A warning has been issued regarding a sophisticated financial scam being circulated via WhatsApp, in which fraudsters impersonate the Department for Registration of Persons, the Sri Lanka Computer Emergency Readiness Team (SLCERT) has stated.

According to SLCERT, the scam messages are crafted in a highly official and convincing manner, creating a significant risk that individuals may easily fall victim.

The fraudulent messages reportedly mimic official communication from the Department, using its name, contact details and references to directives allegedly issued by the Commissioner General. The messages are sent via WhatsApp and appear to be legitimate government notices.

The message claims that, under the Registration of Persons Act, recipients are required to visit the Department for updating and verifying their National Identity Card (NIC) information, according to CERT. It also includes the recipient’s full name, NIC number, and address, adding to its credibility.

Additionally, the message provides specific appointment details, including date, time and location, as well as instructions on documents to bring and biometric verification requirements, such as a right thumb impression.

The Sri Lanka Computer Emergency Readiness Team further warns that failure to attend the verification may result in the temporary suspension of services linked to the NIC. It also instructs recipients to contact a helpline at least 24 hours in advance if they wish to reschedule.

SLCERT officials also warn that recipients often receive these messages shortly before the alleged appointment time, creating urgency and fear. As a result, victims may contact the provided numbers, where fraudsters attempt to obtain sensitive information, including one-time passwords (OTPs) and banking credentials, ultimately leading to financial losses.

SLCERT emphasized that the Department for Registration of Persons does not conduct any identity verification or official communication through WhatsApp.

The general public is strongly advised to avoid engaging with such messages, clicking on suspicious links, or calling unverified numbers. Individuals are also urged not to share OTPs or confidential banking information with any third party under any circumstances.