For decades, Sri Lanka has been marked on the world map as the “Pearl of the Indian Ocean”—a tropical paradise for travelers. However, recent data and chilling revelations suggest that a dark cloud is forming above that beautiful image. Evidence is emerging that horrific cyber crime networks, previously centered in Southeast Asian countries like Myanmar, Cambodia, and Laos, are now shifting their operational hubs toward Sri Lanka. Today, the island is increasingly becoming a secret makeshift headquarters for international “Telecom Fraudsters” and syndicates operating “Pig Butchering” (financial investment fraud) schemes.
Based on raids conducted in the country from 2023 to April 2026, technical data, and information obtained under the Right to Information (RTI) Act, this investigation examines how these networks operate and the threat they pose to both the country and the global community. The findings suggest not isolated activity, but an expanding and structured system that has adapted across borders following crackdowns elsewhere.
Following intense crackdowns by China and Southeast Asian nations on criminal zones like Myanmar’s “KK Park” and areas in Dubai, these criminals have dispersed in search of new safe havens. Sri Lanka has become a primary target for several key reasons, including economic vulnerability, where a relaxed scrutiny regarding foreign investment or cash inflow has benefited criminals. Visa loopholes also play a role, particularly the ease of engaging in business activities while on tourist visas and the opportunities to overstay. Infrastructure is another factor, as Sri Lanka boasts high internet speeds and communication facilities—essential factors for cyber operations. At the same time, a technical literacy gap and lack of digital awareness and negligence among local internet users makes them easy prey, often leading to their bank accounts being used for money laundering (mule accounts).
Since mid-2024, several raids by the Sri Lanka Police and the Criminal Investigation Department (CID) have revealed the scale of these networks. In Kandy (2024), a luxury hotel and several houses in the Hanthana area were raided, resulting in the arrest of 126 Chinese nationals, with over 200 computers and 500 mobile phones seized. In Panadura and Negombo, over 200 foreigners were arrested during raids on a three-story house in Panadura and tourist guest houses in Negombo. Another major raid took place in Iranavila, Chilaw on April 3, 2026, which marks one of the largest recent raids, where 150 individuals, including 133 Chinese nationals, 13 Vietnamese nationals, and one Malaysian national, were arrested at a luxury hotel in Ambakandavila. A common feature in these raids was the presence of “SIM Boxes”—devices capable of operating hundreds of SIM cards simultaneously to send thousands of fraudulent calls and messages.
These criminals operate under a sophisticated multi-layered structure. They post ads for “Online Marketing” or “Data Entry” jobs on Telegram, Facebook, and LinkedIn. Foreigners (Chinese, Thai, Indian) are lured with high salaries, after which their passports are seized, and they are held like slaves in “Scam Centers” to carry out frauds. “Pig Butchering” is the primary revenue stream. Scammers build a romantic relationship or deep friendship with victims online before convincing them to invest in fake platforms. They allow small initial profits to build trust, only to vanish once the victim deposits a large sum. Anonymity is maintained as they use VPNs to show IP addresses in Europe or America while operating from Sri Lanka. They also hack social media accounts (WhatsApp, Facebook) to solicit money. Our investigation revealed many cases where hacked WhatsApp accounts were used to trick victims into depositing money into local private bank accounts via “Phishing” links.
Geographically, activity has been identified across several hotspots in Sri Lanka. In Zone A—Colombo and suburbs such as Wellawatte, Bambalapitiya, and Colombo 07—high-speed internet in luxury apartments is used to conduct ATM fraud and high-end financial scams. In Zone B—the Hill Country including Kandy (Hanthana, Peradeniya)—isolated large bungalows and boutique hotels are used, holding hundreds of workers away from public view. In Zone C—the Coastal Belt including Negombo, Panadura, and Galle—properties are operated as “Call Centers,” blending in due to high tourist traffic. In Zone D—the North Western coast including Chilaw and Iranavila—a newly identified zone uses isolated beachfront luxury hotels as operation hubs.
According to data obtained from the CID via RTI, there has been a massive surge in arrests over the past three years. Between 2023 and April 3, 2026, approximately 412 foreigners were arrested for online fraud alone. In 2023 there were 7 arrests, in 2024 there were 253 arrests, in 2025 there were 2 arrests, and in 2026 (up to April 3) there were 292 arrests, bringing the total arrests during this period to 554. Furthermore, data from the Department of Immigration and Emigration shows that between January 2023 and December 2025, 270 foreigners were deported for visa violations. In 2026 alone, another 125 Chinese nationals were deported. In total, 385 foreigners—including 307 Chinese, 43 Thai, and 18 Vietnamese nationals—were deported during this period.
These raids confirm that Chinese and Nigerian nationals are the primary operators of these networks. Reports from a Chinese special police team suggest these centres are directly linked to international criminal syndicates in Myanmar and Cambodia. In one instance, a Chinese national who was involved in an illegal travel advisory service that meticulously and secretly repatriates money received from foreign tourists visiting the country to other countries was arrested in Kandy.
This is not a random collection of individuals but a highly organised structure. “Masterminds” in Myanmar or Dubai register Shell Companies in Sri Lanka’s IT sector to bring in operators on Business Visas. Local facilitators are also involved, including real estate agents who rent out houses for exorbitant rates (LKR 500,000 to 1,000,000 per month) without informing the police, and individuals who provide thousands of SIM cards using fake data. Money laundering operations ensure defrauded funds bypass the banking system and are converted into USDT (Stablecoin). They are then moved through digital wallets (Layering) to accounts in Southeast Asia or tax havens. There are also cases involving how fraudulently collected money is routed through hacked WhatsApp accounts.
Several challenges and legal gaps continue to complicate enforcement. Technical capacity remains limited, with a significant gap in the ability of average police officers to identify complex data encryption used by criminals. Jurisdiction is another issue, as while ground operators are caught, the “controllers” remain abroad, making it difficult to uproot the network entirely. Legal delays also persist, with approval processes to prosecute specific technical crimes under the Code of Criminal Procedure being time-consuming. Existing laws do not fully cover emerging cybercrimes, and in some cases, officials are not conducting raids on existing connections with these networks and are only deporting arrested accomplices, mainly Chinese nationals, without referring them to judicial proceedings.
To prevent Sri Lanka from becoming a cybercrime hub, several steps are suggested. Stricter housing regulations are needed, including mandatory police reporting of the visa type and employment of foreigners renting houses or apartments. SIM control must be strengthened by limiting the number of SIM cards an individual or entity can obtain and strictly controlling the import of “SIM Boxes.” International cooperation is essential, with joint cyber investigation units with Chinese and Indian security forces and Interpol. Legal reform is also required, including rapid amendments to laws related to cybercrime and financial fraud to match modern technological requirements.
Sri Lanka has reached a critical crossroad, evolving into a “Digital Sweatshop” for international criminals. This is not just a financial issue; it is a grave threat to national security, the stability of the financial system, and the country’s international reputation. Unless authorities act immediately, the world will recognize the island not as a traveler’s paradise, but as the next “Cybercriminal Paradise.” It is a collective responsibility to ensure the motherland does not become a sanctuary for criminals.
