They had phones, laptops, a stamp to forge documents, and so many forged documents.
When enforcement closes one door, criminal ingenuity opens another — and Sri Lanka has become the latest threshold. Chinese-run cybercrime networks, dislodged from their fortified compounds in Cambodia and Myanmar by regional crackdowns, have quietly migrated to the island nation, drawn by permissive visa policies, minimal telecommunications oversight, and a legal culture that deports rather than prosecutes. Nearly 700 foreigners have been arrested in raids this year, yet the deeper question is whether Sri Lanka will reckon with the structural conditions that made it attractive before the industry takes root as deeply as it did elsewhere in the region.
- Scam networks that once operated from walled compounds in Southeast Asia have reinvented themselves as nimble, rotating cells of five, cycling through Sri Lankan hotels and offices every three months to evade detection.
- A single Colombo raid uncovered 62 passports, forged U.S. business certificates, and coordinated devices targeting Americans — a miniature fraud factory hidden inside an ordinary apartment building.
- Landlords in Colombo have more than doubled office rents in some complexes, a telling sign of how much money is flowing into the country through criminal networks flush with global scam proceeds.
- Sri Lanka's response — nearly 700 arrests since January — relies almost entirely on deportation, a consequence so mild that researchers and officials alike warn it functions as little more than a temporary inconvenience for well-organized syndicates.
- Unless Sri Lanka tightens visa vetting, regulates SIM card access, and shifts toward prosecution, enforcement experts warn the island risks becoming as entrenched a scam hub as the Southeast Asian nations it has now surpassed in criminal appeal.
Sri Lanka is quietly becoming the world's newest haven for transnational cybercrime, as Chinese criminal networks — dislodged by crackdowns across Cambodia and Myanmar — relocate their fraud operations to the island with remarkable speed and efficiency. Police are conducting raids nearly every week, arresting and deporting close to 700 foreigners since the start of the year, yet the arrests have done little to slow the migration.
A recent raid in Colombo captured the scale of the problem in miniature: 19 people operating out of a single apartment, surrounded by 62 passports, coordinated scamming devices, document forgery equipment, and a framed fake certificate declaring the operation a legitimate American company worth $10 billion. The targets were real Americans, lured toward investments in a company that did not exist.
The broader industry behind such scenes is enormous. For over a decade, Chinese criminal syndicates have run vast fraud compounds across Southeast Asia, orchestrating romance scams, cryptocurrency fraud, and money laundering operations that cost Americans alone an estimated $10 billion in 2024. The workforce — numbering in the hundreds of thousands, many trafficked or coerced — simply followed the networks when political pressure forced the compounds to close.
Sri Lanka offered an ideal replacement: easy tourist and digital nomad visas with minimal vetting, unregulated SIM cards and internet access, cheap commercial real estate, and an existing Chinese business presence that allows new arrivals to blend in. Crucially, when authorities do catch cybercriminals, they deport rather than prosecute — a consequence that researchers describe as barely a deterrent.
Cybercrime analyst Mark Bo tracked the shift beginning two years ago, watching Telegram posts announce relocations to Sri Lanka as the Cambodia crackdown intensified. The networks have also adapted their structure, abandoning visible compounds in favor of small rotating cells that move between locations every three months, making them far harder to dismantle. In one case, a single criminal group had rented eight full floors of an apartment building.
Both Sri Lankan police and the Chinese embassy have acknowledged the problem publicly, but acknowledgment has not yet translated into the structural reforms — stronger visa vetting, telecommunications regulation, and a shift from deportation to prosecution — that experts say are necessary to prevent Sri Lanka from becoming as entrenched a scam hub as the countries these networks just left behind.
Sri Lanka is becoming a haven for the world's largest transnational scam operations, as Chinese criminal networks flee the crackdowns that have dismantled their compounds across Southeast Asia. The shift is happening quietly but visibly enough that police are now conducting raids almost weekly, arresting and deporting nearly 700 foreigners accused of running fraud schemes since the start of the year.
On a recent Thursday in Colombo, officers raided an apartment where they found 18 Chinese nationals and one person from Laos operating what amounted to a miniature fraud factory. The scene told the story of industrial-scale deception: 62 passports stacked in drawers, mostly belonging to Chinese citizens; laptops and phones arranged for coordinated scamming; a stamp for forging documents; and on the wall, framed like a diploma, a fabricated certificate claiming the operation was a legitimate U.S. business worth $10 billion. The fake documents ranged from falsified legal certifications to counterfeit treasury papers. The officers discovered the scammers had been targeting Americans, trying to lure them into investing in a company that did not exist.
This is not a new crime. For the past decade, Chinese gangs have run vast fraud factories from fortified compounds in Cambodia and Myanmar, orchestrating romance scams, cryptocurrency fraud, online gambling schemes, and money laundering operations that reach across the globe. The scale is staggering: Americans alone lost an estimated $10 billion to these Southeast Asian operations in 2024. The workforce numbers in the hundreds of thousands, many of them trafficked or coerced into the work. But as political pressure mounted on Cambodia, Myanmar, and other host countries, authorities began shutting down the compounds. The criminals simply packed up and moved.
