{"id":18431,"date":"2026-04-28T07:47:16","date_gmt":"2026-04-28T07:47:16","guid":{"rendered":"https:\/\/srilanka.factcrescendo.com\/english\/?p=18431"},"modified":"2026-04-28T07:47:17","modified_gmt":"2026-04-28T07:47:17","slug":"a-financial-scam-operating-under-the-name-of-srilankan-airlines","status":"publish","type":"post","link":"https:\/\/srilanka.factcrescendo.com\/english\/a-financial-scam-operating-under-the-name-of-srilankan-airlines\/","title":{"rendered":"Beware of the Fake \u201cSriLankan APK\u201d App Scam Impersonating SriLankan Airlines"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

\u00a0 Subscribe \u00a0 to \u00a0 our \u00a0 WhatsApp \u00a0 Channel \u00a0 <\/a>\u00a0\n\n<\/strong><\/p>\n\n\n\n

Information continues to be reported regarding financial frauds perpetrated in cyberspace through the impersonation of reputable institutions. Presented below is an analysis of one such organised financial scam, carried out via a fraudulent \u201cSriLankan.apk\u201d application that misuses the name of SriLankan Airlines.<\/p>\n\n\n\n

Explainer:<\/strong><\/p>\n\n\n\n

The Sri Lanka Police have issued a statement indicating that they have uncovered details of a dangerous financial fraud being carried out through \u201c.apk\u201d files currently circulated via WhatsApp and Telegram. These files, which are often sent to users disguised as wedding invitations, electricity bills, or raffle tickets, appear to be images or PDF documents. However, once opened, they install malicious software onto the device. Through this, hackers are able to gain control of the phone\u2019s screen and access SMS messages.<\/p>\n\n\n\n

Through this method, perpetrators are able to obtain confidential one-time password (OTP) codes associated with bank accounts. In light of these risks, the Sri Lanka Police has advised the public to refrain from downloading or opening suspicious \u201c.apk\u201d files received from unknown sources, even if they appear to originate from acquaintances.<\/p>\n\n\n\n

The public is further urged to install applications exclusively through trusted platforms such as the Google Play Store or the Apple App Store, and to ensure that the \u201cInstall Unknown Apps\u201d option is disabled within device settings. If you are caught in such a fraud, immediately suspend your bank accounts and inform the nearest police station or the Computer Crime Investigation Division of the Criminal Investigation Department. The relevant announcement is declared here<\/a>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Furthermore, the Sri Lanka Police has issued a statement indicating that an individual engaging with users via WhatsApp, falsely claiming to represent a service of SriLankan Airlines, directs users to one of several fraudulent websites, namely https:\/\/srilankan.wuozgo.cc<\/a>, https:\/\/srilankan.vaco.cc<\/a>, and https:\/\/srilankan.krgo.cc<\/a>, through which a malicious mobile application titled \u201cSriLankan.apk\u201d is installed on their devices. It has further been revealed that this application functions as a banking Trojan, facilitating an organised scheme of financial fraud.<\/p>\n\n\n\n

It has been observed that, upon installation of this application, the perpetrators are able to obtain remote access to affected mobile devices, thereby enabling the exposure and compromise of sensitive data stored on those devices.<\/p>\n\n\n\n

It has been discovered that these fraudsters are obtaining One-Time Password (OTP) codes, bank account details, and authentication data (including fingerprints and facial recognition) through the \u201cSriLankan.apk\u201d application, and subsequently transferring funds to other bank accounts via unauthorised transactions. It has also been identified that multiple WhatsApp numbers are being used in this process, and the relevant contact numbers provided in the notification issued by the Sri Lanka Police are set out below.<\/p>\n\n\n\n

Phone numbers: <\/p>\n\n\n\n

077 – 4558361<\/p>\n\n\n\n

011 – 7771979<\/p>\n\n\n\n

074 – 1142208<\/p>\n\n\n\n

077 – 5791209<\/p>\n\n\n\n

074 – 3268200<\/p>\n\n\n\n

The full announcement is found here<\/a>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Reports were also made through the mainstream media regarding the related smuggling. Those media reports are located here<\/a>, available here<\/a>, and here<\/a>.<\/p>\n\n\n\n

SriLankan Airlines<\/strong><\/p>\n\n\n\n

In a statement issued in this regard, SriLankan Airlines stated that it has identified fraudulent activities conducted by certain individuals impersonating staff members via WhatsApp and direct telephone calls. It has been reported that these fraudsters have induced users to install mobile applications on their devices and have subsequently requested the disclosure of sensitive financial information, including one-time passwords (OTP), bank PINs, and credit card details. The statement further clarifies that SriLankan Airlines does not contact customers via WhatsApp, nor does it make telephone calls for ticketing, promotional activities, or any other purpose. It is further emphasised that SriLankan Airlines never requests confidential information such as one-time passwords (OTP), bank PINs, or credit card details, and does not instruct customers to install any mobile applications. SriLankan Airlines requests customers to use its official website www.srilankan.com<\/a> only. The full announcement is here.<\/a><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Sri Lanka Computer Emergency Response Forum (SL CERT)<\/strong><\/p>\n\n\n\n

The Sri Lanka Computer Emergency Readiness Team<\/a> (SL CERT) has issued a notice on its official Facebook page, warning that a fraudulent message is currently circulating on social media claiming to offer discounted flight tickets.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

How the SriLankan.apk financial scam works<\/strong><\/p>\n\n\n\n

Scammers contact you via a WhatsApp message or a phone call. They present themselves as official employees of SriLankan Airlines.<\/p>\n\n\n\n

They build your trust by making attractive promises like special discounts on flights, promotional offers, ticket assistance, or cashback.<\/p>\n\n\n\n

Users are redirected to fraudulent websites controlled by the perpetrators (e.g., srilankan.wuozgo.cc<\/a>, srilankan.vaco.cc<\/a>, srilankan.krgo.cc<\/a>), under the pretext of providing additional information or special offers. From these sites, users are instructed to download and install a software application titled \u201cSriLankan.apk\u201d on their mobile devices.<\/p>\n\n\n\n

Once the software is installed, it requests permission to access messages and files, and to enable remote control of the device. Upon granting these permissions, fraudsters gain the ability to remotely operate the phone.<\/p>\n\n\n\n

The application functions as a \u201cbanking Trojan,\u201d covertly extracting banking application credentials, passwords, and other sensitive financial data.<\/p>\n\n\n\n

Even in the absence of any active banking transactions by the user, the perpetrators are able to gain access to the account and, through this application, directly intercept one-time password (OTP) codes received on the device. Ultimately, they covertly transfer funds from victims\u2019 bank accounts to other accounts without authorisation.<\/p>\n\n\n\n

Rise of APK-Based Scams<\/strong><\/p>\n\n\n\n

APK scams are a growing cybercrime trend where attackers trick people into installing Android app files (APKs) from untrusted links instead of official app stores.<\/p>\n\n\n\n

Typical pattern<\/strong><\/h3>\n\n\n\n