The question is no longer whether customers should protect their banking credentials. It is whether banks and regulators are doing enough to protect the money entrusted to them.
Imagine discovering that hundreds of thousands of rupees have disappeared from your bank account overnight.
You contact your bank, expecting an urgent investigation, an attempt to recover the money and a clear explanation of what happened.
Instead, you are told that because a one-time password (OTP) was used, the transaction is your responsibility.
For a victim of digital financial fraud, such a response can feel like a second betrayal.
Customers undoubtedly have a responsibility to protect their passwords, OTPs and banking credentials. But that responsibility does not eliminate legitimate questions about the security systems, transaction monitoring and fraud-response procedures operated by financial institutions.
As Sri Lanka increasingly embraces digital banking, the central issue is becoming impossible to ignore: when cybercriminals exploit weaknesses across the banking and payments ecosystem, how should responsibility for the resulting losses be determined?
The OTP Trap: When Fraudsters Exploit Trust
One of the most common techniques used by digital fraudsters involves phishing messages, fraudulent links and impersonation.
A customer may receive an SMS that appears to come from a trusted financial institution. The message may warn that an account has been suspended, request urgent verification or direct the recipient to a website designed to capture banking credentials.
Some attacks exploit the way sender names are displayed, making fraudulent messages appear alongside genuine bank communications.
Once a victim enters sensitive information or discloses an OTP, criminals may attempt to transfer money before the customer realises what has happened.
This raises questions that deserve serious attention:
- What practical safeguards are banks and telecommunications providers implementing against fraudulent messages that impersonate financial institutions?
- If an account with historically modest transaction activity suddenly transfers Rs. 500,000 or Rs. 1 million within minutes, what monitoring systems are in place to detect the anomaly?
- Under what circumstances do banks delay, block or independently verify suspicious transactions?
- How quickly can a financial institution intervene once a customer reports an unauthorised payment?
- Are customers given sufficiently clear information about their rights, potential liability and available remedies?
These questions do not establish that any particular bank has failed in its duties. They identify areas in which transparent standards and accountable fraud prevention are essential.
The fact that a transaction was authenticated with an OTP should be part of an investigation. It should not automatically replace that investigation.
Mule Accounts: The Other Side of Digital Financial Crime
Fraudsters frequently move stolen funds through intermediary accounts, commonly known as mule accounts.
Some such accounts may be opened using false information. Others may belong to genuine account holders who knowingly or unknowingly permit their accounts to receive and transfer suspicious funds.
Their purpose is often to move money rapidly through multiple accounts, making it harder for investigators to identify the final beneficiaries or recover the proceeds.
This creates another set of questions for banks and regulators.
Are Know Your Customer Requirements Being Enforced Effectively?
Sri Lankan financial institutions operate under customer due diligence and anti-money-laundering requirements overseen by the relevant authorities, including the Financial Intelligence Unit (FIU).
Those requirements are intended to help institutions identify customers, understand relevant risks and detect suspicious activity.
Yet compliance must be measured by effectiveness, not merely by the completion of account-opening documents.
For example:
- Are accounts receiving unusually large deposits and immediately transferring or withdrawing those funds subjected to appropriate scrutiny?
- Can banks identify suspicious patterns involving multiple accounts and repeated rapid transfers?
- Are warning signals shared quickly enough between institutions to prevent further movement of suspected fraud proceeds?
- Are suspicious transactions reported and investigated in accordance with applicable legal requirements?
Where failures are established, responsibility should be examined at the appropriate institutional and individual levels.
However, allegations of employee complicity, corrupt internal arrangements or deliberate facilitation of criminal activity must be supported by evidence. The existence of a mule account alone does not prove misconduct by a bank employee.
What India’s Supreme Court Actually Said About Bank Liability
India offers an important comparison, although its legal position is more nuanced than the suggestion that banks must automatically reimburse every customer who loses money to an OTP scam.
In State Bank of India v. Pallabh Bhowmick, the Supreme Court of India declined to interfere with a judgment holding the bank responsible for unauthorised electronic transactions.
A decisive factor was that customer negligence had not been established. The customer had also notified the bank within 24 hours.
The Court emphasised banks’ responsibility to remain vigilant and use available technology to detect and prevent unauthorised transactions.
Importantly, it also acknowledged that customers could bear responsibility where their own negligence contributed to the loss, including circumstances involving the sharing of OTPs.
The decision therefore cannot accurately be described as establishing universal or unconditional bank liability whenever a customer is deceived into sharing a password.
India’s Reserve Bank has a separate framework governing customer liability for unauthorised electronic banking transactions.
Under that framework, the applicable liability depends on factors including the source of the failure, customer conduct and the timing of notification.
Where a loss results from customer negligence, such as voluntarily sharing payment credentials, the customer generally bears the loss until the unauthorised transaction is reported. The treatment of subsequent losses is different.
The important lesson for Sri Lanka is not that every banking fraud should produce automatic reimbursement.
It is that customer liability should be determined through clearly defined rules, proper investigation and an accessible dispute-resolution process. 2025 Supreme(SC) 87+1
India Is Also Strengthening Its Response to Mule Accounts
The Indian Supreme Court has separately addressed the growing problem of cyber-enabled financial fraud and mule accounts.
In August 2026, the Court directed authorities to strengthen procedures for dealing with suspicious accounts and the recovery of money lost through digital scams.
The measures discussed included temporary restrictions on suspicious funds, improved grievance mechanisms and procedures to facilitate restitution.
These developments reinforce the importance of coordinated action involving banks, regulators and law-enforcement agencies.
They do not mean that every account involved in a fraudulent transfer establishes criminal negligence by the bank concerned.
