Travel ban imposed on five officials over USD 2.5 million cyber heist

The Criminal Investigation Department today (28) presented facts before the Colombo Fort Magistrate’s Court regarding a controversial USD 2.5 million payment made by the Treasury, which was allegedly diverted to a fraudulent party.

The payment had been issued as part of a foreign loan repayment to an Australian government institution. However, investigators revealed that the funds were transferred to a fake account after officials acted on an email sent from a fraudulent domain closely resembling the legitimate address of the institution.

According to the CID, the correct domain “exportfinance.gov.au” had been subtly altered to “exportfinance.av.com,” enabling the scam. Despite an earlier warning issued by the company responsible for maintaining the government email system, the transaction had been carried out without sufficient verification.

The CID further informed court that the payment was processed after the warning had already been received, raising serious concerns over procedural lapses and possible negligence.

In response, the court imposed overseas travel bans on five individuals attached to the Public Debt Management Office, who were directly linked to the email correspondence related to the transaction. The Magistrate also granted permission to investigators to examine their bank account details.

Investigators told court that no conclusive evidence of unauthorized access to the email system has been found so far. However, technical analysis is ongoing, including server log examinations conducted with the support of a local IT service provider, court was informed today.

The CID also revealed that inquiries are being made into whether systems in both Sri Lanka and Australia may have been compromised. International assistance has been sought from INTERPOL and the Australian Federal Police.

Court was further informed that the incident may constitute offences under several sections of the Penal Code, as well as the Computer Crimes Act and the Public Property Act.

Issuing instructions, Colombo Fort Magistrate Isuru Neththikumara emphasized the need to first establish whether a criminal offence had occurred, identify those responsible and take immediate steps to prevent similar incidents in the future and safeguard public funds.

The case is scheduled to be called again on June 3, as investigations continue.