- Sri Lankan police arrested over 1,000 foreign nationals since January 2026 for operating international cyber-fraud compounds.
- Criminal syndicates exploited relaxed 30-day e-visa rules to set up operations in luxury villas and offices.
- The fraud networks targeted victims globally through cryptocurrency scams and pig butchering schemes.
- Authorities are investigating links between these groups and a $2.5 million Treasury cyberattack.
(SRI LANKA) — Sri Lankan authorities arrested over 1,000 foreign nationals suspected of running cyber-fraud compounds since January 2026, a sharp rise from 430 arrests in all of 2024, as the island confronts scam networks that police say took root under a relaxed visa regime.
Police linked the suspects to operations in luxury villas and office complexes in Colombo, including Talangama, Rajagiriya and Kollupitiya, as well as in Galle and Matara. The groups mainly shifted to Sri Lanka from Cambodia and Myanmar after crackdowns in those countries, and the largest share of suspects were Chinese nationals.
Investigators said the compounds ran cryptocurrency investment fraud, “pig butchering” romance scams and illegal gambling schemes aimed at victims across Asia and the United States. One raid alone netted 173 Indians, while other arrests included 74 Vietnamese and 29 Nepalis.
Assistant Superintendent of Police Fredrick Wootler, the police media spokesperson, tied the surge to entry rules that gave foreign operators room to establish themselves quickly. “The island’s generous 30-day tourist e-visa, high-speed internet, and plentiful villa rentals have made it an attractive fallback hub for criminal syndicates. we are receiving a large number of tip-off calls each day,” Wootler said on May 17, 2026.
That 30-day tourist e-visa now sits at the center of the response. Sri Lankan immigration authorities have indicated they may tighten screening for Chinese passport holders and step up device inspections at Bandaranaike International Airport, moves aimed at blocking organizers before they reach the villas and office sites that police say served as boiler rooms.
The scale of the crackdown has also triggered deportations. On March 30, 2026, Sri Lanka deported 125 Chinese nationals on a special aircraft provided by the Chinese government after similar scam raids.
Authorities are also investigating whether the same networks had any role in a recent $2.5 million cyberattack on the Sri Lankan Treasury. That inquiry has widened the case beyond immigration enforcement and local vice operations to include possible damage to state finances and digital infrastructure.
American officials have framed the Sri Lanka arrests as part of a wider regional threat, even when public statements did not name the island in every instance. Acting ICE Director Todd M. Lyons said on May 12, 2026 that investigators were tracking fraud rings that crossed borders and exploited immigration systems.
“We are uncovering evidence of organized fraud that spans national and international borders. The OPT [Optional Practical Training] program has become a magnet for fraud. This fraud is not victimless,” Lyons said. His remarks appeared in material published through the [DHS newsroom](https://www.dhs.gov/news) as U.S. agencies expanded attention on scam networks operating across Asia.
The U.S. Department of State attached a large dollar figure to the losses. In a reward announcement on April 23, 2026, the department offered $4 million for information leading to the arrest of Daren Li, a Chinese national accused of laundering proceeds for Southeast Asian scam centers.
“Americans lost at least $10 billion in 2024 to Southeast Asia-based scam operations, a 66 percent increase over the prior year. Transnational criminal organizations (TCOs) are increasingly targeting Americans through large-scale cyber scam operations,” the department said in the announcement, which was posted through [State Department material on Daren Li](https://www.state.gov/).
U.S. immigration authorities have also adjusted their own screening rules. USCIS implemented “Strengthened Screening and Vetting” protocols on March 30, 2026 to address cases in which foreign nationals from high-risk countries received status without enough investigation into overseas criminal ties, according to material in the [USCIS newsroom](https://www.uscis.gov/newsroom).
Those measures do not govern entry to Sri Lanka, but they reflect the same concern voiced by Sri Lankan police and U.S. investigators: scam syndicates move across jurisdictions quickly, test visa systems for gaps and rebuild operations in places that offer fast internet, rental properties and lighter screening. Sri Lanka’s geography and tourism infrastructure appear to have made it one such fallback point.
Police operations since the start of the year suggest the networks did not hide in remote enclaves. Investigators found them in upscale neighborhoods of Colombo and in southern coastal cities better known for tourism, a pattern that indicates the operators blended ordinary short-term rentals and office space with criminal activity aimed at people far outside Sri Lanka.
The nationality breakdown also points to an international labor structure inside the compounds. Chinese nationals formed the largest group, while the arrests of Indians, Vietnamese and Nepalis showed the workforce extended well beyond a single country, matching a pattern seen in Southeast Asian scam centers that recruit, transfer or relocate workers and supervisors across borders.
Much of the alleged fraud relied on distance and deception rather than physical contact. Cryptocurrency investment schemes lured targets with promises of returns, while pig butchering scams typically used online relationships to draw victims into larger transfers of money over time. Illegal gambling operations added another revenue stream, giving organizers multiple ways to move funds and exploit digital platforms.
Sri Lankan authorities have not limited their response to raids alone. Wootler said the police were receiving frequent public tip-offs, suggesting the compounds had become visible enough to attract local suspicion, whether through unusual patterns of occupancy, heavy device use or the concentration of foreign groups in rented villas and commercial units.
The official trail around the case now spans local police action, deportation flights, a treasury cyberattack inquiry and U.S. warnings about international fraud. People with information tied to cybercrime can submit tips through the [ICE tip line](https://www.ice.gov/tipline), while Sri Lanka continues to test whether tighter airport checks and changes to its relaxed visa regime can slow the arrival of the next wave.
