A Special Investigation into the Sri Lankan Operations of International Telecom Fraud Networks
Rahul Samantha Hettiarachchi
(rahulnews.srilanka@gmail.com)
For decades, Sri Lanka has been marked on the world map as the “Pearl of the Indian Ocean”—a tourist paradise. However, recent data and alarming revelations suggest that a dark shadow is growing behind this beautiful image. Evidence is emerging that notorious cybercrime networks, which were previously centered in Southeast Asian countries like Myanmar, Cambodia, and Laos, are now decentralizing their operational hubs to Sri Lanka. Today, Sri Lanka is progressively becoming a clandestine, temporary headquarters for syndicates operating international “Telecom Fraud” and “Pig Butchering” (financial investment scams) networks.
Based on raids conducted in the country from 2023 to April 2026, technical data, and information obtained under the Right to Information (RTI) Act, this investigation examines how these networks operate and the threat they pose to both the country and the global community.
Global Crackdowns and Sri Lanka Becoming the “Gateway”
Due to severe joint crackdowns by China and Southeast Asian nations on criminal zones like “KK Park” in Myanmar and regions like Dubai, these criminals have dispersed in search of safe new territories. Sri Lanka has become one of their primary targets due to several key factors:
-
Lenient Financial Oversight: In light of the country’s current economic situation, relaxed scrutiny regarding foreign investments or cash inflows has worked to the criminals’ advantage.
-
Visa Loopholes: The ease of entering on tourist visas to engage in business activities, along with opportunities to overstay visa periods.
-
Infrastructure: High-speed internet and advanced communication facilities in South Asia, which are essential requirements for these cyber operations.
-
Vulnerable Locals: The negligence and low digital literacy of local internet users make them easy targets and allow criminals to exploit their bank accounts for money laundering operations (mule accounts).
Recent Raids and Revealed Information
Several raids conducted by the Sri Lanka Police and the Criminal Investigation Department (CID) since mid-2024 have exposed the massive scale of this network.
-
Kandy (2024): A luxury hotel and several houses in the Hanthana area were raided, leading to the arrest of 126 Chinese nationals. Over 200 computers and nearly 500 mobile phones were seized.
-
Panadura & Negombo: Raids on a three-story house in Panadura and tourist guesthouses in Negombo resulted in the arrest of over 200 foreigners.
-
Iranavila, Chilaw (April 03, 2026): This can be described as the largest recent raid. 150 individuals, including 133 Chinese nationals, 13 Vietnamese nationals, and one Malaysian national, were arrested while operating out of a luxury hotel rented in the Ambakandawila, Iranavila area in Chilaw.
A common feature in all these raids was the recovery of “SIM Boxes” in the possession of the suspects. These are devices used to operate hundreds of SIM cards simultaneously to send thousands of fraudulent calls and text messages.
Modus Operandi (Method of Operation)
These criminals operate under a highly sophisticated, multi-layered structure:
-
Human Trafficking and Forced Labor: They post advertisements for “Online Marketing” or “Data Entry” jobs via Telegram, Facebook, and LinkedIn. Promising high salaries, they lure foreigners (Chinese, Thai, Indian) to Sri Lanka, confiscate their passports, and hold them like slaves inside these “Scam Centers,” forcing them to execute frauds.
-
“Pig Butchering” and Investment Scams: This is the primary revenue stream of the network. The scammers build a romantic relationship or a deep friendship with the victim online and subsequently persuade them to deposit money into fraudulent investment platforms. They initially allow small profit withdrawals to build trust, but once a massive sum is deposited, they vanish with the money.
-
Identity Anonymization & Hacking: They use VPNs to conceal their identity; though based in Sri Lanka, their IP addresses appear as Europe or America. They also hack social media accounts (WhatsApp, Facebook) to extort money. Our investigation revealed a high prevalence of scams where hacked WhatsApp accounts are used to message contacts, requesting them to deposit money into local private bank accounts. “Phishing” links are deployed as the primary tool for these hacks.
Geographic Analysis of Sri Lanka: Scam Hotspots
According to investigative data, four main zones can be identified within Sri Lanka:
| Zone | Primary Location | Nature of Activity |
| Zone A – Colombo and Suburbs | Wellawatte, Bambalapitiya, Colombo 07 | Luxury apartments equipped with high-speed internet. They orchestrate ATM fraud and high-end financial scams. |
| Zone B – Central Highlands | Kandy (Hanthana, Peradeniya) | Isolated large bungalows and boutique hotels. Hundreds of workers are kept confined here, completely cut off from the outside world. |
| Zone C – Coastal Belt | Negombo, Panadura, Galle | Operated as “Call Centers.” Since these are high-traffic tourist areas, it is easy for foreigners on tourist visas to stay there without raising suspicion. |
| Zone D – Northwestern Coast | Chilaw, Iranavila | A recently identified zone. Isolated beachfront luxury hotels are used as operational headquarters. |
The Growing Threat
According to data obtained from the CID under the Right to Information (RTI) Act, there has been a massive spike in arrests over the past three years. Between 2023 and April 3, 2026, approximately 412 foreigners were arrested solely in connection with online financial scams. The breakdown shows 7 arrests in 2023, 253 in 2024, 2 in 2025, and 292 up to April 3, 2026. This brings the total number of individuals arrested for cybercrimes during this specific period to 554.
