Sri Lanka has a route that can order your money back and a route that can get a scam page taken down, and neither of them is a police portal — because there is no working online police complaint channel. The online forms that turn up in search results are broken. Plan for a visit to a station.
Your bank, first and in writing
Complain to the bank, finance company or payment provider immediately. This is not just good practice: the Central Bank will not look at your case until the provider has had it. The provider has twenty-one days to respond.
The Central Bank can direct a refund
The Financial Consumer Relations Department at the Central Bank takes complaints on 1935, at [email protected], and through cbsl.gov.lk/en/fcrd. Under the 2023 financial consumer protection regulations it can direct a provider to refund you, and that direction binds the provider. For money lost through a licensed institution, this is the strongest card you hold.
Three limits, all worth writing down. You have one year from the provider’s response to escalate. The department will not touch a matter older than three years. And if either side goes to court, it stops.
One thing the regulations do not give you: an India-style rule where reporting within a set number of days makes your liability zero. There is no such window in Sri Lanka. What you are owed depends on your provider’s terms and on whether the loss was their failure — which is exactly why the written complaint and its date matter.
The police report means going in person
Report at your nearest police station; 119 for an emergency. The advertised online complaint services on the police domain do not work — both of them return an error page — so a physical visit is unavoidable for a criminal complaint. Note also that the old police.gov.lk website no longer loads; the current site is police.lk, though the old email addresses still work.
The CID’s computer crime division can be reached at [email protected] and on 011 2381058. Its remit is social-media and content abuse rather than investment fraud, so match your complaint to the right desk or it will be handed on.
SLCERT, for the site itself
The national CERT takes reports on 101, at [email protected], and at cert.gov.lk/report_incident. It has real takedown reach with platforms and providers, which the police station does not. It cannot recover money. Use it for the fake page, the cloned profile or the compromised account, in parallel with everything else.
The trap that turns a victim into a defendant
Two local patterns deserve naming. The first is money-mule recruitment: a stranger offers a few thousand rupees to open a bank account in your name, and two months later the police arrive, because your account was the one the fraud passed through. The second is worse — under the Banking Act, someone who was drawn into a pyramid scheme and then recruited their own friends can be prosecuted rather than treated as a victim. If that is your situation, get legal advice before you file anything.
What to have ready
Your NIC, the transaction references and dates, the receiving account details, screenshots of every message with the sender visible, and the written complaint you sent the provider with the date it was sent.
And the page
Whoever hosts the site and whoever sold its domain name can remove it, usually the same day, if you send them the exact address and a screenshot. That is a separate message from any of the above and often the only one that produces a visible result quickly.