The scams people report most, and how to avoid each one
1. Calls, links and WhatsApp messages from fake banks, police, CID or Central Bank officials
This is the scam the authorities warned about most often in 2026. In January the police said people were being tricked into revealing bank details, passwords, OTPs and QR codes, and listed phishing links sent in the name of banks, telephone companies and delivery services. In May they warned of fake traffic fine messages by SMS and WhatsApp saying a CCTV camera had caught a violation, with a link to a site made to look like the government's GovPay payment platform that collected card details; the police explained that a real fine slip is only issued after an officer has told the driver about the offence. In July they warned of people using stolen or invented photos of police officers on WhatsApp and Telegram, claiming to be from the Central Bank, the CID or another police unit, saying your National Identity Card or bank account is linked to fraud or money laundering, sending forged identity cards and documents, and then asking for OTPs and PINs, for transfers to unfamiliar accounts or for cryptocurrency such as USDT. In August Sri Lanka CERT described a version aimed at savings and fixed deposits: callers posing as Central Bank and police Financial Crimes Investigation Division (FCID) officials send forged Central Bank letters and stamps and tell victims to move half of their deposits to a private account "for the investigation". CERT said retired and elderly people are especially at risk.[3][8][5][6][7][4][36]
Reported in: Phone calls, SMS, WhatsApp and Telegram, nationwide; the money is moved on through other people's accounts
How it works
A caller, message or video call says he is from your bank, the police, the CID, the FCID or the Central Bank. Your card is blocked, you owe a fine, or your NIC or account is under investigation. You are asked to open a link, read out an OTP, pay a "fine", or move your money to a "safe" account or into cryptocurrency until the case is closed.
Red flags
- Anyone asking for an OTP, PIN, CVV or password, whoever they say they are
- A threat of arrest, an investigation or a frozen account unless you act now
- Photos of officers, identity cards or official letters sent by WhatsApp or Telegram
- Being told to transfer money to another person's account, or to buy cryptocurrency, to "clear" your name
- A fine or payment link that arrives by SMS or WhatsApp
How to protect yourself
- Never share an OTP, PIN, CVV or password; the police say no government or private institution asks for them by phone or social media
- Hang up and call your bank on the number on your card or in its official app
- Remember that the police do not charge any fee for an investigation and send official communications in writing or through officers in person
- Pay traffic fines only after you have an official fine slip
- Talk to elderly relatives about this scam; CERT says they are a main target
If it happened to you
- Call your bank at once and ask it to block your card or account and stop the transfer
- Report to the Computer Crime Investigation Division on 011-2300756, 071-8592918 or 071-8591765, or go to the CID or your nearest police station
- Keep screenshots of the messages, numbers, documents and receipts
- If you received forged documents with government logos, take them to the nearest police station
Where to report: Your bank first; then the police Computer Crime Investigation Division or the nearest police station. Social media incidents can also go to Sri Lanka CERT's incident reporting portal.
2. Online "jobs", task groups and investment or crypto offers on Telegram and WhatsApp
The police list of the nine most common online frauds includes fake data entry and work-from-home jobs that promise unrealistically high pay and ask for a registration or processing fee, and investment schemes promoted through Telegram channels and Facebook groups that promise high returns and ask for registration fees, wallet transfers, referrals and advance payments. In May 2026 the police said complaints arrive daily and that the Computer Crime Investigation Division was investigating them. Cryptocurrency is a common ingredient: the Central Bank says it has not licensed any entity to run cryptocurrency schemes, mining operations or exchanges, and that such investments have no regulatory safeguards in Sri Lanka. In May 2026 AFP reported that police had arrested more than 1,000 foreign suspects over cybercrime since January, after scam networks pushed out of Southeast Asia moved into rented villas and buildings in Sri Lanka; officials said they target victims across Asia and that Sri Lankans could be next.[3][4][15][35][5]
Reported in: Facebook adverts and pages leading to Telegram and WhatsApp groups, apps and trading sites
How it works
You are offered easy money for liking posts, rating products or simple online work, or a share in a trading or crypto platform with fixed daily returns. The first small payments arrive. Then you must pay a fee to join, deposit more to reach a higher level, bring in friends or pay a "tax" to withdraw, and in the end the group or site disappears.
