial transactions, criminals are adapting their tactics to exploit this shift. Phishing attacks, identity theft, and online payment fraud have all seen a notable increase in recent years, placing both individuals and institutions at risk.
Cybersecurity awareness remains one of the most powerful tools available to the general public. Staying informed about the latest scam tactics, practicing safe browsing habits, and verifying the authenticity of online platforms before entering any personal information are essential steps every digital user should take.
Stay Safe Online
Sri Lanka Police urge every citizen to remain vigilant, share this warning with family and friends, and always use official government channels for all payments and service requests. When in doubt, stop, verify, and report. Your security and financial safety depend on the choices you make online every single day.