How to Report a Scam or Cybercrime in Sri Lanka (and Recover Your Money)
Scammed in Sri Lanka? Report fast to Sri Lanka CERT (101) and the Police CCID, and call your bank to hold the funds. There is no automatic refund, speed matters.
Quick answer: Report financial scams and hacked social-media accounts to Sri Lanka CERT through its incident portal at cert.gov.lk/report_incident or its hotline on 101 (also +94 11 269 1692). For a criminal complaint, contact the Police Computer Crime Investigation Division (CCID) of the CID on 011 238 1045. If money has left your account, call your bank right now and ask them to hold the receiving account. There is no automatic refund in Sri Lanka, so speed is everything.
What to do in 3 steps
- Call your bank immediately. Before anything else, phone your bank's fraud line and report the transaction. Ask them to flag or hold the receiving account and to stop any pending transfers. The sooner you call — ideally within minutes — the better the chance the money is still sitting in the other account and can be held. Do the same with any mobile wallet you used.
- Report it to Sri Lanka CERT and the Police CCID. For scams, financial fraud and hacked Facebook, WhatsApp or Instagram accounts, lodge a report through the Sri Lanka CERT incident portal at cert.gov.lk/report_incident or call 101. To pursue the offender criminally, contact the Computer Crime Investigation Division of the CID on 011 238 1045 (email [email protected]) or your nearest police station. You can also call the police emergency line on 119.
- Preserve every piece of evidence. Do not delete the chats, emails, links or payment messages, and do not let anyone talk you into deleting your account. Take clear screenshots showing dates, URLs, phone numbers, account numbers and transaction references before anything disappears or you are blocked.
Be realistic: Sri Lanka has no automatic refund, reversal or central freeze scheme for online fraud. Money comes back only when your bank or the police can ask the receiving bank to hold the funds before the scammer withdraws them — and that depends entirely on how fast you report. Treat the first hour as the window that matters.
How recovery actually works
There is no button that reverses a fraudulent transfer in Sri Lanka. Recovery is a manual, time-sensitive process. When you report quickly, your bank — or the police acting on your complaint — can contact the receiving bank and request that the destination account be frozen while the money is still there. If the scammer has already cashed out, often within minutes through layered accounts, there is usually nothing left to recover, which is why most stolen funds are never returned. Sri Lanka CERT coordinates the technical side and can liaise with platforms and banks, while the CCID investigates and can pursue the offender under the Computer Crime Act — but that is a criminal case, not a guaranteed refund. Your single biggest lever is the gap between realising you have been scammed and the moment the bank acts on your call.
What to have ready
- Your National Identity Card (NIC) or passport for identity verification.
- The exact transaction details — date, time, amount, your account number, and the recipient's account number, name or phone number.
- Transaction reference numbers and the SMS or app confirmations from your bank or wallet.
- Screenshots of every chat, email, advertisement, profile or website involved, showing URLs and timestamps.
- Any phone numbers, social-media handles, usernames or links the scammer used.
- A short written timeline of what happened, in order.
Frequently asked questions
Can I get my money back? Sometimes, but only if you act fast. There is no automatic refund in Sri Lanka. If your bank or the police can freeze the receiving account before the scammer withdraws the funds, the money may be returned. Once it is cashed out, recovery is rare.
Should I report to CERT or the police? Both serve different purposes. Sri Lanka CERT handles the incident itself — getting a hacked account secured, taking down a fake page, advising your bank — and accepts scam and social-media reports through its portal and hotline. The Police CCID handles the criminal investigation. For a financial loss, report to your bank, then CERT, then file a police complaint.
What if I have no proof of who did it? Report anyway. Investigators can trace bank accounts, phone numbers and IP addresses that you cannot see. Bring whatever you have — even a single transaction record and one screenshot helps the case.
Sources
- Sri Lanka CERT — Report an Incident (hotline 101, +94 11 269 1692; scam and social-media reporting via the portal)
- Sri Lanka Police — official site (Computer Crime Investigation Division of the CID; emergency line 119)
- LIRNEasia — Cybersecurity Policy Considerations for Sri Lanka (incidents rose from 596 in 2019 to 4,347 in 2024, citing SLCERT|CC)
For step-by-step reporting and recovery guides covering other countries, see our cybercrime help hub.