The Sri Lanka Computer Emergency Readiness Team (SLCERT) has issued an urgent public warning about a fraudulent social media message that falsely claims a leading Sri Lankan bank is offering special rewards to celebrate Vap Poya Day. Authorities are urging the public to remain vigilant and avoid engaging with the deceptive message, which has been circulating widely across multiple social media platforms in recent days.
What Is the Fake Bank Reward Scam?
According to SLCERT, the fraudulent message claims that a prominent Sri Lankan bank is distributing special gifts or financial rewards to customers as part of a Vap Poya Day celebration. The message is designed to appear legitimate, mimicking the branding, tone, and visual style commonly associated with trusted banking institutions in Sri Lanka. Recipients are typically encouraged to click on a link, fill out a form, or share personal and financial information in order to claim their supposed reward.
This type of scam is commonly known as a phishing attack — a method used by cybercriminals to trick unsuspecting individuals into revealing sensitive information such as bank account numbers, passwords, national identity card details, and one-time passwords (OTPs). Once this information is obtained, scammers can gain unauthorized access to victims' bank accounts and carry out fraudulent transactions.
Why Vap Poya Day Is Being Used as Bait
Cybercriminals frequently exploit public holidays, religious observances, and national celebrations to make their scams appear more believable and timely. Vap Poya, a significant Buddhist public holiday observed in Sri Lanka, marks the end of the Vas season — a three-month period during which Buddhist monks remain within their temples. The occasion holds deep cultural and religious importance for millions of Sri Lankans, making it an emotionally resonant event that scammers can exploit to lower people's guard.
By tying the fraudulent offer to a well-known and respected holiday, cybercriminals increase the perceived credibility of their message. People are more likely to trust and share content that appears to be connected to a meaningful cultural event, which is precisely what these bad actors are counting on.
SLCERT's Official Advisory and Recommendations
SLCERT has strongly advised the public not to click on any suspicious links contained within these messages, regardless of how official or convincing they may appear. The team has also emphasized that legitimate banks in Sri Lanka do not distribute rewards or gifts through unofficial social media messages or unverified links.
To protect yourself from this scam and similar cyber threats, SLCERT recommends the following precautions:
Verify before you act: Always verify any promotional offer directly with your bank by calling the official customer service number listed on the bank's official website or on the back of your debit or credit card. Do not rely on contact details provided within the suspicious message itself.
Do not click unknown links: Avoid clicking on links sent through WhatsApp, Facebook, Instagram, or any other social media platform unless you are absolutely certain of their authenticity. Phishing links are often designed to look nearly identical to legitimate banking websites.
Never share personal information: No legitimate bank will ever ask you to provide your PIN, OTP, full password, or national identity card number through a social media message, email, or unofficial website.
Report suspicious messages: If you receive a message that appears to be part of this scam, report it to SLCERT immediately through their official channels. You can also report it to the relevant bank so that they can issue their own public warning to customers.
Spread awareness: Share SLCERT's warning with family members, friends, and colleagues — particularly those who may be less familiar with online scams. Elderly individuals and first-time smartphone users are often the most vulnerable targets.
The Growing Threat of Cyber Scams in Sri Lanka
This latest warning from SLCERT highlights a growing trend of cybercrime activity targeting Sri Lankan citizens through social media platforms. Over the past few years, phishing scams, fake lottery notifications, fraudulent investment schemes, and impersonation attacks have increased significantly across the country. Cybercriminals are becoming increasingly sophisticated in their methods, making it more challenging for the average person to distinguish between legitimate communications and fraudulent ones.
SLCERT continues to play a critical role in monitoring cyber threats and educating the public about best practices for staying safe online. The organization regularly issues advisories and works in coordination with law enforcement agencies and financial institutions to combat cybercrime across Sri Lanka.
Stay Alert and Stay Safe
As Vap Poya Day approaches, SLCERT urges every Sri Lankan to exercise caution when encountering unsolicited messages on social media — especially those promising gifts, rewards, or financial benefits. When in doubt, always contact your bank directly and report suspicious activity to the relevant authorities. Staying informed and alert is the most effective defense against cyber fraud.