The Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT) has issued a public warning over a rise in sophisticated online shopping scams targeting consumers through phone calls, text messages and fake delivery services.
Sri Lanka CERT said it had received several complaints from victims who had fallen prey to scams linked to online purchases, prompting the agency to raise public awareness about the growing cyber threat.
According to the advisory, one common scam involves fraudsters contacting individuals via phone or SMS, falsely claiming that an item they had supposedly ordered is ready for delivery. The scammers often provide convincing details, including the product name, price and expected delivery time, to make the claim appear genuine.
Even when victims insist they never placed such an order, the fraudsters continue contacting them before eventually claiming that the order can only be cancelled by clicking on a link they provide. Victims are then instructed to enter a verification code displayed on their device.
Sri Lanka CERT warned that clicking the link may allow cybercriminals to gain remote access to a victim’s mobile phone or computer. In some cases, victims may unknowingly install malicious software, such as Android APK files, enabling attackers to take complete control of the device.
The agency also highlighted a more sophisticated variation of the scam, where a person posing as a delivery representative arrives at a victim’s home with a parcel. The fake courier claims an order was placed using the victim’s personal details and persuades them to cancel it by clicking on a link and providing a verification code.
By the time victims realise they have been deceived, scammers may have already accessed their bank accounts or stolen sensitive personal information, documents and files stored on their devices, Sri Lanka CERT warned.
The agency urged the public to exercise caution when shopping online and advised consumers not to click on unsolicited links sent via SMS, WhatsApp or other messaging platforms. It also warned against sharing one-time passwords (OTPs), PINs or verification codes, or installing applications sent by unknown individuals.
Sri Lanka CERT further advised consumers to verify the identity of delivery personnel and confirm orders directly with the seller through official channels. Anyone who suspects they have been targeted by such a scam has been urged to cease communication immediately and report the incident to Sri Lanka CERT or the relevant authorities.
While noting that online shopping remains a convenient and widely used service, Sri Lanka CERT stressed that greater vigilance is essential to avoid becoming a victim of cyber fraud.
