1,000+ Arrested in Sri Lanka as Cyber-Scam Networks Flee Cambodia Crackdown

The balloon effect in cybercrime is reshaping the threat landscape in South Asia. As Cambodia cracks down on fortified scam compounds, organized cyber networks are relocating en masse to Sri Lanka—a country with open visa policies, robust connectivity, and a recovering economy that makes it ripe for exploitation. For threat intelligence analysts, the sudden influx of over 1,000 foreign cyber-scam operatives arrested in just six months signals a critical pivot point that demands immediate regional vigilance and proactive digital defense strategies.

A major realignment is underway in Asia's cyber-scam industry. For years, Cambodia hosted vast fortified compounds where organized crime syndicates ran online fraud operations—ranging from pig‑butchering investment scams to impersonation and ransomware schemes. Sustained diplomatic and law‑enforcement pressure from China and the United States has begun to dismantle these strongholds, but as criminologists have long observed, pressure on one hub simply pushes illicit activity elsewhere. The new frontier, according to recent reporting, is Sri Lanka, and the numbers tell an urgent story: since the start of 2026, Sri Lankan police have arrested more than a thousand foreign nationals for suspected involvement in cyber fraud, up from roughly 430 in all of 2024.

“

As Cambodia cracks down on fortified scam compounds, organized cyber networks are relocating en masse to Sri Lanka—a country with open visa policies, robust connectivity, and a recovering economy that makes it ripe for exploitation.

The geography of the arrests is revealing. Raids are not hitting remote jungle camps but beach towns and ordinary apartment blocks in the south. In May 2026, officers detained 192 Indians and 29 Nepalis in the coastal towns of Galle and Matara; a separate sweep netted 221 foreigners in a single operation. The workforce moving into Sri Lanka increasingly includes citizens of South Asian neighbors, marking a shift from the predominantly Chinese run networks that first built the Cambodian compounds. Chinese, Vietnamese, and Indian nationals still figure prominently among those detained, but the regionalization of the labor pool shows how deeply these scams have embedded into local economies.

Sri Lanka presents an exceptionally attractive environment for displaced cyber‑criminal networks. The country is still recovering from its worst economic crisis since independence, leaving a desperate need for tenants and a shortage of rigorous background checks by landlords and intermediaries. It offers relaxed visa‑free entry for visitors from many countries—a policy the government intends to expand to revive tourism—combined with fast, reliable internet infrastructure and ample rental property in urban and coastal areas. This confluence of factors creates a low‑friction pathway for syndicates to set up shop, often operating behind the veneer of legitimate call‑center or tech‑support businesses.