Sri Lanka is emerging as a possible new operational base for transnational cyber-scam networks, amid a sharp increase in raids targeting foreign nationals suspected of involvement in online fraud, according to law-enforcement data and regional analysis by the East Asia Forum (EAF).
An EAF report by Junqing Zhang, a postdoctoral researcher at Chulalongkorn University, said Sri Lankan authorities have conducted more than a dozen raids on suspected cyber-fraud operations since the beginning of 2026, arresting or deporting hundreds of foreign nationals.
Police reported in August that 1,093 foreign nationals had been arrested in cybercrime raids in Sri Lanka in 2026, compared with 573 arrests recorded throughout 2024. Several operations were carried out in western coastal areas, involving suspects from China, India and other Southeast Asian countries.
The increase comes amid intensified crackdowns on large-scale scam compounds in Cambodia, Myanmar, Thailand and Laos, many of which have been linked to Chinese-speaking criminal networks.
However, the EAF analysis cautioned that the increase in cyber-scam activity in Sri Lanka does not by itself establish that criminal networks have relocated directly from Southeast Asia. Sri Lanka could instead be emerging as one of several destinations in a broader regional displacement of cybercrime operations.
The mobility of such networks was highlighted in April, when Sri Lankan authorities intercepted nine Chinese nationals arriving from Kunming who were reportedly carrying hundreds of electronic devices. This followed another operation in which more than 150 foreign nationals were detained over alleged online fraud.
The report noted that smaller, decentralised scam teams operating from multiple locations are becoming increasingly difficult for authorities to detect and dismantle.
It identified factors such as tourist and digital-nomad visa access, relatively low accommodation and office costs, telecommunications infrastructure, established cross-border financial networks and Sri Lanka’s location between South and Southeast Asia as potentially facilitating temporary operations.
The analysis also highlighted the need for stronger coordination between immigration authorities, financial investigators, telecommunications regulators and cybercrime units to identify the organisers and financial networks behind such operations, rather than focusing only on frontline arrests.
