Sri Lanka has become the newest base for Chinese-run online scam networks fleeing crackdowns in Cambodia and Myanmar, with authorities conducting more than a dozen raids since January 2026 and arresting and deporting roughly 700 foreign nationals, most of them Chinese citizens who entered on tourist visas. Police spokesman Fredrick Wootler called it an “alarming increase of cybercrimes,” and one Colombo raid uncovered forged US Treasury documents and a fake company registration claiming a $10 billion valuation.
The networks now operate as small, mobile cells rather than the fortified compounds of Southeast Asia. American victims lost a reported $10 billion to such operations in 2024 alone, and the threat has simply changed address.
Criminal money moves toward the weakest lock. For a decade the weakest lock in this trade sat in the river towns of Cambodia and the border zones of Myanmar, where Chinese gangs built walled compounds to run romance scams and crypto fraud against victims an ocean away. Tighten one jurisdiction and the operation reappears in the next permissive one. That is the pattern, and Sri Lanka is now the next chapter.
What makes Colombo attractive is not lawlessness. It is the specific shape of its rules. A tourist visa available to nationals of more than 50 countries, a digital-nomad scheme launched in 2024, loosely enforced SIM registration, and a large, unremarkable Chinese business presence that lets new arrivals blend in. Sri Lankan police have already deported hundreds of foreign nationals this year. Almost none have been prosecuted.
The entry door was left open on purpose
Start with the visa, because the operators did. Sri Lanka’s electronic travel authorisation grants a 30-day permit to citizens of the US, UK, EU Schengen states and Australia, extendable to 270 days in total. A scam crew can arrive, work, and leave well inside legal status. The digital nomad visa introduced in 2024 widens the door further, asking only proof of $2,000 in monthly income and a $500 fee.
Jerome Fernando, who directs the Sri Lanka Police Computer Crimes Investigation Division, has warned plainly that the country “is increasingly being used as a platform for online scams targeting foreign nationals.” Most suspects, he notes, enter on short-term visas and exploit weak oversight of digital services. The SIM-card gap is one such service: registration rules require a passport or national ID, yet prepaid cards still change hands at airports with minimal checking.
The operations themselves have shed the architecture that made Southeast Asia notorious. No barbed wire, no trafficked workforce of thousands. Instead, cells of five rotate apartments every three months. One Colombo bust spanned eight rented floors of a single building — modest in footprint, serious in financing. Superintendent Kamal Ariyawansa confirmed that a Chinese syndicate behind one operation was luring Americans into a fake US investment company.
The forged paperwork seized in that raid — fake Treasury documents, a registration claiming a $10 billion valuation — tells you the targets are Western and the ambitions are large. The harder question is what Sri Lanka can actually do once it catches them.
Deportation is not the same as enforcement
Sri Lanka has the laws on paper. The Computer Crimes Act No. 24 of 2007 defines unauthorised access and computer fraud, with penalties of three to five years. A separate 2002 statute provides for sharing evidence with foreign states. The gap is between statute and capacity. Ranjith Maddumabandara, a former minister of law and order, has argued that the country’s investigative tools “have not kept pace with sophisticated cross-border cyber offences.” So authorities reach for the simpler instrument. They deport.
That choice rearranges the incentives for everyone. Sri Lanka’s government wants tourism, investment and debt relief, and dreads being labelled a cybercrime hub. Chinese networks want cheap offices and easy visas, and can re-base in weeks. Beijing’s embassy in Colombo wants the problem handled without inflaming local suspicion of legitimate Chinese projects; Ambassador Zhang Lizhong has said China “supports Sri Lanka’s efforts to pursue Chinese suspects according to law.” The financiers and landlords renting eight floors at a time, meanwhile, face almost no risk at all.
Mark Bo, who wrote the book on these compounds, spotted recruiters naming Sri Lanka on Telegram two years ago, just after Cambodia’s crackdown began. The names of the host countries change. The arithmetic underneath — cheap entry, thin policing, a fast exit — has not changed since the trade began. Tighten the lock here, and the money will find the next weak one.
Beyond the headline
The bigger picture
The move from fortified compounds to dispersed cells shows organised crime now behaving more like a cloud service than a fixed enterprise, redeploying across permissive jurisdictions on demand. Treating these networks as platforms rather than country-bound gangs shifts the task from policing specific hotspots to disrupting their global operating model and financial rails.
The power behind it
On paper, police and regulators decide how far foreign gangs can go. In practice the leverage sits with financiers and landlords profiting from high-rent office conversions and opaque tenants. While property owners and company-service providers face little risk for enabling them, syndicates can outspend enforcement and embed themselves in commercial districts.
The reach
For US regional banks, the shift creates a non-obvious exposure: monitoring models tuned to flag Cambodian or Myanmar-linked flows may read Sri Lanka as low-risk, letting mule accounts and correspondent transfers tied to Colombo move unchallenged. A small regulatory blind spot in South Asia becomes a direct vulnerability in Middle America’s retail banking.
Your exposure travels with the syndicates
With these networks relocating faster than fraud controls can be updated, the people they target need to assume the threat has moved, not gone.
- US and UK consumers
Review the US Cybersecurity and Infrastructure Security Agency guidance on phishing, romance and investment scams at cisa.gov, and tighten your email, messaging and multi-factor authentication settings this week. The forged “US company” pitch seized in Colombo is the exact lure now being run.
- Scam victims and reporters
File reports with your national portal — the FBI’s Internet Crime Complaint Center at ic3.gov or the UK’s Action Fraud — including phone numbers, domains and transaction details. Cross-border correlation is how investigators connect Colombo-routed cases that look isolated.
- Compliance and banking staff
Check whether your transaction-monitoring rules still treat Sri Lanka as low-risk. Until risk-geography lists are updated, transfers through Colombo and regional correspondent banks may clear automated screening that would stop the same flow from Cambodia.
Explainer
- Digital nomad visa
- A residence permit allowing remote workers to live in a country while earning income from abroad. Sri Lanka launched its version in 2024, requiring at least $2,000 in monthly income, a $500 fee, and offering tax exemptions on foreign income remitted through banks. The same low-verification design that attracts legitimate freelancers also offers scam crews a year of lawful presence without local employment scrutiny.
- Computer Crimes Investigation Division
- The specialist unit of the Sri Lanka Police tasked with investigating offences under the Computer Crimes Act. It can seek court orders to access computer systems and data during investigations. Its director has publicly conceded the unit is outmatched by transnational operators, a candour that explains why deportation, not prosecution, remains the default outcome.
- Computer Crimes Act No. 24 of 2007
- Sri Lanka’s primary cybercrime law, defining offences such as unauthorised access, illegal interception and computer-related fraud. Penalties run from three to five years’ imprisonment and apply where any part of the offence touches Sri Lankan systems. Drafted before crypto fraud and compound-style scam operations existed, it is now widely seen as due for amendment.
RELATED STORIES
