GovPay cyber security concerns focus on government websites that direct users to payments, with an expert warning of phishing and fake-link risks.
COLOMBO — Sri Lanka’s expanding GovPay digital payment network may have strong central payment infrastructure, but its wider security depends on every government website and digital route citizens use to reach it, according to a cyber security expert who has warned of risks from fake payment links, look-alike websites and phishing attacks.
GovPay was introduced to make payments for government services easier, more transparent and accessible. As the system expands, it connects banks, fintech applications, government institutions, public officials and millions of potential users.
LankaPay, the country’s national payment network, is a key technology partner in the initiative. Citizens can make GovPay transactions through participating banks and fintech applications rather than being restricted to a single payment app.
The official GovPay platform describes itself as a secure online payment service for taxes, fines, utility bills, educational fees and other government charges. It currently warns users about fraudulent traffic-fine messages and says GovPay payments should be made through official banking or fintech applications, not through payment links received by text message or other unofficial channels.
The warning raised by cyber security expert Lakmal Embuldeniya, however, focuses not on an identified breach of LankaPay’s core infrastructure but on the wider digital environment surrounding GovPay.
Government Websites Could Become the Weak Link
Even if the main payment processor remains secure, Embuldeniya argues that vulnerabilities could emerge through government websites that direct citizens towards payment services.
Members of the public may begin their transactions by visiting the website of a government department or institution. If one of those websites is compromised, an attacker could potentially replace or imitate an official payment route with a fraudulent one.
A user who believes he or she is following an authentic government payment process could then be redirected elsewhere.
In such a scenario, Embuldeniya warns, LankaPay’s underlying financial infrastructure could remain secure while a citizen is deceived before reaching the legitimate payment channel.
That distinction is important. The concern outlined in the source material does not establish that GovPay or LankaPay has been compromised. Rather, it identifies government websites and other access points surrounding the payment platform as potential attack surfaces that require their own protection.
Each government website connected to the wider GovPay ecosystem therefore becomes part of the security chain.
Phishing Is Becoming Harder to Spot
Technology is only one part of the challenge.
Government websites may be maintained by officers with differing levels of cyber security expertise, while citizens themselves must increasingly distinguish legitimate digital services from sophisticated imitations.
Modern phishing attacks are not confined to crude messages containing obviously suspicious links.
Fraudsters can construct websites designed to resemble legitimate government portals. They can also use look-alike web addresses intended to make fraudulent domains appear similar to authentic ones.
Such deception can be particularly dangerous when a citizen is trying to pay for an official service and expects to be directed from one government page to another.
GovPay itself is already warning the public about this type of threat. Its official website carries a scam alert over fraudulent messages purporting to facilitate online traffic-fine payments and advises users not to make payments through links received in messages or other unofficial channels.
Sri Lanka CERT’s published incident information also shows that phishing, website compromises, scams and financial or email frauds form part of the country’s wider cyber-threat environment.
GovPay Brings Clear Advantages
The security concerns come as GovPay continues to expand as a major component of Sri Lanka’s digital government programme.
A central payment framework can make transactions easier to trace, provide government institutions with clearer revenue information and reduce the need for individual public bodies to build separate payment gateways.
ICTA describes GovPay as a centralised digital platform intended to allow citizens to make online payments for government services while enabling public organisations to collect revenue securely, transparently and efficiently.
GovPay is supported by the Ministry of Digital Economy and implemented with ICTA and LankaPay. Its participating stakeholders also include the Central Bank of Sri Lanka, commercial banks, fintech providers and government organisations.
Official figures show how rapidly the platform has grown. By the end of 2025, GovPay had processed more than 69,000 digital transactions worth over Rs. 2 billion across 215 government institutions and 3,372 government services.
That expansion also increases the importance of protecting the wider digital environment through which citizens interact with government services.
Four Areas Need Greater Attention
Experts recommend several measures to strengthen security across the GovPay ecosystem:
- Minimum security standards: Every government institutional website connected to GovPay should be required to comply with mandatory cyber security standards.
- Continuous security testing: Websites should undergo regular vulnerability assessments to identify weaknesses before they can be exploited.
- Strict supervision of payment links: Changes to links directing citizens towards payment services should be tightly controlled and monitored.
- Training and public awareness: Government officers responsible for digital services should receive continuing technical training, while citizens need clear guidance on identifying fraudulent websites, suspicious links and other forms of digital financial deception.
Sri Lanka CERT already publishes an Information and Cyber Security Policy for Government Organisations as part of the country’s wider cyber security framework.
GovPay represents a significant shift towards faster and more transparent government payments. Its official platform says transactions are processed through the country’s regulated interbank infrastructure, while users access GovPay through supported banks and fintech applications.
As the network grows, however, the security of the central payment infrastructure is only part of the equation. Protecting public money also requires securing the government websites, payment routes and human interactions surrounding it.
The challenge, as Embuldeniya’s warning underscores, is therefore broader than GovPay itself: cyber security must operate as a whole-of-government responsibility.
Official and source links for further reading:
Source report: LankaNews – GovPay Sri Lanka Cybersecurity Vulnerabilities
GovPay official website: govpay.lk
LankaPay government payment system details: LankaPay – Government Digital Payment Platform
