By: Staff Writer
October 27, Colombo (LNW): Sri Lanka’s financial security crisis extends beyond the US$2.5 million Treasury cyber heist, with a separate US$626,755 international payment diversion at the Department of Posts exposing potentially deeper weaknesses in the government’s financial controls. The two incidents raise serious questions about whether public institutions are adequately protecting taxpayers’ money, whether senior administrators are confronting the full extent of the failures, and why basic verification procedures appear to have been insufficient to prevent substantial losses.
The postal fraud came to light only in April 2026, after the United States Postal Service alerted Sri Lankan authorities that international settlements had gone missing. According to the investigation details supplied, the Criminal Investigation Department’s Computer Crimes Division traced the diverted funds through nine foreign bank accounts believed to be part of an international money-laundering network.
The case was presented before the Colombo Fort Magistrate’s Court, bringing the scale of the suspected fraud into the judicial process. Investigators believe spoofed communications and phishing emails were used to manipulate payment details within the department’s email network. The suspected diversion began in 2024, meaning the irregularities remained undetected for a considerable period before the foreign postal authority raised the alarm.
The delay itself demands scrutiny. How could international settlements reportedly go missing over an extended period without the department’s internal controls identifying the discrepancies? What reconciliation procedures were in place, and why did an external institution have to alert Sri Lanka before the problem was detected?
These questions acquire greater significance when considered alongside the Treasury fraud. Although the two cases involve separate institutions and payment arrangements, both reportedly relied on deceptive electronic communications to redirect funds. Together, they expose the potential consequences of inadequate email security, weak verification procedures and failures in financial oversight.
he Treasury incident alone forced the government to meet its original US$2.5 million obligation again after the payment failed to reach Export Finance Australia. The postal case involves an additional US$626,755 in diverted funds, although the ultimate financial liability and recovery position must be established through the ongoing investigation. The combined value of the two reported diversions is US$3,126,755, but the confirmed net loss to public finances should not be assumed until recoveries, liabilities and accounting treatment are disclosed.
Former Finance Minister and MP Ravi Karunanayake has criticised the Central Bank of Sri Lanka and the Ministry of Finance over the Treasury fraud, allocating 65% of the responsibility to the Central Bank and 35% to the Finance Ministry. His criticism also carries a wider warning: these failures should not be treated as isolated administrative mishaps.
Karunanayake has questioned the cyber resilience of other critical institutions, including Sri Lanka Customs, the Inland Revenue Department, the Department of Excise and major state-owned banks. His concerns raise the possibility that weaknesses in digital infrastructure, staff preparedness and payment verification could extend across the public sector.
The authorities must now establish whether comparable vulnerabilities exist in the postal service and other institutions, rather than waiting for another foreign organisation to report missing funds.
The response should go beyond emergency software upgrades. Independent audits, mandatory multi-factor authentication, verified changes to beneficiary bank details, transaction monitoring and clear lines of executive responsibility are essential. Equally important is the publication of credible findings, recovery updates and explanations of the controls that failed.
For taxpayers, the fundamental concern is that public money can be lost through institutional failures while the public remains uncertain about who is responsible. Investigations must establish the facts without prejudging individual guilt. But administrative silence, bureaucratic blame-shifting and delayed disclosure cannot substitute for accountability.
Sri Lanka cannot afford a system in which financial institutions discover their vulnerabilities only after money has disappeared. Unless the government demonstrates that the lessons from both cases have translated into enforceable safeguards, taxpayers will continue to bear the risk of failures they had no power to prevent.
