Be warned of thieves and nuisance-makers in AI space

Pradeep Devaiah 

Since the digital space is rich with resources, it naturally draws the interested persons to hack the systems to gain an undue enrichment. Hence, hackers and modes of hacking are aplenty.3 Government institutions are hacked not only for money but also to embarrass the rulers through temporary stoppage of government activities. Hence, AKD Government which is bent on making a digital transformation of the Sri Lanka economy is correct in its action to setup an outfit that will monitor the work of the key institutions day and night and prevent cyber attackers from destroying the system

Setting up of a unit to monitor hackers

Last week, President Anura Kumara Disanayake, unveiling Sri Lanka’s National Cyber Protection Strategy 2025-9, declared open the National Cyber Security Operations Centre or NCSOC, an outfit brought into existence by the work done by Sri Lanka Computer Emergency Team or CERT and the Ministry of Digital Economy with technical support from the World Bank.1 The objective of this outfit has been to improve the preparedness of state institutions, strengthen the capacity of CERT, protect institutions that manage critical digital infrastructure, and foster collaboration with multiple stakeholders to create a secure public cyberspace. It will provide 24-hour monitoring of 37 state institutions involved in the country’s digital infrastructure such as the Departments of Immigration and Emigration, Inland Revenue, and Motor Traffic against potential cyber-attacks.

Digitisation vs. Digitalisation

This is a move in the right direction since, due to lack of data sharing and coordination among these state institutions, the public is greatly inconvenienced. For instance, to have a new car registered, the member of the public should report his taxpayer identification number or TIN to the motor vehicle registration authorities. This number can easily be learned of by accessing online to the data base of the inland revenue authorities. But this facility has not been provided and the member of the public concerned should produce a hardcopy of the certificate issued by the latter institution. 

To get that certificate, he should visit in person to the nearest IRD local office involving the time and the work efforts of officials there on one side and the time, travel expenses, and other costs involved by the member concerned. As a result, both parties stand to lose: IRD officials can use their time for strengthening the core work of the department and the member concerned for some other productive work. What his means is that digitisation-a process in which information in hardcopies is converted to digital form-is necessary but not sufficient to create an inclusive digital ecosystem. 

A further step should be taken for the digitalisation of the systems in which the digitised information is used across different sections within an organisation or across different organisations within an economy.2 This is the fundamental objective of using what is known as big data productively. If digital transformation is not allowed, digitising information in stand-alone institutions is a waste.

A man who is greedy for money is an easy target for these gangs because he would fall for any scheme that promises him instant richness. But as history has recorded, it is a common occurrence when there is economic hardships faced by people due to low economic performance of the countries concerned. This has been the main reason for Albania’s rise of pyramid schemes generating street riots with so many casualties as narrated by IMF’s Finance and Development in one of their lead stories

Numerous methods of hacking

Since the digital space is rich with resources, it naturally draws the interested persons to hack the systems to gain an undue enrichment. Hence, hackers and modes of hacking are aplenty.3 Government institutions are hacked not only for money but also to embarrass the rulers through temporary stoppage of government activities. Hence, AKD Government which is bent on making a digital transformation of the Sri Lanka economy is correct in its action to setup an outfit that will monitor the work of the key institutions day and night and prevent cyber attackers from destroying the system. 

This is a precautionary activity done by the Government to protect the government institutions from cyberspace crimes. It is a must, but it is necessary to protect other stakeholders too in an economy, namely, private businesses, and private individuals. This is where a supplementary work program is needed to make the system completely free from cyberspace crimes.

IBEX fair and conference

Last week, I met Pradeep Devaiah, Chairman and CEO of Bangalore based PDA Trade Fairs4 in Colombo who can speak authoritatively on how innocent people become victims of cyberspace criminals. He had been in Colombo with a dual purpose. One is to attend an AI related cybercrime conference in Colombo. The other is to solicit Sri Lankan banks’ participation in his flagship annual trade fair and conference for Indian Banking, Financial Services, and Insurance or BFSI Sector organised for IBEX India which has been organising trade fairs and conferences since 2011 to bridge and banking and BFSI sector technology.5 The adoption of advanced technology is a must for both the survival and prosperity of the institutions in this sector.6 In this context, the annual fair and conference of BFSI sector, tagged as the 13th edition of Ibex India, is to be held in April 2026 in Mumbai, India. 

