“Avurudu Kumari” competitions become a key avenue for online scammers - Sri Lanka CERT

• A growing number of complaints involve fraudsters impersonating government institutions, public service departments, well-known supermarkets, and reputable businesses
• Urges the public to remain vigilant and follow key safety measures, including avoiding suspicious links, refraining from sharing personal or banking information on unverified platforms, and never disclosing One-Time Passwords (OTPs) to unknown parties
• These scammers promote fake offers, discounts, financial rewards, and prize giveaways to deceive unsuspecting individuals

“Avurudu Kumari” competitions have become a key avenue for online scammers targeting the public during the Sinhala and Tamil New Year season, according to a warning issued by the Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT).

It said it has observed a significant rise in social media scams and financial fraud attempts, with cybercriminals exploiting the festive period when online activity is at its peak. These scams are designed to take advantage of public trust, seasonal goodwill, and increased digital engagement.   According to Sri Lanka CERT, a growing number of complaints involve fraudsters impersonating government institutions, public service departments, well-known supermarkets, and reputable businesses.

These scammers promote fake offers, discounts, financial rewards, and prize giveaways to deceive unsuspecting individuals.  The agency further noted a surge in scams linked to “Avurudu Kumari” contests and similar promotions, where victims are tricked into sharing personal data, including photographs and other sensitive information.  

In many cases, scammers circulate deceptive links that prompt users to make payments or reveal personal and financial details. Several victims have already reported unauthorized bank transactions and financial losses as a result.   Sri Lanka CERT urged the public to remain vigilant and follow key safety measures, including avoiding suspicious links, refraining from sharing personal or banking information on unverified platforms, and never disclosing One-Time Passwords (OTPs) to unknown parties. 

Emphasizing the seriousness of the threat, the agency stressed that legitimate institutions do not request sensitive information through unsolicited messages or social media posts, and advised the public to verify all online communications through official sources before taking any action.