Red flags
- A job that asks you to pay before you earn
- Fixed daily or monthly returns, or money that doubles
- Commissions for bringing in friends and family
- A fee to withdraw your own balance
- Requests to scan a QR code, install an app or browser extension, or lend your bank account
How to protect yourself
- Treat any job or group that asks for money first as a scam
- Do not install apps or extensions from unknown sources or give them access to your phone
- Never let anyone else use your bank account; the police list this among their main precautions
- Check that an investment is offered by an institution licensed by the Central Bank or another regulator
If it happened to you
- Stop paying; more deposits never unlock the balance
- Tell your bank which transfers went to the fraudsters
- Report to the Computer Crime Investigation Division or your nearest police station with screenshots of the group, app and every payment
Where to report: The police Computer Crime Investigation Division or the nearest police station; your bank for the transfers.
3. Fake foreign jobs, visas and recruiters, including Gulf jobs
For anyone planning to work abroad this is the section to read first. SLBFE said in March 2026 that between October 2025 and February 2026 it received 2,081 complaints, filed 244 court cases against foreign employment fraudsters, carried out 19 raids, arrested 88 people (three of them linked to licensed agencies) and recovered more than Rs 194.5 million for victims. It said fraudsters increasingly work through social media, promising jobs in Israel, South Korea, Japan, Romania and several Middle Eastern countries, and that many use personal accounts or new pages. In September 2026 it warned about a fake website using its name, logo and photographs to offer free jobs in Israel and collect names, NIC numbers and phone numbers. Recruiting, advertising, collecting money or personal information, or processing passports for foreign jobs without an SLBFE licence is an offence under the SLBFE Act. Fake offers can also lead to trafficking: in 2025 the Foreign Ministry announced the rescue of 15 Sri Lankans forced to work in cybercrime centres in Myanmar, and the National Anti-Human Trafficking Task Force said some victims were recruited while already working in Dubai.[21][22][23][24][27][28][29][30][31][32][33][34]
Reported in: Facebook, TikTok and WhatsApp pages and videos, individual "agents" and people who once worked abroad, nationwide
How it works
A person or page offers a well-paid job abroad, sometimes with an official-looking letter. You pay for the visa, ticket and "processing" and hand over your passport. The job never comes, the person disappears, or you are sent on a visit visa to a job that does not exist or to a scam centre where your passport is kept.
Red flags
- The recruiter is a private person or page, not an agency on SLBFE's list of licensed agencies
- The job cannot be found on SLBFE's job search, or the fee is above the maximum shown for that job order
- Payment in cash or to a personal account, without a receipt
- An online form asking for your NIC and personal details before any interview
- High pay in Myanmar, Thailand, Cambodia or Laos, or an offer passed on to you while you work in the Gulf
How to protect yourself
- Check the agency on SLBFE's agency search and the job order on its job search before paying anything; our guide to working in the Gulf from Sri Lanka explains SLBFE registration and the fee limits
- Do not hand over money or your passport to intermediaries
- Register with SLBFE and travel on a work visa, never on a visit visa with a promise to change it later
- Ignore "free job" websites using SLBFE's logo; SLBFE news appears on slbfe.lk
If it happened to you
- Call SLBFE's 24-hour hotline 1989 or its Special Investigation Division on 011-2882228
- File a complaint online at services.slbfe.lk or at the SLBFE head office in Battaramulla, with receipts, chats and the advert
- If you are abroad and stranded, contact the SLBFE Employment and Welfare officer at the Sri Lankan mission
Where to report: SLBFE: hotline 1989, Special Investigation Division 011-2882228, online complaint system; abroad, the Sri Lankan mission's labour section and the host country's labour ministry.
4. Pyramid schemes, unauthorised deposit-taking and plantation "investments"
The Central Bank defines a pyramid scheme as one where earnings come mainly from recruiting new members or from members paying in more, rather than from a real business. Under section 83C of the Banking Act, a scheme with even one of these features is illegal, and the law also covers those who promote, advertise or finance it. CBSL publishes the schemes it has investigated and found to be prohibited: its notice of 1 July 2026 listed 25 companies, apps and groups, and its notice of 5 August 2026 added one more, making 26. Separately, only institutions licensed under the Banking Act or the Finance Business Act may accept deposits from the public; in September 2026 CBSL listed companies whose assets are frozen under the Finance Business Act, and a Sunday Times report quoted Central Bank officials saying more than 150 cases concern unauthorised deposit-taking. In January 2026 the Governor said the Bank was investigating 18 institutions and individuals over deposit-taking through forest and plantation schemes, and that promised returns of 30 to 40 per cent a month cannot come from genuine farming. In June 2026 CBSL warned the media not to promote unregistered deposit or plantation schemes.[11][12][13][14][18][16][17]
Reported in: Seminars, word of mouth, Facebook and WhatsApp groups, apps, and advertisements on television and in newspapers
How it works
You are invited to join a business, app or plantation project that pays high returns or commissions. Early members are paid with the money of new members, so you are pushed to recruit relatives and friends. When new money slows, payments stop and the promoters are gone.