This event will provide a platform for Indian and South Asian bankers to source information, gain knowledge, share experiences, and learn of cutting-edge technology and products to deliver efficient banking services to customers in the present era of digital transformation of banks and financial service institutions. There is an advisory committee set up to guide the organisers as to how this fair and conference should be held. It is made-up of leading Indian bankers and headed by reputed banker CHSS Mallikarjuna Rao, former MD and CEO of the Panjab National Bank.7 

Devaiah tells me that the organisers welcome participants from other countries to enrich the knowledge dissemination process through cross-fertilisation of new ideas. Hence, in my view, it is good opportunity for Sri Lankan banks and insurance companies to have a foot stand in the technologically growing Indian marketplace.

AI and inequality

Devaiah tells me that technology, specifically AI technology, is being used by cyber thieves to capture technologically illiterate people to siphon off the moneys they have. This puzzles me because this is the first time I am being told that AI is being used by cyber thieves to steal money from individuals. We have been told about stories of cyber hackers attacking computer systems of large organisations, including government websites, and demanding ransoms to allow them to start operations again. Also, another undesirable side effect of AI, we are being told, is how it will have undesired consequences on income distribution and poverty levels of national economies.

A study by Emma J. Rockel, Marina Mendes Tavares, and Carlo Pizzinelli, all attached to the International Monetary Fund, and released in April 2025 under the title AI Adoption and Inequality says that AI may reduce income inequality between the high wage earners and low wage earners by displacing the former and delivering a part of productivity gain to the latter, it is surely in favour of capital earners as against the labour earners.8 Hence, the continued embracing of AI for digital transformation will create social chaos in both developed and emerging economies. I ask Devaiah how AI victimises the technologically illiterate and hit their pockets.

Impersonation through AI

‘AI techniques are now available to tech savvy hardcore criminals’ he says. ‘They can create videos with other people exactly copying their voices and you may have seen such videos being circulated and shared about leading politicians’. This is true and there are many such AI generated videos being circulated. There was a report of a fake AI generated Donald Video released by cyber criminals promoting a hotel investment scheme which had duped even a young lawyer, a smart Gen Z man, in India.9 This was a technologically literate educated person. But how could they victimise technologically illiterate people? I ask Devaiah. ‘Their modus operandi is very smart. They contact an old father or a mother whose son or daughter are not with them, possibly outside the country. It is a video call in which the daughter pleads with the mother or father that she is in great difficulty, perhaps she has been met with an accident, and asking them to send some money to an account nearby so that she could get out of the predicament. The old father or mother believing that it is their daughter who is speaking decides to send money promptly without verifying the story being told to them. They lose their money and that is the end of the story’.

Devaiah tells me that technology, specifically AI technology, is being used by cyber thieves to capture technologically illiterate people to siphon off the moneys they have. This puzzles me because this is the first time I am being told that AI is being used by cyber thieves to steal money from individuals. We have been told about stories of cyber hackers attacking computer systems of large organisations, including government websites, and demanding ransoms to allow them to start operations again. Also, another undesirable side effect of AI, we are being told, is how it will have undesired consequences on income distribution and poverty levels of national economies

Use of voice communication by cyber criminals

I was told a similar story by a senior banker in Sri Lanka. This has happened to parents in Kurunegala area. Their daughter had been studying at the university and suddenly they had got a call from her, possibly her voice has been imitated via AI techniques, and told the unsuspecting father that he had suddenly fallen ill and being admitted to hospital. There had been an expensive drug to be purchased from the pharmacy, and she had told her father that the pharmacy man had agreed to deliver it to hospital promptly if money had been remitted to him. They were to deliver money via a system being operated by a high-tech mobile phone company in Sri Lanka.