Sri Lanka offered everything they needed. Tourist visas are easy to obtain, and the country recently introduced digital nomad visas with minimal vetting. Sim cards and internet connections face almost no regulatory oversight. Office space and hotel rooms rent cheaply, and there is already a substantial Chinese presence in the country's infrastructure and business sector, so Chinese visitors attract little suspicion. The government has also relaxed rules around online gambling. Most importantly, when authorities catch cybercriminals, they typically deport them rather than prosecute them—a slap on the wrist that does little to deter the next operation.
Mark Bo, a cybercrime researcher and author of a book on Southeast Asian scam compounds, began noticing the shift about two years ago. Posts started appearing on the messaging app Telegram from people announcing they were relocating to Sri Lanka. As the crackdown in Cambodia intensified, the migration accelerated. "There's clearly been some kind of transplanting of the exact same set-up there," Bo observed. "It shows the challenge of controlling the industry because one of its defining characteristics is how mobile and how adaptable it can be."
The operations have adapted in another crucial way. Rather than building visible compounds that attract attention, the networks now work in small rotating cells of about five people each, moving between different hotels, apartments, and offices every three months. This makes them harder to track and dismantle. Yet the money flowing into these operations is enormous. In one recent raid, officers found that eight floors of an apartment building had been rented out by a single group. The demand has been so intense that landlords in Colombo have more than doubled office rents in some complexes, cashing in on the influx of well-funded Chinese criminal groups.
Sri Lankan police spokesperson Fredrick Wootler has publicly acknowledged the "alarming increase of cybercrimes" perpetrated by people who arrive as tourists and then establish illegal scam operations. The Chinese embassy in Colombo has also acknowledged the problem, stating that its citizens involved in telephone fraud gangs have relocated to Sri Lanka after the Southeast Asian crackdowns, and pledging support for law enforcement efforts. Yet the machinery of enforcement appears outpaced by the speed and scale of the relocation. As long as Sri Lanka remains easier to operate in than Cambodia or Myanmar, and as long as deportation remains the primary consequence, the networks will keep coming. The question now is whether the country will tighten its visa policies, regulate its telecommunications infrastructure, and shift from deportation to prosecution before the scam industry becomes as entrenched there as it was in Southeast Asia.
Notable Quotes
There's clearly been some kind of transplanting of the exact same set-up there. It shows the challenge of controlling the industry because one of its defining characteristics is how mobile and how adaptable it can be.— Mark Bo, cybercrime researcher
Cases like these pose immense harm, and the Chinese embassy provides full support to Sri Lankan law enforcement agencies in resolutely cracking down on suspects.— Chinese embassy in Colombo
The Hearth Conversation Another angle on the story
Why is Sri Lanka suddenly so attractive to these networks? They could set up anywhere.
It's a combination of things working together. The visa system is permissive—tourists can arrive easily, and the new digital nomad visas ask almost no questions. But it's not just that. There's already a Chinese business presence, so Chinese nationals don't stand out. Rents are cheap. And crucially, when you get caught, you get deported, not prosecuted. That's a business calculation.
So they're not hiding at all. They're just operating in plain sight.
Not quite. They've learned from the Southeast Asian crackdowns. Instead of building visible compounds with hundreds of people, they're now working in small cells of five or so, rotating through different locations every few months. It's harder to detect that way. But yes, the infrastructure they need—offices, hotels, sim cards, internet—is all readily available and unregulated.
How many people are we talking about?
Nearly 700 arrests and deportations just this year in Sri Lanka. But that's only what they've caught. The broader industry employs hundreds of thousands globally, many of them trafficked or coerced. Americans lost $10 billion to these operations in 2024 alone.
What happens when someone gets deported?
They go back, or they go somewhere else. There's no prosecution, no real consequence beyond being sent home. For a criminal network with the resources these groups have, that's just a cost of doing business. The researcher Mark Bo noticed the shift starting two years ago on Telegram—people literally announcing they were moving to Sri Lanka as the Cambodia crackdown got serious.
Is Sri Lanka aware this is happening?
Yes. The police are conducting raids regularly. The Chinese embassy has publicly acknowledged it. But the country's mechanisms for fighting cybercrime are limited. They're focused on deportation, not prosecution. And the demand for office space has gotten so high that landlords have doubled rents in some complexes. The economy is benefiting, even as the crime accelerates.
So what stops it?
Stronger visa vetting, regulation of sim cards and internet, and actually prosecuting people instead of deporting them. But that requires political will and resources. The networks are mobile and adaptable—that's their defining strength. They'll keep moving until the cost of operating somewhere becomes higher than the profit.