In a country where the average citizen is squeezed for every cent of tax and every rupee of VAT, the news of $ 2.5 million vanishing into the digital ether is an insult. This is not some minor accounting error or a rounding mistake in a ledger. We are talking about nearly Rs. 750 million of public money, intended for a bilateral agreement with Australia that has reportedly been diverted through nothing more than a few fraudulent email instructions.
If the situation were not so tragic, it would be comical. In an era where even a common man needs two-factor authentication and biometric verification to move a few thousand rupees from a mobile app, we are expected to believe that a multi-million dollar State transaction was diverted because someone clicked ‘send’ on a fake email. The timeline alone is enough to raise eyebrows. The payments occurred between December 2025 and January 2026. Yet, here we are in late April, only just beginning to grasp the scale of the heist.
The Finance Ministry has followed the classic Sri Lankan playbook by appointing a Technical Investigation Committee. While the names on this committee, including Deputy Secretaries to the Treasury A.N. Hapugala and S.S. Mudalige, carrying the weight of bureaucratic authority, one must ask a fundamental question. Can a Ministry truly investigate itself with the rigour that the public deserves? When public funds are at stake, the Treasury acting as both the judge and the jury is a hard pill for the taxpayer to swallow.
The Free Lawyers’ organisation was right to take this to the Speaker of Parliament. Their letter dated 22 April highlights the vacuum of accountability that currently exists. Responsibility for public funds does not end at the desk of a junior clerk or an IT technician. It rests squarely at the highest levels of financial administration, specifically with the President, the Finance Minister, and the Secretary to the Treasury. To suggest that cyber hackers simply breached the system of the External Resources Department (ERD) and walked away with $ 2.5 million is a convenient narrative, but it is an incomplete one.
A cyber breach is a failure of infrastructure, but the release of funds is a failure of human protocol. Who authorised the transfer? What happened to the verification steps that are supposedly the bedrock of our financial system? If a fake email can bypass the entire hierarchy of the Finance Ministry, then our national coffers are essentially an open vault with a ‘Welcome’ sign on the door.
The civil society group Dinana Dakuna has hit the nail on the head by demanding a step-by-step public explanation. We do not need vague statements about cyber hackers. We need a forensic map of how this money moved. We need to know why the intended recipient in Australia did not receive the funds and why it took months for the alarm bells to ring loudly enough for the public to hear them.
The call for an independent investigation is not just a suggestion; it is a necessity for the restoration of any remaining public trust. The National Audit Office and the Committee on Public Enterprises (COPE) must be given immediate access to the ERD’s systems and the Ministry’s internal logs. An investigation conducted entirely within the walls of the Finance Ministry risks becoming a mere exercise in damage control rather than a search for the truth.
Disciplinary action against a few officials is a standard sacrificial offering in these scenarios, but it rarely addresses the rot at the core. If this was a ‘theft’ by external actors, it exposes a terrifying level of incompetence. If there was internal collusion, it represents a level of corruption that cannot be washed away by a simple internal memo.
The Government must understand that the public is tired of the ‘technical error’ excuse. We are living in a time where the State demands total transparency from its citizens regarding their income and assets. It is only fair that the citizens demand the same level of transparency when $ 2.5 million of their money disappears. We need more than a committee. We need a conviction, a recovery of funds, and a total overhaul of a system that is clearly not fit for the digital age. Anything less is just more noise.