Red flags
- Income that depends on recruiting others or on members paying in more
- Monthly returns far above bank rates, or guaranteed profits
- A company that takes deposits but is not a licensed bank or finance company
- A scheme, app or company that is on CBSL's list of prohibited schemes
How to protect yourself
- Check any scheme against the Central Bank's latest notice on prohibited pyramid schemes before you join
- Deposit money only with banks and finance companies licensed by the Central Bank
- Do not recruit others; promoting a prohibited scheme is itself an offence under the Banking Act
- Be wary of plantation or crop schemes that promise monthly returns; the Central Bank says they are not regulated
If it happened to you
- Stop paying in and keep every receipt, contract and message
- Report the scheme to the nearest police station or to the Central Bank's Financial Consumer Relations Department
- Warn the people you introduced
Where to report: The nearest police station, or CBSL's Financial Consumer Relations Department: hotline 1935, 011-2477744, 076-5780000, fcrd@cbsl.lk.
5. Hacked WhatsApp and Facebook accounts and fake profiles asking friends for money
Sri Lanka CERT says fake and hacked accounts made up a large part of the more than 12,650 complaints it received in 2025, and by June 2026 it had recorded 40 WhatsApp account hacks that year. The police warned in 2025 of a surge in WhatsApp takeovers: fraudsters send deceptive messages or pose as someone you know to get the verification code WhatsApp sends you, then use the account to ask your contacts for money. The police list of common frauds also starts with fake social media accounts that copy the names and photos of well-known people and institutions.[1][2][9][3][36]
Reported in: WhatsApp, Facebook, Messenger and Instagram, nationwide
How it works
Someone posing as a friend, a contact or a service asks you to send the verification code that has just arrived on your phone. The code lets the fraudster take over your account, and your contacts then get urgent requests for money in your name.
Red flags
- Anyone asking you to forward a six-digit code you did not request
- An urgent request for money by message, with an excuse for not talking on the phone
- A second profile in the name of someone already on your list
How to protect yourself
- Never share a verification code or OTP, even with a friend
- Turn on two-factor authentication on WhatsApp and Facebook and use strong passwords, as CERT advises
- Before sending money, call the person on a number you already know
If it happened to you
- Recover the account through the app's official recovery steps and log out other devices
- Warn your contacts from another account or by phone
- Report to Sri Lanka CERT's incident reporting portal or to the police; anyone who sent money should call their bank at once
Where to report: Sri Lanka CERT's incident reporting portal (hotline 101); the police Computer Crime Investigation Division or the nearest police station.
6. Fake instant loans, prizes, gift parcels and online shops
Four of the nine frauds on the police list fall here. Advertisements on Facebook and WhatsApp offer "instant" or "no-repayment" loans; victims pay a service or registration fee and get nothing, or get a small loan followed by excessive interest and harassment of their family and friends. Others are told they have won a prize and must first pay tax or a processing fee, often by someone posing as a "prize officer". Some are asked to pay for a "gift parcel" from abroad. Fake Facebook pages and groups sell goods that never arrive and insist on direct bank transfers. The police also warn that elderly people are targeted with requests for help from abroad and that children are drawn in through gaming top-ups and fake "free skins" links.[3][5]
Reported in: Facebook, WhatsApp and phone calls, nationwide
How it works
A loan, prize, parcel or bargain is offered, but first you must pay a fee, a tax, a delivery charge or the full price to a personal account. After you pay, the seller or "officer" disappears or asks for more.
Red flags
- A loan that needs a fee before it is paid out
- A prize from a draw you never entered
- A customs or delivery fee for a parcel you did not expect
- A seller who accepts only direct bank transfers and has no verifiable identity
How to protect yourself
- Borrow only from banks and licensed finance companies
- Never pay to receive a prize, loan or parcel
- Buy from verified pages and check the seller before paying
- Watch what children download and top up in games
If it happened to you
- Call your bank to stop the payment
- Report to the police Computer Crime Investigation Division or the nearest police station with the page link, chats and receipts
- If a loan company harasses your family, report the threats to the police
Where to report: Your bank; the police Computer Crime Investigation Division or the nearest police station.
