An alleged BOC mobile banking fraud saw Rs. 2.87 million drained from a retired Army nursing officer’s account in just 14 minutes.
COLOMBO — Nearly Rs. 2.87 million was allegedly transferred from a retired Army nursing officer’s Bank of Ceylon account through 30 transactions completed within just 14 minutes, leaving his family without money they say had been borrowed to build a home.
The transactions allegedly took place between 1.24 a.m. and 1.38 a.m. on August 14 through the Bank of Ceylon’s mobile banking system.
According to the account holder’s family, Rs. 2,869,000 disappeared from the account despite their attempt to contact the bank after receiving a succession of SMS transaction alerts.
The money formed part of a Rs. 4.4 million loan obtained from BOC by pledging the retired officer’s pension, his wife said. The couple had intended to use the loan to build a permanent home.
More than a month later, the family says it is still awaiting a resolution.
30 Transactions in 14 Minutes
The retired military nursing officer, who now works in the private sector in Colombo, maintained his account at BOC’s Baddegama branch.
His family alleges that 28 transfers of Rs. 100,000 each were made consecutively during the 14-minute period.
Two additional transactions of Rs. 50,000 and Rs. 19,000 followed, bringing the total allegedly transferred to Rs. 2,869,000 across 30 transactions.
The account holder and his wife became aware of what was happening after receiving repeated SMS notifications on their phone.
They immediately contacted the Bank of Ceylon hotline and asked for the account and card to be blocked, according to the family. They allege, however, that the transfers continued.
The Morning Telegraph has not independently established how the transactions were authorised or whether the account, mobile banking credentials or another element of the banking process had been compromised.
‘We Don’t Have a Permanent House’
Describing the impact on her family, the retired officer’s wife said the missing money had been borrowed specifically to build a home.
“We don’t have a permanent house to live in. So we pledged my husband’s pension and obtained a loan of Rs. 4.4 million from the Bank of Ceylon itself, and that money was what had been deposited in this account. He served in the army as a nursing officer for the country and has now retired. He is now doing another job in Colombo.
“On August 14 last month, from 1.24 a.m. to 1.38 a.m., one lakh after another was deducted from his account 28 times continuously. As soon as the SMS messages came, we panicked and called the bank hotline and asked them to block the account and the card. But it did not stop. By 1.38 a.m., 28 transfers of one lakh each, plus two more transfers of 50,000 and 19,000, had drained all the money.
“The next day we went to the relevant Baddegama bank branch and told them through tears. But the bank officials only said, ‘There is nothing we can do now.'”
That account represents the family’s version of events. A response from the Bank of Ceylon was not included in the material provided for this report.
Complaints Lodged With Investigators
After approaching the bank, the family says it attempted to lodge a complaint with the local police.
According to their account, police officers directed them elsewhere because of the amount involved.
They subsequently took the transaction records to the Elpitiya Special Crimes Investigation Unit, where they say a formal complaint was lodged.
Reports were also made to the Computer Crime Investigation Division of the Criminal Investigation Department and Sri Lanka CERT, according to the family.
Despite those complaints, the family says it has yet to receive information identifying who was responsible for the transactions or establishing the ultimate destination of the money.
Transaction Pattern Raises Security Questions
The unusual sequence of transactions raises important questions about how the transfers were processed and what safeguards applied to the account.
Among the questions requiring clarification are:
- Fraud monitoring: Did BOC’s monitoring systems flag 28 consecutive Rs. 100,000 transfers occurring within minutes during the early hours of the morning, and if so, what action was triggered?
- Transaction limits: What daily or individual transfer limits applied to the customer’s mobile banking account, and how were transactions totalling Rs. 2.869 million permitted within 14 minutes?
- Emergency response: At what point did the family contact the bank’s hotline, what action was taken following that call, and were further transfers processed afterwards?
Those questions cannot establish by themselves that BOC’s systems failed. Determining what happened would require examination of the transaction records, authentication data, device and account access logs, the timing of the family’s call to the bank and the accounts that ultimately received the funds.
It would also need to be established whether the transactions resulted from compromised customer credentials, social engineering, unauthorised access or another method.
Family Seeks Recovery of Funds
For the retired officer and his wife, the dispute has consequences beyond the immediate loss.
The money was borrowed against his pension and was intended to help the couple build a home, meaning the family says it remains liable for a loan while a substantial portion of the borrowed funds is missing.
The case now requires investigators to trace the transfers and establish how the transactions were authorised, where the funds ultimately went and whether any of the money can be recovered.
A formal response from the Bank of Ceylon on the family’s allegations, including the operation of transaction limits and the response to the hotline call, would also be necessary to establish a complete account of what occurred.
