Sri Lankan banks have issued warnings to customers over a rise in phishing attacks in which hackers are believed to be using spoof websites and deceptive emails to steal online banking credentials and drain accounts.

Cybersecurity sources said the attackers typically create fake websites resembling official banking portals and send messages urging customers to take immediate action, such as resetting passwords or verifying accounts.

When users click the links and enter their usernames and passwords on the counterfeit sites, the credentials are captured by hackers, who simultaneously input them on the genuine banking platforms. In many cases, customers are then prompted to enter one-time passwords (OTPs), which are also intercepted and used to gain full access to accounts.

Once access is obtained, funds can be swiftly transferred to other accounts, often before the victim is aware of the breach.

Issuing a warning to customers, Pan Asia Banking Corporation (PABC) said users must remain alert and verify web addresses before logging in.

“Stay alert! Before entering your username and password, always check the website address,” the bank said, urging customers to use only its official online banking portal at https://online.pabcbank.com and avoid suspicious links, unknown apps and sharing OTPs.

DFCC Bank also cautioned customers against fraudulent websites, noting that scam pages often use misspelled or closely resembling web addresses.

“Always double check before entering any details,” the bank said.

Sampath Bank, in a message to customers, warned of attempts by scammers to use fake payment links, promotional offers, and social media messages to obtain banking credentials.

It advised customers not to enter login details on any external links, and to access Sampath Vishwa only via www.sampath.lk or the official mobile app.

Hatton National Bank (HNB) said customers should remain vigilant against fraudulent websites impersonating its corporate portal, adding that services should be accessed only through www.hnb.lk or official applications.

Standard Chartered Sri Lanka also alerted customers to fake websites impersonating its local domain, warning against clicking suspicious links or sharing personal banking details, and urging use of its official website or SC Mobile app.

Cybersecurity experts said multiple banks across Sri Lanka have been targeted in coordinated phishing attempts in recent days, with attackers believed to be preparing campaigns against more than a dozen financial institutions. They added that defensive countermeasures have been deployed following the initial wave of attacks.