Speed Read
- In coordinated cybercrime raids conducted within 24 hours, authorities have arrested more than 220 foreign nationals in Sri Lanka’s South.
- Since January 2026, nearly 850 foreign nationals have been arrested in connection with online fraud, cybercrime, visa violations, and illegal business operations linked to transnational scam networks.
- Police say foreign syndicates are increasingly using rented villas, apartments, hotels, and guesthouses across the island as operational bases for sophisticated digital scam centers.
- Crackdowns in Cambodia and Myanmar have displaced cybercrime syndicates into Sri Lanka, citing weak regulatory oversight, lenient visa policies, and affordable infrastructure as key drivers.
COLOMBO – Sri Lanka is facing an unprecedented surge in transnational cybercrime activity, with authorities arresting more than 220 foreign nationals in a series of coordinated raids across the Southern province within a 24-hour period, as the island increasingly emerges as an operational base for sophisticated online fraud syndicates displaced from other parts of Asia.
The raids, carried out on Monday (11) and Tuesday (12) in Midigama, Hikkaduwa, and Galle, form part of a broader nationwide crackdown that has already led to the arrest of nearly 850 foreign nationals linked to cybercrime, online financial fraud, immigration violations, and illegal business operations from January to May 2026.
The scale, geographic spread, and sophistication of the operations have intensified concerns among law enforcement officials and digital security analysts that Sri Lanka is rapidly becoming a preferred destination for regional cybercrime syndicates seeking to exploit the country’s relatively liberal visa regime, expanding digital infrastructure, and weak regulatory oversight.
Investigators say the simultaneous operations underscore a rapidly expanding pattern in which foreign cybercrime syndicates establish temporary operational hubs across Sri Lanka using rented villas, hotels, apartments, and guesthouses.
Sweeping regional crackdowns, particularly by China and the United States, have forced East and Southeast Asia’s multi-billion-dollar cyber scam syndicates to rapidly evolve and expand into new territories. Rather than dismantling the illicit industry, intensified law enforcement pressure has pushed these operations into under-governed and conflict-affected regions around the world.
Southern province raids
Police told CIR the latest operations uncovered multiple foreign-run cybercrime centers operating out of hotels, guesthouses, and rented accommodations along Sri Lanka’s southern coastline.
In Midigama, authorities arrested 33 foreign nationals, including 28 Indian nationals and five Nepali nationals, at a tourist hotel. The suspects, aged between 25 and 35, were taken into custody over allegations including overstaying visas, engaging in employment while holding tourist visas, possession of duty-free cigarettes, and offenses under Sri Lanka’s Computer Crimes Act.
In a separate operation, Special Task Force (STF) officers attached to the Akmeemana Camp raided a lodging facility in Dodanduwa, Hikkaduwa, arresting 55 foreign nationals, including 35 Indians and 20 Nepalis. Police also arrested the 43-year-old owner of the guesthouse for allegedly providing accommodation to the suspects.
Authorities seized 25 computers, 119 mobile phones, Rs. 750,000 (equivalent to $3,215) in cash, a car, and a jeep during the raid.
Meanwhile, officers attached to the Galle Police Station arrested 110 Indian nationals staying at two guesthouses. The suspects, aged between 19 and 35, were detained on suspicion of offenses linked to the Computer Crimes Act. Police seized 58 computers and 79 mobile phones during the operation.
Another 23 foreign nationals, including 19 Indians and four Nepalis, were arrested by Galle Harbour Police during raids. Officers recovered 10 computers and 32 mobile phones from the suspects, who are aged between 21 and 47.
Police said the suspects are expected to face charges related to violations of the Computer Crimes Act, visa overstays and engaging in employment while on tourist visas.
Operations reveal broader pattern
The Southern province raids came days after another major operation in Colombo.
According to Police Spokesperson and Assistant Superintendent of Police Fredrick Wootler, on May 6, officers attached to the Kollupitiya Police raided a housing complex along Sri Uttarananda Mawatha, arresting 74 Vietnamese nationals aged between 19 and 39. Police said investigations are continuing into their suspected involvement in digital fraud operations.
Simultaneously, officers from the CID’s Matara cybercrime investigation division raided a hotel in Talalla, Gandara, arresting six additional foreign nationals. The suspects, identified as Taiwanese and Chinese nationals aged between 25 and 40, were alleged to have conducting unauthorized business operations while residing in the country on tourist visas. Authorities also found foreign cigarettes in their possession.
Sri Lanka’s growing cybercrime crisis
The first major operation of the year took place on February 23 in Cinnamon Gardens, Colombo 7, where two separate raids resulted in the arrest of 21 Chinese nationals.
Weeks later, on March 16, authorities carried out coordinated raids across three hotels in Mihintale and Anuradhapura, arresting 133 Chinese nationals in what became one of the largest cybercrime-related operations recorded in the country.
The crackdown rapidly expanded nationwide.
On March 20, police arrested 77 Indonesian nationals in Kochchikade. Four days later, raids in Poddala and Kurunegala led to the arrest of 12 Vietnamese and five Chinese nationals.
On March 27, authorities conducted dual operations in Negombo, arresting 43 Chinese nationals alongside several Malaysian and Cambodian suspects.
