As Cambodia Cracks Down, Cyberscam Networks Test Sri Lanka

Sri Lanka’s beach towns and apartment blocks are not the first places one associates with Southeast Asia’s cyberscam epidemic. But recent arrests of foreign cybercriminals suggest that scam networks, increasingly pushed out of Cambodia and other Southeast Asian hubs, are now testing Sri Lanka as a new base.

This, however, does not mean Sri Lanka has replaced Cambodia as the region’s main haven for cybercriminals. Cambodia’s scam economy grew over several years, drawing strength from casinos, real estate, tycoon networks, weak enforcement, and political protection. Sri Lanka is not there yet, but recent detections show that thousands of foreign cybercriminals have arrived at this Indian Ocean island.

Sri Lankan authorities have arrested more than 1,000 people this year in connection with suspected cyberscam operations, many of them foreign nationals. Some raids have taken place in coastal areas popular with tourists, while others have taken place in apartment buildings and properties near Colombo. In one April raid on the west coast of the island, police found more than 150 foreign nationals allegedly running a cyberscam operation. Days later, another raid near Colombo led to the arrest of about 120 foreign nationals. In May, 221 foreigners were arrested in the Southern Province.

In Sri Lanka, it is impossible to operate remote jungle compounds, given that the state has control over the entire territory, which drew global attention to Cambodia and Myanmar.

Criminals have chosen less conspicuous locations on the island where it’s easy to blend in, where the presence of foreign nationals will not raise questions. They have rented houses, hotel spaces, apartment blocks and office buildings that can be occupied quickly, wired for operations, and abandoned when police pressure increases. Many tourists come to Sri Lanka in groups and Sri Lankans are used to seeing large number of them renting out properties together. This gives scam networks mobility and makes them harder to detect.

But why are cybercriminals moving into Sri Lanka? Chief Information Security Officer at Sri Lanka Computer Emergency Readiness Team (SLCERT), Nirosh Ananda, said a combination of harsh action against cybercriminals in Southeast Asia and China as well as Sri Lanka’s lax visa rules are the main reasons driving this influx.

Cambodia, one of the region’s most notorious centers for online fraud is cracking down on cybercriminals following Chinese and U.S. pressure. Online scam networks have stolen trillions of dollars from victims across the world. They have also relied on trafficked workers, many lured by fake job offers and then forced to defraud strangers online. Following international pressure, Cambodian officials have targeted hundreds of suspected scam locations, shut down most of them, opened legal cases against alleged ringleaders and associates, and repatriated thousands of foreigners.

However, one must not forget that Cambodia’s scam industry did not grow because foreign criminals arrived with laptops and phones. It grew because they found shelter and powerful partners. Casinos, property projects, special economic zones and politically connected business networks provided space and cover for cybercriminal networks. Scam operations moved into buildings left idle after the collapse of online gambling and the shock of the COVID-19 pandemic. Politicians and local businessmen made certain areas in Cambodia safe spaces for crime.

Sri Lanka is attractive for several reasons. It offers relaxed entry for visitors from many countries and wants to expand visa-free access to support tourism. It has good telecommunications infrastructure, widespread connectivity and easy access to urban and coastal rental properties. The country also has a well-established informal money-transfer culture, including the Undiyal system, which has long moved money outside formal banking channels. While these features can serve legitimate economic and social purposes, they can also be exploited by organized crime. Sri Lanka is recovering from its worst financial crisis since independence and property owners want tenants, tourism businesses want occupancy, and local intermediaries won’t ask too many questions when a group of foreigners wants to rent a house, an office floor or several apartments, if they pay well.

Sri Lankan investigators are still trying to determine whether these operations mainly target victims overseas or also target Sri Lankans. The answer is likely both because the location of scam centers matters less than their access to connectivity, payment channels, accommodation and protection.

Many suspects arrested in Sri Lanka are Chinese nationals, and many victims of Southeast Asian scam networks are Chinese citizens. Beijing pushed Cambodia to act against online gambling and cyberscam operations. The Chinese embassy in Colombo has said it welcomes efforts to combat cybercrime.

China is worried about its reputation overseas. Online scam networks hurt Chinese citizens, move Chinese money through criminal channels, and embarrass Chinese-linked business ecosystems abroad. In recent years, Beijing has urged Sri Lanka not to let the country be used as a safe ground for scammers.

Sri Lanka should welcome legitimate cooperation with China, Interpol and regional governments. But it should avoid treating this as a problem of one nationality. Cambodia’s experience shows that foreign scam bosses thrive when local systems help them. A narrow focus on Chinese suspects may satisfy public anger for a while, but it will not stop the industry.

Sri Lanka’s response must therefore move beyond raids. Scam networks adapt quickly; therefore, the state has to understand how they enter the country, rent space, connect devices, move money and avoid attention. That is why police, immigration officials, telecom regulators, financial intelligence officers, Sri Lanka CERT, the Central Bank and foreign missions need to work together.

Public awareness matters as well. Until recently, most Sri Lankans would not have found it suspicious if they came across many foreign nationals living in a rented house, avoiding contact with neighbors, working through the night and operating many hi-tech devices. It is only now that people know what to notice. But there needs to be more public awareness to make it impossible for scammers to disappear into local communities.

Sri Lanka may have been spared the worst because of timing. Cybercriminals thrived in Cambodia because they found powerful political and business allies.

If they had made the shift to Sri Lanka a few years ago, they would have found plenty of willing and powerful political and business allies in Sri Lanka, who would have linked cyberscammers to local communities and businesses. Under the National People’s Power government, that route appears more difficult. The recent arrests suggest that law enforcement agencies are more willing to act, while the political cost of protecting criminals has risen.

Cambodia is now trying to dismantle a system that grew over decades and with the collusion of some political actors. Sri Lanka’s task is simpler as it has a good chance of preventing cyberscam networks linking with local business interests and property markets. The arrests show that the criminals are here, and what happens next will show whether Sri Lanka remains a temporary refuge or becomes part of Asia’s cybercrime infrastructure.