If it feels like everyone you know has a scam story lately, the official numbers back you up. Here is what Sri Lanka's own authorities reported over the past two years — with links to the original coverage so you can read it yourself.
The scale of it
Sri Lanka CERT, the national cybersecurity authority, received more than 12,650 complaints about cybersecurity incidents and social media misuse in 2025 — a sharp rise on previous years, according to its Lead Information Security Engineer. The figure was widely reported, including by The Island and Newswire. The top categories: fake and hacked accounts, financial scams run through social media, and false information.
The trend was already steep. The CID's Computer Crimes Investigation Division logged 5,243 complaints in all of 2023 — and then over 1,500 complaints in just the first quarter of 2024. The same CID briefing carried two details worth sitting with: 63% of cybercrime victims are women, and roughly 200 fake Facebook accounts are reported for deactivation every day.
What the Police say the scams look like
In January 2026, Sri Lanka Police published a list of nine common online scams — and online shopping fraud is its own named category: "Fake Facebook pages or groups advertising goods for sale, where products are never delivered after payment. Sellers insisting on cash-only or direct bank transfers."
A few weeks earlier, police had issued a plainer warning about fake product listings with unrealistically low prices, citing typical advance payments of Rs. 5,000, Rs. 10,000 and Rs. 20,000 — and advice that could not be clearer: "Never pay money without receiving the product in hand."
The CID had said the same in mid-2025, warning of a surge in social-media scams that start small — a tiny deposit that shows a fake return — and escalate until victims have transferred serious money, at which point the scammers invent "customs fees" and disappear.
Even the busy seasons get their own warnings
In December 2025, CERT issued an alert about a sharp jump in scams during the festive season — fake supermarket pages, fake promotions and prize draws, even fake disaster-relief appeals. Its one-line rule applies year-round: legitimate organisations do not request sensitive information via unsolicited messages, social media posts, or online links.
What this means for your next purchase
Read the warnings side by side and a pattern emerges. Almost every shopping scam in them depends on a single moment: you sending an irreversible payment to someone you cannot verify. The fake page, the too-good price, the urgency — all of it exists to get you past that moment without thinking.
So take the officials' advice literally. Don't pay strangers in advance by bank transfer. And when an advance payment is unavoidable — a custom order, a delivery from another city — don't send it to the seller at all. With TrustPay, the money sits safely in the middle: the seller ships knowing it's real, and it's only released after you confirm the order arrived as described. If it never arrives, every rupee comes back. See how it works.