The poor father, without seeking to verify the matter, had sent the money promptly and that had been the end of his money. His daughter had never given him a call, and it had been a fake event. The senior banker told me that there had been many other unsuspecting people who had been victimised by this gang.

Greed and vulnerability

Another banker told me of a story like the duped lawyer in India. In this case also, voice communication had been used. An old, retired government teacher had been contacted by someone on the phone to be told that if she invested 100,000 rupees in a money growing scheme, she would get interest of Rs. 3,000 daily. They had asked her to debit her account via internet banking and remit money to an account number they had provided. This lady had done exactly as she had been told, and she had not heard anything about this lucrative investment thereafter. According to the banker, there had been many others who had been victimised in this manner. 

In another story that was told to me by one of my former colleagues who is now in retirement and living on his pension, these cyber criminals had tried to collect a ransom from him by threatening that they are calling from the Police and there had been a person in custody who had spelled the bean implicating my colleague for a drug transaction. The caller had asked him to pay something immediately to have this evidence erased. Fortunately, my colleague had spoken to someone in the Police Department, and he had been advised not to act on that call because there had been many other instances of playing the same game by these people. He had been advised to lodge a complaint with the Police, but he had decided not to do so in fear of any future reprisal by this gang. I trade this information with Devaiah. He confirms that similar things are happening daily in India. Some stories are horrible because the drug mafia had been very active in devising various schemes to rid people of the moneys they have. The number of cases is so high that even the Police cannot tackle them then and there to protect the gullible people.

Role of government

I ask Davaiah how to prevent it if we cannot eliminate it altogether. He says: ‘The first thing that we should do is educating people by revealing these stories as and when they happen. The best method is to use the social media by revealing these stories in the form of catchy posters. It will go to the heads of people more easily than the conventional print or digital media. Then, the government should give the same importance to these gangs in the same way they seek to protect government institutions from potential hackers. There should be special digital investigation units which in every Police station which could conduct investigations promptly and apprehend the culprits. The court system should also be reorganised to hear these cases without delay and pass the sentences immediately. This is like fighting drug wars by governments. If narcotic is a menace, this is a bigger menace because it is normally poor people who are victimised.’

Desire to gain quick richness

I agree with Devaiah. But it will not be a success so long as people are driven by greed. A man who is greedy for money is an easy target for these gangs because he would fall for any scheme that promises him instant richness. But as history has recorded, it is a common occurrence when there is economic hardships faced by people due to low economic performance of the countries concerned. This has been the main reason for Albania’s rise of pyramid schemes generating street riots with so many casualties as narrated by IMF’s Finance and Development in one of their lead stories.10

So, it is a matter for governments to take effective action to apprehend such con artists who go by the dictum that if they do not cheat people, someone else would do so.

References:

1https://www.ft.lk/front-page/Govt-opens-National-Cyber-Security-Operations-Centre/44-781964

2https://www.sap.com/sea/products/erp/digitization-vs-digitalization.html#:~:text=Digitisation%20took%20off%20with%20twentieth,and%20reliability%20of%20modern%20life.

3https://www.geeksforgeeks.org/computer-networks/types-of-hacking/

4https://pdatradefairs.com/

5https://ibexindia.com/

6Wijewardena, W A, 2015, Innovation and Creativity: A must not only for survival but also for prosperity, Association of Professional Bankers. Sri Lanka, available at: https://apbsrilanka.com/wp-content/uploads/2021/01/2015_27th_conv_a_3_W.A.Wijewardena.pdf

7https://ibexindia.com/advisory-committee.html

8https://www.elibrary.imf.org/view/journals/001/2025/068/article-A001-en.xml#:~:text=This%20is%20driven%20both%20by,(if%20decreasing%20at%20all).

9https://www.hindustantimes.com/india-news/how-ai-generated-video-of-donald-trump-duped-a-karnataka-lawyer-of-5-93-lakh-details-101748274008281.html

10https://www.imf.org/external/pubs/ft/fandd/2000/03/jarvis.htm

(The writer, a former Deputy Governor of the Central Bank of Sri Lanka, can be reached at [email protected].)