Sri Lanka Records Zero Prosecutions Amid Online Scam Surge - Organized Crime and Corruption Reporting Project | OCCRP

Sri Lankan police arrested 1,093 suspected members of cyber scam networks from January through September this year. That is a sharp increase from earlier figures. Police recorded only 26 arrests in 2025 and 573 the previous year. The numbers show that suspected scam activity and enforcement have both risen rapidly.

Police reached the 2026 figure through raids on 27 suspected scam compounds around the country. Many suspects reportedly held Asian passports, including those from China, Vietnam, India, and Indonesia. Some had previously traveled to Cambodia or Myanmar, both identified as scam hubs.

The arrests have not produced a successful transnational cybercrime prosecution. Most suspects are instead charged with visa violations and removed from Sri Lanka. Police say the large number of encrypted phones and laptops, language barriers, and limited resources make investigations difficult. The gap between arrests and prosecutions remains the central problem.

A transnational cyber scam is an online fraud operation whose people, victims, technology, or financial flows cross national borders. The criminals may operate from one country, target victims in another, and use accounts, devices, or intermediaries elsewhere. That spread makes the crime harder to investigate and prosecute.

The article describes suspected syndicates operating from Sri Lanka while scamming victims abroad. Police found large numbers of phones and laptops, and many suspects held passports from China, Vietnam, India, and Indonesia. Some had previously traveled through Cambodia or Myanmar. These details point to networks that move people and operations across countries.

An ordinary online fraud may still be serious but can often be investigated mainly within one legal system. A transnational case requires cooperation across borders, usable digital evidence, and a legal basis for prosecution. Sri Lanka has not yet successfully prosecuted someone for using the country as a base to scam foreign victims.

Sri Lanka’s main obstacle is a legal requirement. Its computer crime law, dating from 2007, allows a case to begin only after a victim files a complaint. Because most people allegedly scammed from Sri Lanka live in other countries, few complaints reach Sri Lankan authorities.

Investigators also face practical barriers. Suspects may speak languages police do not understand, and devices are often encrypted. Each raid can produce about 200 phones and laptops, but the cybercrime unit lacks enough resources to examine them all. Without processed evidence and complainants, arrests do not readily become court cases.

As a result, police have arrested 1,093 suspected scammers this year without securing a successful prosecution for overseas scamming. The vast majority are charged with visa violations and removed from the country instead. This can take suspects out of Sri Lanka, but it does not establish criminal responsibility for the alleged scams.

Sri Lankan police say most suspects are handled through immigration violations because the available cybercrime route is difficult to activate. Under the country’s 2007 computer crime law, authorities need a complaint from a victim before opening a case. Most alleged victims are abroad, so that legal trigger is often missing.

The evidence problem adds pressure. Investigators face language barriers, encrypted devices, and hundreds of phones and laptops after some raids. The cybercrime unit says it lacks the resources to process all the material. A visa violation may therefore be easier to establish than a complex case linking suspects, devices, and foreign victims.

Police have said the current government wants these networks removed from Sri Lanka. Charging suspects with visa violations and deporting them achieves that immediate goal. However, it does not produce a successful prosecution for the alleged cyber scams, and it may leave the wider networks insufficiently tested in court.

Crackdowns in Southeast Asia have made established scam compounds harder to operate. The article says these actions drove mostly Chinese-origin syndicates to set up in more vulnerable countries, ranging from Madagascar to Papua New Guinea. Sri Lanka is now viewed as being at serious risk of becoming an industrial-scale scam hub.

The movement is visible in suspect travel histories. Sri Lanka’s cybercrime chief said many arrested people had previously been in Cambodia or Myanmar, both known scam hubs. The article also describes Cambodia as a place that had housed massive compounds, many relying on trafficked workers. When such centers face pressure, syndicates can move workers, equipment, and operations elsewhere.

Sri Lanka offers conditions that may attract them, including visa-free travel for passport holders from 40 countries, investment openings, and legal gray areas around online and offshore gambling. Its clandestine industry is smaller and less visible than Southeast Asia’s compounds, but experts warn it could grow.

Failure to prosecute can allow scam networks to stay active and expand. Arrests alone do not establish who organized the operations, how money moved, or whether the same syndicates can return. If cases continue ending in visa charges and deportations, the underlying criminal networks may avoid meaningful court scrutiny.

The article gives a warning from Jason Tower of the GI-TOC. He says Sri Lanka’s combination of economic distress, foreigner access, online and offshore gambling gray areas, and Colombo Port City could create room for growth. At present, the scam industry is clandestine, unlike the public compounds reported in Southeast Asia.

Tower warns that the industry could shift from hidden activity to something open and obvious. At a larger scale, criminals could become powerful enough to defy the government. The country’s current threshold therefore matters: stronger legal tools, international cooperation, and investigative capacity would be needed to prevent that growth.

When a scam crosses borders, more than one country may have a connection to the crime. The operating country may investigate conduct occurring there. A victim’s country may investigate the harm suffered there. Other countries may control suspects, devices, bank accounts, or communications. Which country prosecutes depends on its laws and the available evidence.

In Sri Lanka’s case, suspected scammers allegedly operated inside the country while targeting people abroad. Police found phones and laptops in Sri Lankan raids, but devices can be encrypted and difficult to analyze. Investigators may also need information from foreign victims, travel records, financial institutions, or authorities in other countries.

The article specifically identifies Sri Lanka’s legal barrier: its 2007 computer crime law requires a victim complaint. With few foreign complaints, cases may not begin. International cooperation can help connect the evidence, but the article does not detail a particular cooperation mechanism or any completed cross-border prosecution.