You must be extremely vigilant about this scam. It is highly sophisticated, and many people can easily become victims because the fraudsters have designed it to appear completely legitimate.
The scam typically begins with a WhatsApp message sent to the victim. The message claims to be from the Department for Registration of Persons (DRP) and closely resembles an official government communication. It includes official-looking telephone numbers, email addresses, and other details, making it appear authentic.
The message states:
“In accordance with the Registration of Persons Act, you are hereby officially invited by the Department for Registration of Persons (DRP) to update and verify your National Identity Card (NIC) information. This exercise forms part of a national initiative to enhance the security and accuracy of our central identity database.”
The recipient’s full name, address as stated on the NIC, and NIC number are often included in the message, making it appear even more credible and leaving little room for suspicion.
The message also provides details such as the date, time, and location for the supposed verification process, along with a list of required original documents. It further mentions biometric verification (right thumbprint) and the applicant’s signature on an official declaration. These details make the communication seem entirely legitimate.
Additionally, the message contains the name and designation of the officer allegedly sending it and states that it has been issued under the instructions of the Commissioner General. As a result, recipients often fail to realize that the website link provided in the message is fraudulent.
The most critical part of the message is the following warning:
“Failure to participate in this verification process may result in the temporary suspension of services linked to your National Identity Card. If you need to reschedule, please contact our help desk at least 24 hours before your appointment.”Many recipients receive this message at the last moment. Consequently, they immediately call the telephone number provided.That phone call is exactly what the scammers want.
Once contact is established, the fraudsters persuade victims to complete an application form and provide sensitive information, including passwords and One-Time Passwords (OTPs). Using this information, they gain access to victims’ bank accounts and steal funds without the victims realizing it.
The Sri Lanka CERT urges the public to remain alert to this scam and emphasizes that the Department for Registration of Persons does not conduct any identity verification or information validation through WhatsApp. Citizens are advised to verify any such requests directly through official government channels before taking any action.
