Speed Read
- Following the recent crackdowns on international gangs engaged in cybercrimes, experts are warning against existing regulatory gaps that could attract organized cybercrime syndicates.
- The challenge is becoming even more complex as scammers are adopting artificial intelligence.
- Cyber scams could damage investor confidence and Sri Lanka’s global reputation.
- Failure to strengthen cyber defenses could threaten Sri Lanka’s economic and national security.
COLOMBO — As Southeast Asian nations intensify crackdowns on sprawling cyber scam compounds, cybersecurity experts are warning warn the possibility that Sri Lanka could emerge as an attractive alternative destination for transnational fraud networks.
Cybersecurity experts also say the challenge is becoming even more complex as artificial intelligence transforms the methods used by scammers. They say that a country cannot market itself as a digital hub while simultaneously gaining a reputation as a safe operating environment for cybercriminals.
What initially appeared to be isolated cybercrime cases is increasingly being viewed by experts as something far more concerning: the possible emergence of Sri Lanka as a new operating base for transnational cyber scam networks displaced from other parts of Asia.
Over the past five months, Sri Lankan authorities have arrested more than 1,000 individuals in connection with cybercrime-related activities, including online scams, financial fraud, cryptocurrency-related schemes and suspected scam operations allegedly run by foreign nationals.
The arrests come at a time when governments across Southeast Asia are intensifying crackdowns on sprawling scam compounds linked to online fraud, money laundering, human trafficking and organized crime. Countries such as Cambodia, Myanmar and Thailand have faced growing international pressure to dismantle criminal networks that have targeted victims around the world.
While Sri Lankan authorities describe the arrests as evidence of heightened vigilance, cybersecurity experts, intelligence analysts and legal experts claim that the growing frequency of such cases raises a broader question: Are criminal networks increasingly viewing Sri Lanka as a safe and attractive place from which to operate?
“The increasing arrests of foreign nationals linked to cybercrime operations in Sri Lanka should no longer be treated as isolated criminal incidents. It has become a dangerous and deeply organized pattern,” said Mahil Dole, a former investigation and intelligence analyst at the Financial Crimes Investigation Division (FCID).
The concern extends beyond online fraud.
Experts say if Sri Lanka develops a reputation as a destination for cybercriminal networks, the consequences could include loss of investor confidence, increased global scrutiny of the country’s financial system, reputational harm to its digital economy ambitions and broader national security risks.
A pattern, not isolated incidents
According to Dole, public attention is increasingly being directed toward apartment owners and landlords who rent their properties to suspects, while more fundamental questions remain unanswered.
“The first and most important question is this: How did these individuals enter the country, establish themselves and operate so freely within Sri Lanka in the first place?” he asked.
“Foreign nationals do not simply appear inside luxury apartments overnight. They arrive through airports, obtain visas, extend permits, lease office spaces, establish communications infrastructure, move funds and begin operations. Every one of these stages should leave a regulatory footprint.”
Dole noted that responsibility begins with immigration controls, in exercising regulatory oversight, financial monitoring and national security mechanisms rather than with private property owners who hardly have any means of knowing what activities are taking place behind closed doors.
“Sri Lanka cannot expect ordinary civilians to perform the functions of intelligence officers, cyber investigators or immigration surveillance units,” he said. “The danger arises when accountability is shifted downward because institutional systems above have failed.”
He warned that many of today’s cybercrime operations bear little resemblance to the stereotypical image of a lone hacker.
“Many of these groups function as highly organized transnational criminal cartels with international linkages, encrypted communications, financial laundering systems and sophisticated operational structures,” said Dole.
Some, he added, may have links to broader criminal ecosystems involved in online gambling, money laundering, identity theft and financial fraud.
Why Sri Lanka could be attractive
Rohan Samarajiva, chair of LIRNEasia, a Colombo-based digital policy and regulation think-tank, believes the issue is more complex than traditional cybersecurity concerns.
Based on information available so far, he noted that many of the scam operations detected in Sri Lanka appear to be targeting victims abroad rather than local citizens.
“If a crime is happening within Sri Lanka, it is not happening to the people inside Sri Lanka,” he said.
Samarajiva said these operations often rely on social engineering, fraudulent communications and deception rather than sophisticated technical attacks on computer networks.
He also suggested that perceived legal and regulatory gaps may be one factor attracting foreign criminal groups.
“Perhaps if there is such a gap in the law, they might think this is a safe place,” he said.
The perception that prosecution may be difficult, even if inaccurate, could itself be enough to make Sri Lanka appear attractive to transnational scam networks seeking new jurisdictions from which to operate.
He also noted that because of these scammers paying exorbitant prices for accommodations, the rental prices in Colombo and suburban areas have skyrocketed, thereby making it next to impossible for locals to rent houses or apartments.
Digital transformation without digital defenses?
Sithira Wanniarachchi, chair of the Colombo-based SLASSCOM Cybersecurity Center of Excellence and director of the Digital Trust Alliance, said Sri Lanka’s digital transformation has outpaced the systems designed to protect it.
“Everyone talks about digital transformation and building a digital economy, but the question is whether we have built the supporting systems around it,” he said.
“Do we have the laws, the forensic capabilities, the investigative capacity and the enforcement mechanisms required when something goes wrong?”