For Sri Lanka, the broader principle is nevertheless relevant: money moving through the banking system should trigger appropriate safeguards when suspicious patterns are detected. Finance News – Business Standard+1
What Protections Exist for Sri Lankan Banking Customers?
Sri Lanka is not operating without a financial consumer protection framework.
The Central Bank of Sri Lanka introduced Financial Consumer Protection Regulations No. 01 of 2023, covering financial institutions under its regulatory authority.
The regulations address matters including fair treatment, transparency, consumer protection and complaint handling.
The Central Bank also operates a Financial Consumer Relations Department, providing a channel for complaints concerning regulated financial service providers.
These safeguards matter.
Nevertheless, their existence does not resolve every question surrounding reimbursement for digital fraud.
Customers need to understand:
- When a financial institution can hold them responsible for an unauthorised transaction.
- What evidence a bank must consider when assessing allegations of customer negligence.
- Whether fraud-monitoring failures can affect the allocation of liability.
- How quickly disputed transactions must be investigated.
- What options are available when a customer disagrees with a bank’s findings.
Clearer, publicly accessible standards could reduce uncertainty for consumers and financial institutions alike.
The Central Bank’s consumer protection framework provides a foundation on which more specific digital fraud protections could be developed. Central Bank of Sri Lanka+1
The Profits of Digitalisation and the Cost of Financial Security
Digital banking delivers significant advantages.
Customers can transfer money, pay bills and manage accounts without travelling to a branch or waiting in a queue.
Banks also benefit from more efficient processes and reduced reliance on physical infrastructure.
But digitalisation creates risks that cannot simply be transferred to consumers without scrutiny.
As banks develop mobile applications, online payment platforms and increasingly automated services, investment in cybersecurity must be treated as a core operating responsibility.
That includes appropriate transaction monitoring, secure authentication, fraud detection, customer alerts and rapid incident-response capabilities.
The effectiveness of these systems should be assessed against measurable standards.
For large financial institutions, including the Bank of Ceylon and Commercial Bank of Ceylon, the public has a legitimate interest in understanding the protections applied to digital transactions.
This is not an allegation that either institution has committed wrongdoing or failed to comply with its legal obligations.
It is a call for consistent expectations across the banking sector.
Financial institutions that encourage customers to adopt digital services must also demonstrate that they are managing the risks associated with those services.
Reforms Sri Lanka Should Seriously Consider
A credible response to digital financial fraud should combine customer education with stronger institutional safeguards.
Three areas deserve particular attention.
1. A Clear Customer Liability and Reimbursement Framework
Sri Lanka should consider a more explicit framework governing losses from unauthorised electronic transactions.
Such a framework could distinguish between:
- Fraud caused by failures in a bank’s systems or controls.
- Fraud involving third-party compromise without established negligence by either the customer or the bank.
- Fraud where evidence establishes that the customer’s conduct contributed to the loss.
The rules should establish reporting requirements, investigation deadlines, evidence standards and mechanisms for reviewing disputed decisions.
Where a financial institution’s failure is established, customers should have a clear route to appropriate reimbursement.
2. Faster Interbank Fraud Detection and Freezing
Fraud proceeds can move rapidly between financial institutions.
Sri Lanka should examine whether existing mechanisms allow suspected fraudulent transfers to be identified and restricted quickly enough.
A coordinated, continuously available response system could improve the prospects of recovering funds.
However, account restrictions must operate within the law and include safeguards against wrongful freezing, mistaken identification and unnecessary disruption to legitimate customers.
Any expansion of freezing powers should be accompanied by transparent oversight and accessible avenues of appeal.
3. Stronger Monitoring of Mule Accounts
Banks should continually assess the effectiveness of their customer due diligence and suspicious transaction monitoring.
Potential improvements include enhanced detection of unusual account behaviour, faster escalation procedures and better coordination with relevant authorities.
Where investigations establish serious misconduct, regulatory or legal action should follow in accordance with the evidence and applicable law.
Effective enforcement requires accountability, but it must not presume that every suspicious transaction proves deliberate wrongdoing by bank staff.
Consumer Awareness Is Necessary, but It Is Not Enough
Banks frequently warn customers not to reveal OTPs, passwords or other confidential credentials.
That advice is essential.
Consumers should never share authentication codes with callers or respond to unexpected requests through suspicious links. They should also report suspected fraud to their bank immediately.
But public education cannot substitute for effective technological safeguards.
A sophisticated financial system must anticipate that criminals will use deception, urgency and impersonation to exploit ordinary human behaviour.
Security should be designed with those realities in mind.
The ultimate objective should be to prevent losses wherever possible, contain fraud rapidly when prevention fails and determine responsibility fairly through a transparent process.
Banking Trust Depends on Shared Responsibility
The relationship between a depositor and a bank rests on trust.
Customers trust financial institutions to safeguard their money. Banks trust customers to protect their credentials and report suspicious activity.
Neither side can reasonably be expected to carry every risk alone.
India’s evolving legal and regulatory response offers Sri Lanka useful lessons, but those lessons must be understood accurately and adapted to the country’s own laws and financial infrastructure.
The question is not whether customers should be excused from every mistake.
The question is whether a financial system can claim to protect depositors while leaving them uncertain about what happens when sophisticated criminals penetrate the digital banking process.
For Sri Lanka, the priority should be clear: stronger fraud prevention, rapid recovery mechanisms and fair, enforceable rules for deciding who bears the loss.
Without those safeguards, every successful cyberattack risks becoming something larger than an individual financial crime.
It becomes another reason for the public to question whether their savings are truly secure.
