By Rathindra Kuruwita

Around 50 percent of individuals conducting online transactions in Sri Lanka are unaware of the importance of safeguarding their passwords, Gimhan Mohotti, Assistant Director at the Payments and Settlements Department, has revealed in a recent televised interview.

Mohotti also noted that about 60 percent of people do not comprehend the purpose of a One-Time Password (OTP). Furthermore, approximately 68 percent of online transaction users are unaware of the methods scammers use to compromise their online banking accounts.

Mohotti said rule number one in online transactions is that you should not share an OTP with anyone. “The other thing you have to understand is that if you get an OTP to your phone, in the context of online banking, it is someone trying to take money out of your account. If you get an OTP at a time when you have not made any transaction, alarm bells should go in your head. You are not getting an OTP when money is deposited to your account,” he said.

Mohotti said social engineering attacks are now becoming a common weapon many cybercriminals use to achieve their nefarious goals. It leverages psychological manipulation to deceive individuals into divulging confidential or personal information. “Often someone would call you, pretending to be a state institution. Often these are eloquent speakers. If I take a real life example, in recent times people pretending to be from the Pensions Department would call people and say that the Department has decided to digitalize the payment system. Then this person would ask for information under the pretext of updating their platforms. They are trying to obtain personal and sensitive information from you,” he said.

Mohotti said digital infrastructure is extremely secure and institutions invest billions in creating and maintaining state of the art digital infrastructure. They adhere to guidelines and standards. “However, this means nothing if you divulge your OTP to a third party. This is akin to buying the most secure lock and then handing the key to a thief,” he said.

Scammers often target people who collect money for medical emergencies, he said. “Let’s say I have a relative who needs a kidney transplant. I place an advert in the newspapers, or social media, asking for donations. Given that I am expecting funds from philanthropists, I have to put the name and the mobile number of the account holder, account number and the bank branch on the advert. A scammer can call me and say that they have deposited money into the account, ask if I had received a code from the bank, and he would ask me to share this number with him. This is the OTP and if I give him the OTP, the scammer can secure access to my account and he can drain it,” he said.

Mohotti said when someone becomes a victim of a scam, the first thing is to prevent further loss.

“Please call your bank and deactivate your account. Then you must go to your nearest police station and lodge a complaint if you have been scammed for less than two million rupees. If the loss is between two and 20 million, you must go to the special crimes investigation bureau at the headquarters police station closest to you.  If the scam is over 20 million you must go to the CID and the computer crimes investigation division will take over the case,” he said.