News

No cyber hack: Fintech expert exposes shocking legacy flaws that led to $2.5 million theft

Published

1 hour ago

2026/04/24

The alleged diversion of Sri Lanka’s $2.5 million debt repayment is unlikely to be a simple “hack,” but rather a case of a compromised payment process, where weak verification layers, email-based instructions, and insufficient system segregation created an opening for fraud, a fintech expert told The Island Financial Review.

He pointed out that in cross-border public payments, especially sovereign debt servicing, transactions typically moved through multiple controlled layers: payment instruction generation, authentication, bank routing (often via SWIFT), and final settlement.

Elaborating on the matter, he noted, “For funds to ‘miss’ the intended creditor and reach a third party, one of two things must happen: either the payment instructions themselves are altered before execution, or the beneficiary details are fraudulently substituted during the approval chain. The reports I see suggest a Business Email Compromise (BEC) scenario rather than a deep, system-level cyber intrusion.”

“In such attacks, hackers gain access to or spoof official email accounts and send seemingly legitimate payment instructions with altered bank details. If Treasury officials relied on email as a trusted channel without independent verification, such as callback protocols or cryptographic authentication, the system could have been easily deceived. This is not a failure of encryption in transit; emails may still be encrypted. The failure probably lay in identity assurance and process integrity.”

When asked whether end-to-end encryption would have prevented this, he said, “Encryption protects data from interception, but it does not confirm that the sender is genuine or that the instructions are legitimate. What is required here is a zero-trust architecture, meaning every instruction must be verified independently, regardless of the source. Modern Treasury systems, including those at commercial banks, use multi-factor authentication, digital signatures, and secure payment gateways integrated directly with banking systems – removing the reliance on email altogether.”

“Another technical gap appears to be the lack of straight-through processing (STP). In well-designed sovereign payment systems, payment instructions flow directly from Treasury platforms to Central Bank or correspondent bank systems through secure APIs or SWIFT interfaces, with minimal human intervention. If manual steps, such as email confirmations or document attachments, are still embedded in the workflow, they create vulnerabilities.”

“The institutional transition of debt management functions away from the Central Bank may also have introduced operational fragmentation. If there isn’t a unified digital infrastructure and clearly defined control points, accountability gaps emerge.”

“Given that President Anura Kumara Dissanayake also holds the digital infrastructure portfolio, and with advisory leadership from Dr. Hans Wijesuriya, this incident raises questions about execution rather than intent. A country pursuing a digital economy must ensure that its most sensitive financial operations are built on secure, interoperable, and audited platforms.”

“In practical terms, a better-coordinated strategy between the Finance Ministry and digital infrastructure authorities could have enforced mandatory secure channels, real-time transaction monitoring, and anomaly detection systems. Large-value sovereign payments should trigger automated red flags if beneficiary details change or deviate from historical patterns.”

“Ultimately, this episode underscores that digital transformation is not just about adopting technology – it is about redesigning processes, enforcing trust frameworks, and eliminating legacy practices like email-based approvals. Without that, even the most well-intentioned digital agenda remains exposed to very analog fraud,” he concluded.

By Sanath Nanayakkare

All News Advertisement

News

Whistleblowers ask Treasury Chief to resign over theft of USD 2.5 mn

Published

1 hour ago

2026/04/24

Thilina Walpola

Payment made to new account number outside agreement

Civil society group ‘Free Lawyers’, which exposed the payment of USD 2.5 mn loan instalment by the Treasury to a third party instead of Australia, yesterday (23) said that in spite of the Treasury having the legitimate bank account mentioned in the relevant agreement, the payment had been made to another account subsequently received from a person who had been in contact with some senior officials.

Civil society activist Keerthi Tennakoon on behalf of ‘Free Lawyers’ emphasised that the account number mentioned in the agreement couldn’t be changed without approval of the Secretary to the Treasury Harshana Suriyapperuma, who is also the Secretary to the Finance Ministry. Suriyapperuma, who quit his National List seat to receive the top appointment, should be held responsible for the unprecedented development, Tennakoon said.

If the Treasury had followed the time-tested procedures in place, a new bank account couldn’t have been introduced, and therefore a thorough investigation was required to reveal the truth.According to Free Lawyers, the scam had been detected by relatively junior officer and not those higher ups.

Free Lawyers’ would continue to follow the developments to ensure transparency in the investigations, Tennakoon said, noting that Suriyapperuma should step down as he was aware of a third party securing root access to the system in September 2025 but failed to take action to prevent the scam. Tennakoon said that the NPPer hadn’t informed relevant authorities, and altogether 16 officials were involved in the scam.

By Shamindra Ferdinando

News

Hambantora port sets new record

Published

1 hour ago

2026/04/24

Thilina Walpola

MSC Marie Leslie at Hambantota port

Hambantota International Port (HIP) successfully handled container vessel MSC Marie Leslie, marking one of its highest-volume vessel calls to date. The achievement further strengthens the port’s position as an emerging hub for containerised cargo in the region, according to HIP press release.

The vessel, operated by Mediterranean Shipping Company (MSC), was berthed at HIP from 11 to 15 April 2026. The port achieved 7,968 container moves during this period, translating to a total volume of 13,260 TEUs; the highest single-vessel throughput recorded by HIP to date.

This latest milestone surpasses previous records, including 12,957 TEUs handled on MSC Ilenia and 11,369 TEUs on MSC Ruby in March this year, reflecting a steady upward trend in the port’s container handling performance.

News

US sinking of Iranian frigate off Sri Lanka unprecedented war crime Araghchi tells Vijitha

Published

1 hour ago

2026/04/24

Thilina Walpola

Iranian Foreign Minister Abbas Araghchi has told his Sri Lankan counterpart Vijitha Herath that US sinking of Iranian frigate IRIS Dena off Sri Lankan waters was an unprecedented war crime.

Of some 180 crew only 30 odd personnel survived.

While referring to crimes committed by the United States and Israel against Iran, Araghchi has stressed that they would never forget this crime, which constitutes a grave violation of the fundamental rules of international humanitarian law and the 1949 Geneva Conventions, and would employ all legal and political means to hold the perpetrators and those responsible accountable and bring them to justice.

Araghchi has said so during a telephone conversation with Herath regarding the ongoing West Asia conflict and related developments.

During the phone call, Araghchi expressed appreciation for the Sri Lankan government’s efforts in the rescue operation for the sailors of the IRIS Dena and for assisting in the transfer of the bodies of the crew of the vessel and other Iranian naval personnel back to Iran, according to the Iranian Embassy in Sri Lanka.

US sank Dena as it along with two other Iranian vessels awaited Sri Lanka approval to enter the Colombo port. Iranian ambassador in Colombo Dr. Alireza Delkhosh is on record as having said that the Commander of Sri Lanka Navy invited the Iranian ships to visit Colombo following their participation in International Fleet review and Milan 2026 held in India in late Feb. All Iranian vessels had been unarmed at that time in keeping with protocols regarding the participation in such events.