Nalinda Indatissa, President’s Counsel.
Online criminals try to trick people and steal money. They pretend to be banks, delivery companies, government offices, shops, or even friends. They send emails, SMS or WhatsApp messages, and sometimes they call on the phone. Their real aim is to make you click a link, install an app, or share your OTP, password, PIN, or bank details.
Sometimes you get an email saying your account is blocked or a delivery is waiting. It asks you to click a link. The email looks real, but the link goes to a fake website made to steal your information.
Sometimes you get a message on SMS or WhatsApp saying your card is blocked, you won a prize, or you must pay a small fee. It asks you to click, install an app, or share your OTP. This is also a trick.
Sometimes someone phones and says they are from the bank, police, court, or a company. They talk fast and try to scare you. Then they ask for your OTP, password, or card number. This is a scam.
There is also another common type called a romance scam. A person pretends to love you, only to take your money. They usually meet you online. They say sweet things, send photos, and tell nice stories. After some time, they start asking for money, saying there is an emergency, a hospital bill, a parcel stuck, or a travel problem. They promise to pay back, but they never do. Sometimes they ask for personal details or private photos and later use them to threaten you.
A tech support scam usually starts with a message, pop-up, email, or phone call saying your computer or phone has a virus, is hacked, or will be blocked. The message looks frightening on purpose. It may show a red screen or ask you to call a number. The person pretends to be from Microsoft, Apple, or your internet company. They ask you to give remote access or install a fixing app. Once you allow them in, they can lock your device, steal files, or ask you to pay for fake repairs. Real companies do not suddenly call you about viruses. Stay calm, close the window, restart the device, and ask someone you trust. Never give remote access to a stranger and never pay for a problem you did not ask to check.
An investment scam is when someone promises big profits with very little risk. They may say the money is guaranteed and that you will get rich fast. They often show fake screenshots or fake stories of people earning huge amounts. First they let you see a small profit. Then they ask for more money. After you send more, they disappear or say you must pay extra fees to withdraw. They often use words like crypto, trading, gold, or shares, but the trick is the same. If it sounds too good to be true, it usually is. Real investments go up and down, and nobody can promise profit.
Online shopping scams happen when a fake website, ad, or seller pretends to sell good products for a cheap price. The pictures look nice, and the reviews may look good, but they are often fake. After you pay, the item never arrives, or you get something very cheap and different. Sometimes the site takes your card details and uses them later. Be careful with shops you have never heard of. Check if the website has a real address, real contact number, and clear return rules. Do not pay by bank transfer to a stranger. Use only trusted websites and safe payment methods.
Business email compromise is when criminals break into or copy company email accounts and send messages that look real. They may pretend to be the boss, a supplier, a lawyer, or an accountant. They ask someone in the office to pay a bill or change a bank account number. Everything looks normal, so people send the money to the wrong account. This is very dangerous for companies. If an email asks for urgent payment, always double-check by calling the person using a known number. Never trust payment changes sent only by email.
Lottery and prize scams start with a message saying you have won a big prize, car, lottery, or holiday — even though you never took part. They say you only need to pay a fee, tax, or processing charge first. Once you pay, they keep asking for more, or they disappear. Real lotteries do not ask winners to pay first. If someone says you won something you did not enter, it is almost always a scam. Do not pay. Do not share your details.
Fake job offers usually promise easy work and high pay. They may say work from home, no experience needed, or earn fast. After you show interest, they ask you to pay for training, uniforms, registration, or processing. Sometimes they ask for your ID, bank details, or private documents. Real employers do not ask you to pay to get a job. Always check the company website, call a real office number, and talk to people you trust before sending documents or money.
Today, scams have become more clever because criminals now use artificial intelligence. AI helps them copy voices, create fake photos and videos, and write messages that sound real and natural. A scammer can take a short recording from social media and make a fake phone call that sounds exactly like your child, spouse, boss, or friend. They may say there is an emergency and ask you to send money immediately. AI can also make fake videos of company leaders, famous people, or officials, so people believe they are real. Scammers use AI to write smart emails without spelling mistakes, and they look professional and polite. They can build fake websites, fake companies, and even fake people online, complete with nice photos and fake reviews. Some romance scammers now use AI chatbots to talk all day, send sweet messages, and sound loving and caring, until they slowly start asking for money. Because of AI, scams are harder to spot and move very fast. This is why it is more important than ever to slow down, check carefully, and not trust anything just because it looks real or sounds real.
Do not share OTPs, passwords, PINs, or bank details. Do not click strange or suspicious links. Do not install apps that strangers tell you to install. Do not send money to people you have never met in real life. If anyone rushes you, scares you, or tells you to keep secrets — stop and think. Real banks, government offices, and genuine companies will never ask for your password or OTP. If you are unsure, call your bank using the number on your card, or type the real website yourself. Ask a trusted person for help. If you already shared something or sent money, contact your bank at once and report it to the police or cybercrime unit. Scammers are very clever. Many good people get caught. Do not feel ashamed. The most important thing is to stop quickly and stay safe.
Even when a person manages to avoid losing money to a scam, there is still an important civic responsibility to report the attempt. Reporting helps authorities identify patterns, discover networks, and prevent others from falling victim. Many people who are elderly, less educated, or financially vulnerable are often targeted repeatedly, and each report strengthens the ability of law enforcement to act. Silence allows scammers to operate freely. In Sri Lanka, a complaint can be made at the nearest police station, where a formal statement will be recorded and a reference number issued. Cases that involve digital fraud or online communication can also be referred to the CID Cyber Crimes Division. In addition, Sri Lanka CERT — the national cyber-security response team — accepts reports relating to online incidents. If money has moved or accounts have been accessed, the affected bank or financial institution should be notified immediately so that suspicious transactions can be frozen wherever possible.
When a complaint is received, investigators first obtain a detailed statement and collect any available evidence such as screenshots, emails, text messages, bank slips, phone numbers, and website links. They then focus on preserving digital evidence from devices and records before attempting to trace both the money trail and the communication trail. Banks, telecom operators, and online platforms may be contacted so that suspicious accounts, SIM cards, or payment channels can be monitored or frozen. The objective is to connect the suspect, the devices involved, and the movement of funds. In many cases, scammers are not even in Sri Lanka. They may operate from call centres overseas, use foreign numbers and VPNs, or direct payments through international channels, cryptocurrencies, or “money mule” accounts. Funds are sometimes moved quickly from one country to another to make tracing more difficult.
Despite these tools, cybercrime investigation is complex. Scammers hide behind false identities, constantly change devices and accounts, rely on intermediaries, and exploit delays between countries. VPNs disguise locations, evidence disappears quickly, cryptocurrency requires specialised analysis, and different countries have different privacy and data rules. Because many scams are cross-border, effective investigation also requires specially trained officers with skills in digital forensics, financial tracking, and international legal processes, together with closer working relationships between agencies in different jurisdictions so that information can be shared quickly and action can be coordinated. As a result, not every case leads to recovery of funds, and quick reporting becomes critically important. Investigations can move more effectively when victims come forward immediately, banks are alerted in time, and evidence is preserved carefully — even though formal cross-border procedures can still create unavoidable delays.
In Sri Lanka, experience shows that investigations which extend beyond national borders are extremely complex and often painfully slow. In today’s global village, there is therefore a pressing need for well-coordinated investigative mechanisms, supported by genuine mutual legal assistance and cooperation among countries, if we are to effectively curb the rising wave of cybercrime.
