By Hafsa Rizvi

This year, the scammer may not sound suspicious. They may sound perfectly human.

The voice on the phone knows your name. The SMS from your bank looks identical to the real thing. The delivery notification arrived right after you placed an order. The WhatsApp message from your relative feels warm, familiar, and urgent. And yet, none of it is real.

This Avurudu season, Sri Lanka enters one of its most financially active weeks of the year. And globally, 2026 has already been declared the year AI-powered fraud went fully mainstream.

What AI Scams Look Like Now
Not long ago, you could spot a scam by its bad grammar, strange formatting, or obviously fake phone number. Those days are over.

Cybersecurity researchers have documented a surge of over 1,200% in phishing attacks linked to generative AI since 2023. What used to take a scammer more than 16 hours to assemble, including a convincing message, a fake sender identity, and a targeted script, now takes under five minutes using AI tools. The result is thousands of personalised, polished attacks running simultaneously, targeting thousands of people at once.

The messages no longer have spelling mistakes. The voices no longer sound robotic. And the stories are no longer generic. They are built around you.

Voice cloning technology can now replicate a person's voice using as little as three seconds of audio. That means a scammer who finds a short video of your sibling, your boss, or your bank's customer service representative on social media has everything they need to call you and sound exactly like them. According to 2026 research, one in four Americans has received a deepfake voice call in the past year alone. That figure is almost certainly rising in Asia.

How Scammers Use the Festive Rush Against You
April is the perfect hunting season for digital fraud. Here is why: during Avurudu week, people are receiving more messages than usual. Delivery confirmations, bank payment alerts, e-commerce order summaries, promotional offers, and family group forwards all compete for your attention at the same time.

This is exactly the environment scammers engineer for. They know that during high-traffic periods, people process messages faster, think more emotionally, and verify less carefully. The festive mood lowers defences. The urgency of celebrations shortens patience. A fake "your package could not be delivered" SMS on a normal Tuesday might get a second look. The same message arriving during New Year shopping week, when you genuinely have three orders in transit, is far more convincing.

Scammers also exploit the increased financial activity of the season. Fake payment confirmations, fraudulent "Avurudu offer" links, and impersonation of well-known local stores have all become documented tactics. AI makes them faster to produce and harder to distinguish from the real thing.

Five Red Flags Every Reader Should Know
1. It creates urgent pressure to act immediately. Whether it is a missed delivery, a suspended bank account, or a "limited time" prize claim, the goal is to make you act before you think. Legitimate institutions give you time. Scammers cannot afford to.
2. The message asks you to click a link or call a different number. Real banks, real delivery companies, and real government offices will never redirect you to an unverified link or ask you to call a number embedded in a text message. Always go directly to the official website or the number printed on your card.
3. The caller sounds familiar, but the request is unusual. AI voice cloning means the voice you hear may genuinely sound like someone you know. If someone who sounds like your relative or colleague is asking for money, a transfer, or personal information over the phone, hang up and call them back on a number you have saved yourself.
4. The communication knows personal details about you. This actually makes the scam feel more legitimate, but it should raise, not lower, your suspicion. AI systems scrape publicly available data from social media, leaked databases, and online activity to personalise attacks. A message referencing your recent purchase, your employer, or your neighbourhood is not proof of legitimacy. It is proof of research.
5. Payment is requested through an unusual channel. Bank transfers to unknown accounts, gift card redemptions, cryptocurrency payments, or requests to "confirm your details" via WhatsApp are not how legitimate businesses operate. If the payment method feels unusual for the context, stop immediately.

Before You Click Any Payment Link
Even if a link looks legitimate, take thirty seconds before you act. Check the URL carefully. Official Sri Lankan banks and institutions will use their verified domain names, not variations or shortened links. If the message came through WhatsApp or SMS, that alone is not a guarantee of authenticity.

When in doubt, do not use the link at all. Open a new browser tab, type the official website address directly, and log in from there. For bank-related concerns, call the number on the back of your card or visit a branch.

Never share OTP codes with anyone, including someone who claims to be from your bank's fraud department. Banks do not ask for OTPs to verify your identity. That request, regardless of how professional it sounds, is a scam.

A Family Safety Checklist for Parents and Elders
The people most frequently targeted by AI-enhanced scams are those who are less familiar with how these technologies work. If you have parents, grandparents, or older relatives in your household, share this checklist with them before the New Year celebrations:

• If you receive a call asking for money, even from a voice you recognise, hang up and call that person back directly.
• No bank will ever call you and ask for your PIN, OTP, or full account number. Ever.
• Before clicking any link in a WhatsApp message, even from a known contact, ask yourself whether that person would normally send something like this.
• If an offer seems too good to be true, particularly a "cash prize" or "free gift" requiring you to pay a small fee first, it is a scam.
• When in doubt, do nothing and ask someone you trust to look at it with you.

Avurudu is a season of trust, warmth, and generosity. Scammers know this, and they exploit it deliberately. The best defence is not fear but awareness. Knowing what AI-powered fraud looks like in 2026 means you are already one step ahead of the people trying to use it against you.
Stay alert. Share this with your family. And have a safe and joyful New Year.