SriLankan Airlines has openly warned Sri Lankans against what appears to be a “golden-ticket giveaway promotion” featuring glossy promotional materials that utilise the SriLankan Air logo and other branding in an attempt to trick users into clicking the links inside and harvesting their personal information. Media sources locally reported the alert and are now spreading the information on social media, reflecting the rapid proliferation of this ongoing series of airline-related scams that exploit the trusted relationship between an individual and their travel provider to steal an individual’s passport number or ID number, as well as credit card information. The Sri Lankan Mirror has reported this alert and other similar alerts that have gone viral, highlighting how quickly a single post can proliferate into thousands of individuals being duped.
The fraudulent messages have been posted via WhatsApp groups and public Facebook pages and are utilising the same visual and name as that of SriLankan Airlines to give the appearance of being legitimate – textbook examples of social engineering. The screenshots provided by the Daily Mirror and broadcasters, including the same wording and pages, show that these fraudsters are duplicating copies of their site to grow their scheme. Individuals who have been victimised were instructed to “claim” prizes by submitting identifying information or clicking on a questionable link to make a payment. A public warning has been issued by the airline: they do not request passport or National Identity Card identification numbers, one-time passwords or credit card numbers in informal chat communications.
Everyone ought to take heed: phishing and social-engineering attacks are the foremost means by which cybercriminals enter upon larger frauds. Multiple major studies indicate that the overwhelming majority of breaches or financial frauds are perpetrated through methods that attack the human open to social-engineering techniques, including emails and social-media lures; as a result of this, the volume of fraud and breaches has greatly increased due to scammers’ abilities to automate and scale their attack methods. Simply put: the more visually appealing the banner, the higher the probability it is actually bait.
This problem is not a new phenomenon. Many large companies, such as the national carrier, have continually warned the public about these tactics for a long time and have published various forms of information on how to distinguish between authentic channels used by marketers (websites, mobile applications, verified social media profiles and telephone numbers); this long-standing history is important because, after the first success of a fraudulent post, fraudsters determine just enough to alter the content, and then, indefinitely thereafter, will continue to use the original post as a basis for their subsequent fraudulent post(s) until either the monitoring or the general public exposes it. In addition, scepticism and expeditious fact-checking (i.e., confirming through particular companies or brands) are most effective at insulating oneself from becoming a victim of fraud: never click, never forward, and always confirm through authentic channels.
Practical steps for the reader when a viral “offer” goes around and you suspect that the link may be spam: – Hover over links to see what the real domain is; – Check if the link has an HTTPS and check if the airline’s site name matches exactly. – never respond with OTPs or payment information; and – When you are unsure about something, call the airline’s verified hotline or go to their official app. – If you’ve already clicked on a suspicious link, change your passwords for any accounts linked to your credit card and notify your bank and the airline about what happened so they can warn other customers. – Social media sites can also be used to report false posts. Flagging a scam can help prevent the next round of people from sharing it, so be proactive in protecting yourself from scams. Experts say sending a screenshot of the warning to your friends, without forwarding the original link, is an effective way to notify them of a scam.
The travel warning for all travelers in Sri Lanka includes holidaymakers, migrant workers, and business passengers; the simplest scams can have a devastating effect upon them. These scams can result in identity theft, drain accounts, or cause individuals to lose money due to fraudulent travel arrangements, leaving them stranded. Brands and platforms are trying to take down the fraudulent content as quickly as they can, but users remain the main line of defence. Therefore, making a moment to be careful and to verify an offer, check its URL and call the hotline provided can be the difference between a great deal and an expensive scam. If you receive a suspect message, report it to the carrier and the appropriate local authorities because if a brand goes viral for the wrong reasons, a quick and collective response is the fastest way to get back to safety.