7. Romance scams and video-call sextortion
Romance and relationship scams are on the police list: fake profiles on Facebook, Instagram, WhatsApp or Messenger build trust and then ask for money, sometimes for a "gift parcel" they say they sent. In May 2026 Sri Lanka CERT warned of an extortion scam that begins with fake Facebook accounts befriending a victim's friends, followed by a WhatsApp video call that is recorded and used to demand money under threat of sending the video to the victim's contacts. CERT urged victims to complain at once to the nearest police station.[3][10][36]
Reported in: Facebook, Instagram, Messenger and WhatsApp video calls, nationwide
How it works
A friendly new contact moves quickly to love, marriage or an intimate video call. The fraudster then asks for money for travel, customs or an emergency, or records the call and threatens to share it unless you pay.
Red flags
- A new contact who moves fast to love or intimate video calls
- Someone you have never met who needs money for travel, customs or fines
- A threat to share images unless you pay
How to protect yourself
- Accept friend requests only from people you know
- Do not join video calls with strangers or share intimate images
- Keep your friends list private
If it happened to you
- Do not pay; payment usually brings more demands
- Keep screenshots of the profile, chats and threats, then block
- Complain to the nearest police station or the Computer Crime Investigation Division; report the profile to the platform
Where to report: The nearest police station or the police Computer Crime Investigation Division; Sri Lanka CERT for the social media accounts.
City by city
Colombo and the Western Province
Several of the offices you report to are here: the Central Bank's Financial Consumer Relations Department on Janadhipathi Mawatha, Colombo 01, and the SLBFE head office in Battaramulla; the police say you can also take a complaint to the CID in person. Published 2026 cases from the area include the SLBFE arrest in January of a man accused of taking more than Rs 3 million from 11 people for jobs in Canada with a forged ministerial letterhead, who was found running the racket from a lodge in Rajagiriya, and AFP's report in May that police had arrested 280 foreign suspects near Colombo in one week in operations against scam networks working from rented property.[11][33][5][25][35]
- You can walk in to the CID with a written complaint, or go to any police station
- Before paying anyone in Colombo for a job abroad, check the agency on SLBFE's agency search
Where to report: The CID or the nearest police station; 119 in an emergency.
Kandy and the hill country
Two foreign job cases published by SLBFE in 2026 involved people from the Kandy area. In January its Special Investigation Unit arrested a Pilimatalawa resident, a former local council member, accused of taking more than Rs 3 million from 11 people for jobs in Canada using a forged letterhead of the foreign employment minister; investigators said several earlier cases against him were pending in the Kandy courts. In May it arrested a man from Haguranketha, found hiding in a rented house in Kadugannawa, over promised construction jobs in Romania; it had received 16 complaints totalling Rs 21.3 million.[25][26][21]
- A letter with a minister's or ministry's letterhead does not prove a job is real; check the job order with SLBFE
- Be careful with offers from people who say they worked in the country before and can get you in
Where to report: SLBFE hotline 1989 or its Special Investigation Division on 011-2882228; the nearest police station.
Galle, Matara and the south coast
The south coast has seen some of the largest raids on scam operations. Police told AFP in May 2026 that in a single night they carried out five raids in the Galle and Matara districts against groups running online fraud from rented properties, and that they had begun warning property owners not to rent villas and apartments to suspected scam groups, because they could be prosecuted for aiding a criminal offence. These networks mainly target people abroad, but the same rules protect residents: do not let anyone use your bank account or SIM, and do not take part-time "online work" for groups you cannot verify.[35][3]
- If you rent out a villa, house or rooms, check who your tenants are and report suspicious activity to the police
- Never open a bank account or register a SIM for someone else
Where to report: The nearest police station or the Computer Crime Investigation Division; 119 in an emergency.
