While advanced cyberattacks exist, the most effective scams targeting everyday Sri Lankans rely on social engineering—manipulating human trust and fear.

• The WhatsApp Account Takeover: Sri Lanka CERT recently issued warnings regarding WhatsApp account takeover attacks targeting various mobile devices. Scammers often trick users into forwarding a verification code, locking the original user out of their own account to scam their contact list.
• The “Urgent” Bank Impersonator: Victims frequently receive phone calls from individuals posing as bank officials or telecom representatives, falsely claiming there is a sudden security issue or a mandatory “KYC” (Know Your Customer) update. They create a false sense of panic, demanding that the user read out a One-Time Password (OTP) sent to their phone.
• Fake Lottery Wins and Malicious Apps: Another common tactic involves fake SMS alerts declaring a lottery win or a lucrative job offer. These messages often contain dangerous links that prompt users to download malicious APK files or direct them to fake login pages explicitly designed to capture banking credentials and OTPs.

The Golden Rule: Protect Your OTP

An OTP is the digital equivalent of the key to a safe. Banks and legitimate telecom operators will never call a customer and ask them to read an OTP aloud.

Once a scammer obtains an OTP, they gain full access to the victim’s account, allowing them to transfer and drain funds within a matter of minutes before the victim even realizes what has happened. Sri Lanka CERT continuously urges the public, especially pensioners and older adults who are highly susceptible to these subtle tactics, to remain highly vigilant.

How to Stay Safe (Pause. Think. Verify.)

Cybersecurity experts recommend a simple, highly effective behavioral defense mechanism: “Pause. Think. Verify.”.

• Pause: Recognize that scammers rely entirely on creating artificial urgency. Never act immediately if a message or caller demands instant action.
• Think: Question the scenario. Would a legitimate bank or government institution threaten to block an account over a standard phone call?
• Verify: Hang up and contact the institution directly using an official hotline printed on a bank card or published on their official website.

Further Protection Steps:

• Never share OTPs, PINs, or passwords with anyone under any circumstances.
• Avoid clicking unknown links sent via SMS or messaging platforms like WhatsApp, Telegram, or Facebook.
• Download applications exclusively from official sources such as the Google Play Store or Apple App Store, completely avoiding third-party APK files.
• Establish a “pause-and-verify” household rule where elderly relatives or teenagers agree to consult another family member before responding to any digital request involving money, OTPs, or urgent threats.

What to Do If You Are Compromised

If a mistake happens and details are shared, speed is critical. Stolen funds become increasingly difficult to recover with every passing hour.

1. Freeze Accounts: Call the bank’s 24/7 fraud hotline immediately to block all connected cards and freeze digital banking access.
2. Report to Authorities: Lodge a formal complaint with the Cyber Crime Unit of the Criminal Investigation Department (CID), which serves as the official law-enforcement entry point for cyber fraud in Sri Lanka.
3. Alert CERT: If details were captured through a phishing link or malicious app, report the incident to FinCSIRT or email Sri Lanka CERT at report@cert.gov.lk so the malicious domain can be investigated and taken down.

Protecting our communities in the digital age requires ongoing education and patience. By sharing these basic rules with family members who are less familiar with smartphone security, we can collectively close the vulnerabilities that scammers rely on.