The Criminal Investigation Department has arrested a 29-year-old Kompanyaveediya resident accused of running a financial fraud operation over WhatsApp using the SriLankan Airlines name, NewsFirst reported.
The arrest followed a CID investigation opened on a complaint. Officers recovered from the suspect five applications used in the fraud, 40 bank accounts and 15 ATM cards. Investigators have found that the racket was operated from a foreign country.
NewsFirst’s headline refers to the “UL brand” — UL is SriLankan Airlines’ IATA airline code, not a separate company.
Forty accounts is the significant number
The arrest is reported as a single suspect with a single complaint behind it, but the recovered material describes something larger. Forty bank accounts and fifteen cards are not the apparatus of one fraud; they are the cash-out layer of a racket designed to move money through many hands before it is withdrawn. The five applications are the front end.
That the operation was run from abroad, with the recovered banking infrastructure held locally, fits the division of labour Sri Lankan investigators have described repeatedly this year: direction offshore, collection onshore.
A warning that matches, from six months ago
The method closely resembles a scheme Sri Lanka Police warned about in April, when they told the public that fraudsters posing as SriLankan Airlines were contacting victims over WhatsApp and directing them to install a malicious application called “SriLankan.apk”. That app functioned as a banking trojan, capturing one-time passwords, account details and biometric data including fingerprints and facial recognition, and was used to move money out of victims’ accounts. Police named three impersonating domains and several phone numbers.
The resemblance is close — same brand, same messaging platform, same objective — and the April warning described exactly the kind of transfers that forty accounts would absorb. But no filing connects the two. NewsFirst does not say whether this arrest relates to that racket, does not name the applications, and does not describe how they worked. The April warning concerned one named application; this arrest involves five. They are reported here as a resemblance, not an identification.
One caution carries over from that episode. Police initially listed five phone numbers as being used by the scheme, then issued a correction after SriLankan Airlines pointed out that one of them was the airline’s own official line. Brand-impersonation cases are easy to over-attribute.
Not reported: NewsFirst does not say when or where the arrest took place, which country the operation was run from, how much money is alleged to have been taken, how many victims there are, whether the suspect has been produced in court, or whether the 40 accounts were opened in his name or others’. It does not say whether SriLankan Airlines was involved in the complaint. The photograph carried with the report is a stock arrest image from the newsroom’s 2022 library, not a picture of this case. No other verified newsroom had filed on the arrest at the time of writing — a domain-restricted search and a sweep of the Daily Mirror’s latest-news listing returned only the earlier warnings — so this account rests on a single source.