Wanniarachchi warned that artificial intelligence is making cyber scams more sophisticated and difficult to detect.
“Today’s cybercriminals are not necessarily breaking through firewalls or attacking networks,” he said. “The easiest target is still the human being.”
Voice cloning, AI-generated videos, automated chatbots and advanced phishing campaigns are increasingly allowing criminals to deceive victims at unprecedented scale. He noted deportation alone being an inadequate response.
“If someone enters the country and establishes a scam operation that defrauds people of millions of dollars, that is not simply an immigration issue,” he said. “It is a criminal offense.”
Perhaps his starkest warning was directed at Sri Lanka’s broader digital ambitions.
“A country cannot market itself as a digital hub while simultaneously gaining a reputation as a safe operating environment for cybercriminals,” Wanniarachchi said.
Investor confidence at risk
Meanwhile, others warn that the issue could eventually affect far more than law enforcement statistics.
Nirosh Ananda, Chief Information Security Officer of the Sri Lanka Computer Emergency Readiness Team (SLCERT) said a sustained increase in cyber scam operations could damage perceptions of Sri Lanka’s digital ecosystem.
“If this situation continues unchecked, it could affect perceptions about Sri Lanka’s cybersecurity environment and potentially undermine investor confidence,” he said.
Ananda noted that many of the foreign nationals arrested in recent operations were found to be targeting victims in overseas jurisdictions rather than Sri Lankan citizens.
“Based on information that emerged from investigations so far, many of these groups appear to be operating from Sri Lanka while targeting victims abroad,” he said.
Even so, he warned that reputational damage can occur regardless of where the victims are located.
Countries increasingly compete for foreign investment, technology partnerships and digital services contracts based not only on economic fundamentals but also on trust, regulatory effectiveness and cybersecurity resilience.
A national security and economic challenge
For Nalin Herath, former director general of Institute of National Security Studies the issue extends beyond cybercrime and enters the realm of national security.
“If Sri Lanka develops a reputation as a regional hub for cybercrime, the implications extend well beyond individual financial losses. It becomes a national security issue,” he said.
Herath noted that cybercriminal networks often exploit weaknesses in governance, financial oversight, law enforcement and digital infrastructure.
“The image projected internationally matters. Investors seek predictability, regulatory effectiveness and confidence that their data, intellectual property and financial transactions will be protected.”
Recent incidents involving major financial fraud investigations and cyber-related losses affecting institutions connected to Sri Lanka’s financial system have only intensified concerns about cyber resilience and financial sector integrity.
“When significant cyber or financial fraud incidents affect major financial institutions or entities connected to the country’s monetary system, the issue transcends criminal activity and enters the realm of economic security,” Herath said.
Can Sri Lanka prosecute foreign cybercriminals?
One of the recurring questions surrounding recent arrests is whether foreign nationals operating cyber scam networks from Sri Lanka can be prosecuted under local law.
Senior technology and digital law expert Jayantha Fernando, who was involved in drafting Sri Lanka’s Computer Crimes Act, said the legal framework provides broad jurisdiction to prosecute cybercrime offenses involving foreign nationals and cross-border activities.
“One of the key principles is that the law applies to a person committing an offense while being present in Sri Lanka or outside Sri Lanka,” he said.
Fernando noted that the law refers to a “person” rather than a citizen, meaning it applies to foreign nationals as well.
“The cause-and-effect principle is important. If an action results in an offense under the Computer Crimes Act and that offense has an impact on a computer system, service or information connected to Sri Lanka, the law can be triggered,” said Fernando, adding that the law does not require the offender and victim to be located in the same country.
His interpretation suggests that foreign nationals operating cyber scam networks from Sri Lanka could face prosecution under domestic law, provided the jurisdictional requirements of the Computer Crimes Act are met.
Raids alone not be enough
However, Police insist that authorities are actively responding.
Police media spokesman ASP Fredrick Wootler said recent enforcement operations have resulted in hundreds of deportations and increased monitoring of immigration violations.
“We always encourage foreign nationals to visit Sri Lanka and experience the beauty of our country. However, some individuals violate the provisions of the Immigration and Emigration Act by overstaying their visas or engaging in unlawful activities,” he said.
He said approximately 700 of over 1000 foreign nationals arrested during recent operations were deported by the first week of June, while many deportees have been blacklisted from re-entering Sri Lanka.
Experts argue that enforcement alone will not be enough.
“What matters most is not detection after the crime has already occurred, but prevention before these networks become operationally entrenched within the country,” Dole said.
As Southeast Asian nations intensify crackdowns on organized cybercrime syndicates, Sri Lanka faces a pivotal challenge: not merely arresting cybercriminals after the fact, but building the legal, technological and institutional safeguards needed to prevent such networks from taking root. How the country responds could determine whether it strengthens its position as a trusted digital economy or becomes an attractive destination for cyber scam operations seeking new bases in the region.
Banner Image : More than 1,000 suspects have been arrested from January to May amid a surge in online fraud investigations. The image has been generated using artificial intelligence.
This story was written and edited by Gagani Weerakoon. She leads the editorial at the Center for Investigative Reporting (CIR).
This story was produced with support from Report for the World, a global media service strengthening local independent journalism.
