Bank of Ceylon transactions totaling Rs. 2.869 million are disputed by a customer, while BOC says its systems suffered no security breach.
COLOMBO — A retired Army nursing officer and his family are seeking answers after Rs. 2.869 million was transferred from his Bank of Ceylon account in 30 transactions over just 14 minutes, while the state-owned bank says the transactions were authenticated and did not result from a breach of its systems.
The account holder maintains his account at BOC’s Baddegama branch. According to his family, the missing funds formed part of a Rs. 4.4 million loan obtained from the bank by pledging his pension, with the money intended to help build a home.
Between 1.24 a.m. and 1.38 a.m. on August 14, the family says 28 transfers of Rs. 100,000 each were made from the account, followed by two further transfers of Rs. 50,000 and Rs. 19,000.
Together, the 30 transactions totalled Rs. 2,869,000.
The family alleges that the transfers were unauthorised and says it contacted BOC’s hotline after receiving a succession of SMS transaction alerts. They claim they asked the bank to block the account and card, but the transfers continued.
BOC has subsequently rejected suggestions that the incident resulted from a security failure in its systems.
‘We Don’t Have a Permanent House’
The account holder’s wife said the financial impact had been particularly severe because the money had been borrowed to build a home.
“We don’t have a permanent house to live in. So we pledged my husband’s pension and obtained a loan of Rs. 4.4 million from the Bank of Ceylon itself, and that money was what had been deposited in this account. He served in the army as a nursing officer for the country and has now retired. He is now doing another job in Colombo.
“On August 14 last month, from 1.24 a.m. to 1.38 a.m., one lakh after another was deducted from his account 28 times continuously. As soon as the SMS messages came, we panicked and called the bank hotline and asked them to block the account and the card. But it did not stop. By 1.38 a.m., 28 transfers of one lakh each, plus two more transfers of 50,000 and 19,000, had drained all the money.
“The next day we went to the relevant Baddegama bank branch and told them through tears. But the bank officials only said, ‘There is nothing we can do now.’”
Her account represents the family’s version of events. The precise timing of the hotline call, what action was taken following that call and whether any transfers were processed afterwards would need to be established from the relevant banking and telephone records.
Complaints Lodged With Investigators
According to the family, an initial attempt to lodge a complaint at a local police station was unsuccessful, with officers directing them elsewhere because of the amount involved.
They subsequently took their transaction records to the Elpitiya Special Crimes Investigation Unit, where they say a formal complaint was lodged.
The family also says reports were made to the Computer Crime Investigation Division of the Criminal Investigation Department and Sri Lanka CERT.
More than a month after the incident, they say they have yet to receive a resolution or information establishing who initiated the disputed transactions or where the funds ultimately went.
BOC Says Its Systems Were Not Breached
Bank of Ceylon has since issued a public response concerning reports about transactions conducted through its digital banking facilities.
“The bank emphasises that the relevant transactions were not carried out due to any security breach, unauthorised access or technical fault in the Bank of Ceylon’s banking systems or digital banking apps.”
BOC further stated:
“The relevant transactions have been authenticated using internet banking login credentials required for such transactions and a one-time password (OTP) sent to the registered phone number.”
The bank has urged customers not to disclose usernames, passwords, OTPs, PINs, card details or other confidential banking information, and warned against clicking suspicious links received through SMS, email, WhatsApp or social media.
BOC’s statement establishes its position that its systems and digital banking application were not compromised. It does not, by itself, establish who initiated the disputed transfers or how the credentials and OTPs used to authenticate them came to be used.
Those questions remain matters for investigation.
Questions Over Fraud Detection and Emergency Response
The incident also raises broader questions about the safeguards surrounding digital banking transactions.
A central issue is whether a sequence of 30 transfers totalling nearly Rs. 2.87 million within 14 minutes during the early hours triggered any automated fraud or risk monitoring, and what action, if any, followed.
The family’s allegation that it contacted the bank while the transactions were taking place also makes the precise timeline important. Establishing when the hotline call was received, when any blocking instruction was implemented and which transactions occurred before and after that point could help determine what happened.
None of those questions, on their own, establishes that BOC was responsible for the loss.
A complete investigation would need to examine transaction and authentication records, device and account access logs, OTP delivery records, the hotline call, applicable transaction limits and the accounts that received the money.
It would also need to determine whether the incident involved phishing, social engineering, compromised credentials, unauthorised device access or another method.
Digital Security Extends Beyond Bank Systems
The dispute highlights a wider challenge facing banks as more customers move to digital services.
Technical security within a bank’s own infrastructure is one component of that protection. Fraud prevention also involves detecting unusual transaction patterns, warning customers about phishing and social engineering, providing rapid emergency-response channels and investigating suspicious activity.
Customers, in turn, have a responsibility to protect passwords, OTPs and other credentials and to avoid suspicious links and communications.
For the retired officer and his family, however, the immediate question is more concrete: what happened to Rs. 2.869 million borrowed against his pension, who initiated the transactions and whether any of the money can be recovered.
Until investigators establish those facts, the family’s allegation of unauthorised transfers and BOC’s position that its systems were not breached remain two important parts of an unresolved case.