April saw an even sharper escalation. A large-scale operation in Chilaw on April 2 dismantled a cybercrime hub involving 133 Chinese nationals, 13 Vietnamese nationals, and one Malaysian national.
Later that month, police arrested 30 suspects from China, Malaysia, and India during operations in Dungalpitiya.
The trend intensified further in May.
On May 2, police raided a location in Koswatta, arresting 37 Chinese nationals. On the same day, a landmark operation at a residential complex on Meda Welikada Road in Rajagiriya resulted in the arrest of 121 suspects from China, Myanmar, Malaysia, Vietnam, and the Philippines.
By early May, Sri Lankan authorities had arrested well over 800 foreign nationals connected to cybercrime investigations, with the majority linked to organized online fraud and digital scam operations.
Property owners warned
Police have now issued warnings to landlords, property owners, and apartment managers over the increasing use of rented premises for organized cybercrime operations.
According to police, many of the recent raids uncovered foreign nationals operating sophisticated online scam centers from luxury apartments, villas, and commercial buildings equipped with advanced computer systems and telecommunications infrastructure.
Police said many suspects had also violated immigration regulations by overstaying visas or engaging in employment while holding tourist visas. Legal action has already been initiated against several groups in coordination with the Department of Immigration and Emigration, ASP Wootler said.
Under Section 76 of the Police Ordinance, police officers have the authority to request details regarding residents occupying any household.
“Homeowners and chief occupants are required to provide information about family members, employees and temporary residents to the nearest police station,” police spokesman said.
Police warned that failure to notify police regarding changes in residency status, including arrivals and departures, constitutes a punishable offense under Sri Lankan law.
“Any foreigner who visits the country will have a valid visa and passport. These particulars are incorporated into the Department and Immigration and Emigration. Any foreigner who overstays after their valid dates commits an offence under the Immigrants and Emigrants Act, and authorities will take action against them.”
“Sri Lanka is what displacement looks like”
Digital rights advocate Sanjana Hattotuwa said the current crisis reflects a broader regional displacement of cybercrime syndicates following crackdowns in countries such as Cambodia and Myanmar.
“The crackdowns on scam compounds in Cambodia and Myanmar have not eliminated these networks. They have displaced them,” Hattotuwa said.
“Sri Lanka is what displacement looks like in practice. A liberal tourist visa regime, decent digital infrastructure, affordable accommodation, and a leasing and sub-letting framework that asks almost no questions about what tenants actually do with the property: each of these on its own is unremarkable, but together they form an operationally attractive proposition for criminal enterprises looking for somewhere to land.”
Hattotuwa noted that even the Chinese Embassy in Colombo had acknowledged Sri Lanka’s telecommunications infrastructure, geographic location, and comparatively lenient visa policies as factors driving the influx.
He said the predominance of Chinese nationals among those arrested reflects a deeper structural shift in regional organized crime rather than isolated criminal incidents.
“The predominance of Chinese nationals among those arrested is not coincidence or stereotype,” he said. “It is the leading edge of a structural shift in transnational organized crime that finds our country precisely because our legal framework can do little more than deport people back to where they came from.”
He also pointed to the growing human cost of the crisis, noting that Sri Lanka is simultaneously becoming both a host country for cybercrime operations and a source of trafficking victims.
“Even as foreign syndicates set up shop here, Sri Lankans lured by false job offers continue to be rescued from scam compounds in Myanmar. The country is now host and source of victims at the same time.”
Escaped detainees raise serious questions
One of the most alarming incidents emerged after 30 foreign nationals, including 21 Chinese and nine Vietnamese suspects, escaped from the Welisara Detention Centre, where they had been held pending deportation.
Police later re-arrested the group in Boralesgamuwa, where authorities discovered they had resumed operating an online fraud center from a rented building equipped with 10 computers, 29 iPhones, and communications equipment.
Hattotuwa said the incident pointed to severe institutional failures.
“You do not walk out of a detention center, secure a property, set up infrastructure, and reboot a scam operation by accident,” he said.
“Something inside the system enabled it. Whether that something is gross negligence, paid complicity, or some hybrid of the two will determine whether the next televised raid means anything at all.”
He cautioned that deportation alone is proving insufficient as a deterrent.
“Deportation as the only available consequence was already an embarrassment. A deportation pipeline that leaks its own detainees, and into a working scam center at that, is something worse.”
Over the past two years, authorities in Myanmar, Cambodia, Laos, and the Philippines have come under growing international pressure over scam compounds linked to online financial fraud, cryptocurrency scams, romance scams, and human trafficking operations.
As enforcement pressure increased in those countries, criminal groups appear to have shifted toward jurisdictions perceived as lower risk and less regulated.
Sri Lanka’s strategic location, comparatively low operating costs, expanding internet connectivity, and tourism-linked accommodation sector have combined to create what investigators increasingly describe as a permissive operating environment for transnational cybercrime networks.
The rapid rise in arrests during 2026 now poses mounting questions for Sri Lankan authorities over border controls, visa monitoring, property regulation, financial oversight, and the country’s broader cyber defense capabilities.
This story was written and edited by Gagani Weerakoon. She leads the editorial at the Center for Investigative Reporting (CIR).
This story was produced with support from Report for the World, a global media service strengthening local independent journalism.