Where to report a scam in Sri Lanka
Channels named on official Sri Lankan pages or in official statements reported by the press. If you are in danger, call 119.
| Situation | Channel | Source |
|---|---|---|
| You are in danger or a crime is happening now | Police emergency 119; the police 118 online emergency complaint service (Tell IGP) | Sri Lanka Police |
| Money taken from your bank account or card | Your bank at once to block the card or account; then the police Computer Crime Investigation Division on 011-2300756, 071-8592918 or 071-8591765, the CID in person or the nearest police station | Sri Lanka Police, as reported by the Daily Mirror |
| Hacked or fake social media account, online fraud or harassment | Sri Lanka CERT's incident reporting portal at cert.gov.lk/report_incident; hotline 101 (CERT asks that social media and financial fraud matters go through the portal, not email) | Sri Lanka CERT|CC |
| A pyramid scheme or someone taking deposits without a licence | The nearest police station, or the Central Bank's Financial Consumer Relations Department: hotline 1935, 011-2477744, 076-5780000, fcrd@cbsl.lk | Central Bank of Sri Lanka |
| Your bank, finance company or payment provider does not resolve your complaint | Complain to the provider first; then the Central Bank's online Complaint Management System at reachus.cbsl.lk | Central Bank of Sri Lanka |
| A fake foreign job offer or an unlicensed recruiter | SLBFE 24-hour hotline 1989; Special Investigation Division 011-2882228; online complaint system services.slbfe.lk | SLBFE; SLBFE as reported by Ada Derana |
| A problem with your mobile or internet service | Your operator first; then the Telecommunications Regulatory Commission in writing | TRCSL |
| A Sri Lankan worker in the Gulf who needs help | The SLBFE Employment and Welfare officer at the Sri Lankan embassy or consulate, and the host country's labour ministry (below) | SLBFE |
Call your bank first, within minutes, with transaction details, numbers, times and screenshots; then report. The police say they never ask for OTPs or charge a fee for an investigation, so treat anyone who does, or who offers to recover your money for a fee, as part of the scam.
Six habits that stop most of these scams
The warnings from the police, Sri Lanka CERT, the Central Bank and SLBFE come down to a few rules.
- Never share an OTP, PIN, CVV, password or WhatsApp code with anyone, whoever they say they are
- Hang up and call your bank on the number on your card or in its official app
- No police officer or Central Bank official will ask you to move your money to another account
- Never pay to get a job, a loan, a prize or a parcel
- Before joining any scheme, check the Central Bank's list of prohibited schemes and deposit only with licensed institutions
- Never let anyone use your bank account, card or SIM
If you have lost money: the first hour
Speed matters, because the money is moved on quickly through other accounts.
- Call your bank's hotline and ask it to block your card or account and the transfer
- Report to the Computer Crime Investigation Division or the nearest police station with transaction details, amounts, times and the fraudster's numbers
- Report hacked or fake accounts on Sri Lanka CERT's portal
- Keep screenshots, links, chats and receipts, and do not pay anyone who promises to recover the money
If the scam happened while you were working in the Gulf
Many of our readers work in the Gulf. If you were cheated there, by an employer, an agent or an online fraudster, you can complain to the labour ministry and police of the country where you work, not only in Sri Lanka; our scam guides for the UAE, Saudi Arabia, Qatar, Oman, Kuwait and Bahrain, linked below, list their channels in full, and our guide to working in the Gulf from Sri Lanka explains SLBFE registration and fees. The SLBFE Employment and Welfare officer at the Sri Lankan embassy or consulate can help you prepare and follow up a complaint. If the agent who sent you is in Sri Lanka, or the money went to a Sri Lankan account, the Sri Lankan channels above also apply.
- UAE: the MOHRE app or website, or the Labour Claims and Advisory Centre on toll-free 80084; u.ae lists the signs of labour and visa fraud [42], [43], [39]
- Saudi Arabia: HRSD's amicable settlement service through Qiwa or the unified number 19911; domestic workers through Musaned [44], [45]
- Qatar: the Ministry of Labour's Unified Complaints and Disputes Platform; 16505 for fraud or requests for unofficial payments [46], [49]
- Oman: the Ministry of Labour's free labour complaints e-service or 80077000 [50]
- Kuwait: the Public Authority for Manpower's labour complaint service, which is separate from reporting a violation [51], [52]
- Bahrain: Ministry of Labour complaints on 17873637 or 17873919; for exploitation or trafficking, the LMRA hotline 995 [53], [54]
- In Sri Lanka: SLBFE 1989 and services.slbfe.lk for the agent who sent you, the police or Sri Lanka CERT for online fraud, and your Sri Lankan bank [33], [32], [36]
Before you go abroad: three checks
SLBFE says most foreign job fraud now starts on social media. Three checks cut the risk.
- The agency is on SLBFE's list of licensed agencies, and the job order is on SLBFE's job search
- You pay no more than the maximum shown for that job order, through a bank, against a receipt
- You register with SLBFE and travel on a work visa, never on a visit or tourist visa with a promise to change it later