The Sri Lanka Computer Emergency Readiness Team (SLCERT) has issued an urgent public warning about a deceptive social media message circulating online, falsely claiming that Sri Lankan banks are offering special rewards and bonuses to customers in celebration of Vap Poya Day. Authorities are urging the public to remain vigilant and avoid engaging with the fraudulent message, which is designed to steal personal and financial information from unsuspecting victims.
What Is the Fake Vap Poya Day Bank Rewards Message?
The fraudulent message, which has been spreading rapidly across popular social media platforms and messaging applications, claims that major Sri Lankan banks are distributing exclusive monetary rewards, cashback offers, or special bonuses to account holders as part of Vap Poya Day celebrations. The message typically includes a suspicious link that directs users to a fake website designed to mimic a legitimate banking portal or official government page.
Once a user clicks on the link and enters their personal details — including bank account numbers, passwords, or one-time passwords (OTPs) — cybercriminals gain unauthorized access to their financial accounts. This type of cyberattack is commonly known as phishing, a widespread and increasingly sophisticated method used by fraudsters to harvest sensitive data from unsuspecting individuals.
SLCERT's Official Warning to the Public
SLCERT, the national body responsible for responding to cybersecurity incidents in Sri Lanka, has confirmed that the circulating message is entirely fabricated and has no association with any licensed bank or financial institution operating in the country. The organization has strongly advised members of the public not to click on any links embedded in the message and to refrain from sharing it further across social networks or messaging platforms such as WhatsApp, Facebook, and Telegram.
According to SLCERT, no Sri Lankan bank or government institution has announced any such reward scheme in connection with Vap Poya Day. The team emphasized that legitimate banks never request sensitive account information, passwords, or OTPs through social media messages or unsolicited links. Any communication asking for such details should be treated with extreme suspicion and reported to the relevant authorities immediately.
How This Phishing Scam Works
Cybercriminals behind this scam are exploiting the cultural and religious significance of Vap Poya Day — a sacred Buddhist full moon day observed in Sri Lanka — to lend credibility to their fraudulent claims. By tying the fake offer to a widely recognized national holiday, scammers increase the likelihood that recipients will trust the message and act on it without conducting proper verification.
The mechanics of the scam follow a classic phishing pattern. Users receive the message through social media or a messaging app, often forwarded by someone they know, which adds a layer of false legitimacy. The embedded link leads to a convincingly designed fake webpage that prompts users to enter their banking credentials or personal identification information. Once submitted, this data is immediately captured by the fraudsters and used to drain bank accounts or commit identity theft.
How to Protect Yourself From Online Banking Scams
SLCERT and cybersecurity experts recommend several practical steps that Sri Lankans can take to protect themselves from falling victim to similar phishing attacks:
Verify before you click: Always verify the authenticity of any message claiming to offer bank rewards or financial incentives. Contact your bank directly using the official phone number or visit the official website by typing the address manually into your browser rather than clicking a link.
Never share sensitive information online: Legitimate banks and financial institutions will never ask you to provide your password, PIN, or OTP through social media, email, or text messages. If any message requests such information, it is almost certainly a scam.
Report suspicious messages: If you receive a suspicious message, report it to SLCERT at their official contact channels and inform your bank immediately. Reporting such incidents helps authorities track and shut down fraudulent operations faster.
Enable two-factor authentication: Strengthening your online banking security with two-factor authentication adds an additional layer of protection, making it significantly harder for cybercriminals to access your accounts even if they obtain your password.
Educate family and friends: Many phishing scams succeed because people unknowingly forward fraudulent messages to others. Sharing awareness about such scams within your social circle can help prevent further spread and protect vulnerable individuals, particularly the elderly.
Stay Alert During Public Holidays
Cybersecurity professionals have long noted that public holidays and festive seasons are prime periods for online scams, as fraudsters capitalize on heightened emotions, goodwill, and the expectation of special offers. Sri Lankans are encouraged to maintain a healthy level of skepticism toward any unsolicited online message promising financial rewards, especially during national and religious observances such as Poya Days.
SLCERT continues to monitor the situation and is working with relevant stakeholders to take down fraudulent websites and prevent further harm to the public. Citizens are urged to stay informed, remain cautious online, and always rely on official sources for any information related to banking services or government announcements.