By The Pulseline News Desk
A suspected cyber-enabled fraud involving the Postal Department is now the subject of a widening criminal investigation, after the Criminal Investigation Department (CID) told a Colombo court that more than $626,000 intended for the United States Postal Service was instead routed into accounts belonging to an unrelated party.
Money diverted through the email system
Appearing before Colombo Magistrate Pasan Amarasena on Wednesday (22), the CID had said investigations are underway, in coordination with the Ministry of Foreign Affairs, into how $ 626,755 belonging to the Postal Department was transferred out of its intended channel and into nine different accounts.
According to the CID, the diversion had happened on two separate occasions, with the funds credited into the nine accounts via the Postal Department’s email system rather than through the payment’s proper destination — the United States Postal Service, the intended recipient of the money.
Email address outside the official channel
Central to the investigation is a detail that points toward deliberate manipulation rather than simple administrative error: the payments were processed using an email account that fell outside the official address designated by the Universal Postal Union for global postal transactions. Since international postal payments are meant to flow through a specific, sanctioned channel, the use of an unauthorised email address suggests the fraud — if confirmed — exploited a gap between the department’s internal systems and the safeguards built into the international payment process.
The Universal Postal Union sets the framework through which postal administrations around the world exchange funds and coordinate services, making its official communication channels a critical control point. An unauthorised address slipping into that process, and successfully redirecting a six-figure sum, raises immediate questions about how the breach occurred and who had the access needed to carry it out.
Digital evidence now with SLCERT
To trace how the diversion happened, the CID had said it has referred the relevant email data, server systems, and case items — including laptop computers seized as part of the probe — to the Sri Lanka Computer Emergency Response Team (SLCERT) for forensic examination. These materials are expected to be presented to the court in due course, once the technical analysis is complete.
What happens next
With the Ministry of Foreign Affairs now involved alongside the CID, the investigation appears to be taking on both a diplomatic and a criminal dimension, given that the funds were meant for a foreign postal authority. The findings from SLCERT’s forensic review of the seized devices and server data are likely to be pivotal in determining exactly how the Postal Department’s email system was compromised, and in identifying who controlled the nine accounts that received the misdirected funds.
For now, the case remains before the Colombo Magistrate’s Court, with investigators working to piece together a digital trail spanning the department’s internal systems, an unauthorised email address, and nearly two-thirds of a million US dollars that never reached its intended destination.
Leave a comment