Notable incidents among these arrests include:
-
October 2024: A group of 120 Chinese nationals suspected of online financial fraud was arrested in Kundasale, Kandy.
-
March 17, 2026: 125 Chinese nationals who had arrived on tourist visas and were overstaying illegally were arrested in Anuradhapura. On March 30, 2026, they were deported under orders from the Controller General of Immigration and Emigration.
-
March 24, 2026: 17 Chinese and Vietnamese nationals engaging in online scams while on tourist visas were arrested in Poddala. Police seized 8 computers and 84 smartphones in their possession.
-
April 03, 2026: Following military intelligence information, officers of the CID’s Cyber Crime Division arrested a group of 150 individuals, including Chinese nationals, who had rented a luxury hotel in Iranavila, Chilaw, to conduct online financial fraud.
While these represent the largest mass arrests between 2023 and 2026, numerous other arrests of foreign nationals operating online scams have been reported across many other regions, with Chinese nationals comprising the vast majority.
Furthermore, data obtained from the Department of Immigration and Emigration under the RTI Act reveals that 270 foreigners were deported from Sri Lanka between January 1, 2023, and December 31, 2025, for violating visa conditions. In addition, 125 Chinese nationals were deported in 2026 under similar circumstances. Accordingly, a total of 385 foreigners—including 307 Chinese, 43 Thai, 18 Vietnamese, 8 Filipino, 6 Myanmarese, and 3 Indonesian nationals—were deported from the country between 2023 and April 3, 2026.
These raids confirm that Chinese and Nigerian nationals are the primary operators of these cybercrime networks. Reports provided by specialized Chinese police teams indicate that these hubs are directly linked to international criminal networks based in Myanmar or Cambodia.
Additionally, it has been observed recently that in the Southern Province—including Hambantota, Matara, and Galle—as well as several other areas in Sri Lanka, Chinese nationals residing as tourists are partnering with certain locals to run various illicit rackets and tourism businesses.
Network Analysis and Hidden Connections
This criminal network is not merely a loose collection of individuals; it is a highly organized corporate structure. The “Masterminds” based in countries like Myanmar or Dubai register shell companies in Sri Lanka’s IT sector. Through these, they secure business visas to bring in operators, thereby setting up an international corporate framework.
Crucial local enablers are vital cillars of this operation. These include real estate agents who lease out properties at exorbitant monthly rentals ranging from LKR 500,000 to 1,000,000 without registering them with the local police, and individuals who provision thousands of SIM cards using fraudulent identification. The stolen funds bypass the formal banking system and are converted into cryptocurrencies like USDT (Stablecoin). From there, the funds are moved through various digital wallets (layering) and eventually credited to accounts in Southeast Asia or tax havens.
Prevailing Challenges and Legal Loopholes
The primary obstacles faced by Sri Lankan law enforcement authorities include:
-
Technical Deficiencies: The inability of standard police officers to decrypt complex data encryption used by cybercriminals is a glaring technical weakness.
-
Jurisdictional Issues: Even when local operators are arrested, the “masterminds” remain in foreign countries, making it extremely difficult to entirely uproot the network.
-
Legal Delays: Beyond the Code of Criminal Procedure, obtaining the necessary approvals to prosecute specialized technological crimes takes a significant amount of time. Furthermore, the existing laws do not comprehensively cover newly emerging forms of cybercrime, posing a major challenge to eradication efforts.
What Needs to Be Done?
To prevent Sri Lanka from turning into a global hub for cybercriminals, the government must urgently focus on implementing strict regulations:
-
Mandatory Reporting on Rentals: A law must be introduced making it compulsory for landlords to report the visa status and occupation of any foreign tenant renting a house or apartment to the local police.
-
SIM Control: Restricting the number of SIM cards an individual or institution can acquire, and imposing strict import controls and data collection on equipment like SIM Boxes.
-
International Cooperation: Setting up joint cyber investigation units in collaboration with Chinese and Indian security forces, as well as Interpol.
-
Legal Reforms: Speedily amending existing laws on cybercrime and financial fraud to match current technological advancements.
-
Monitoring Tourism Violations: Developing a mechanism to increase surveillance on foreigners who arrive on tourist visas but illegally engage in local business or tour guiding services.
Conclusion
Sri Lanka has reached a critical turning point, standing on the verge of becoming a “Digital Sweatshop” for international cybercriminals. This is not merely a matter of financial fraud; it is a severe threat to national security, the stability of the financial system, and the country’s international reputation. If authorities fail to act immediately, the world will soon recognize Sri Lanka as the next “Cybercriminal Paradise.” It is the collective responsibility of everyone to ensure that our motherland, once cherished as a tourist paradise, does not become a haven for global criminals.
