As law enforcement intensifies efforts to dismantle organized crime within a particular country, criminals seldom cease their activities; rather, they relocate their operations. This premise is currently influencing the dynamics of Asia’s online fraud industry, leading to significant shifts in its geographic landscape. As Cambodia – under sustained pressure from Beijing and Washington – begins to dismantle the fortified compounds that made it a byword for cyber-scams, the networks behind them are looking for somewhere new to work. Recent reporting suggests one of their chosen testing grounds is Sri Lanka. The numbers are already striking. Since the start of 2026, Sri Lankan police have arrested more than a thousand foreign nationals for suspected involvement in cyber fraud – up from around 430 in all of 2024 – many of them Chinese, Vietnamese and Indian.
The raids have a revealing geography: not remote jungle camps, but beach towns and ordinary apartment blocks. In May, officers detained 192 Indians and 29 Nepalis in the southern towns of Galle and Matara, and a separate sweep brought in 221 foreigners in a single operation. This is as much a South Asian story as a Sri Lankan one: the workforce drawn into these operations increasingly includes citizens of Sri Lanka’s own neighbours. Criminologists refer to the phenomenon of displacement as the ‘balloon effect,’ in which pressure in one area causes an increase in illicit activity elsewhere. This highlights the need for regional cooperation among law enforcement to improve their effectiveness.
Sri Lanka offers an attractive combination of conditions. It offers relaxed entry for visitors from many countries and aims to expand visa-free travel to revive tourism; it has fast, reliable internet; and it has plentiful rental property in its cities and along its coast. Crucially, the country is still recovering from the worst economic crisis since its independence, so landlords want tenants and few intermediaries ask challenging questions of a group of foreigners who pay well and on time. Because the state controls its whole territory, the operators cannot build the walled compounds seen in Myanmar; instead, they hide in plain sight, wiring an apartment for a few weeks and abandoning it when the police draw near.
One significant concern for policymakers is the prevalence of an informal money-transfer system known as undiyal and commonly referred to as hawala in other contexts. This system facilitates the transfer of value outside of the formal banking framework based solely on mutual trust. It addresses entirely legitimate needs, particularly those related to remittances on which numerous families rely for financial support. Its recent history also shows how quickly it can absorb new demand: when the central bank defended an artificially fixed exchange rate during the 2022 crisis, expatriate workers deserted the banks almost overnight, and remittances through formal channels fell to 3.8 billion dollars before rebounding by 57 per cent the following year, once the parallel rate was scrapped and official channels became competitive again. The money had never stopped flowing; it had been rerouted through undiyal brokers offering better rates.
That episode revealed both the scale and the elasticity of the informal network. The same qualities that make it fast and discreet also make it useful to anyone who needs to move criminal proceeds without a paper trail, which is why Sri Lanka’s own central bank has moved to register undiyal and hawala operators and flagged them as a high money-laundering risk – and why observers of the new arrivals note that scam proceeds are now routinely laundered through cryptocurrency platforms layered on top of these older trust networks. For an industry whose whole purpose is to extract money and move it out of reach before victims or regulators can react, a mature, low-visibility settlement layer is not a convenience. It is infrastructure.
This underscores a crucial lesson from the situation in Cambodia, one often overlooked amid the commendation of arrests. The expansion of Cambodia’s scam economy was not merely the result of the infiltration of criminals equipped with laptops and facilitated by influential local partners. Casinos left empty after online gambling was banned and the pandemic struck were converted into guarded scam centres; special economic zones and politically connected businesses supplied space and cover. The US Institute of Peace estimates that the industry is now worth around 12.5 billion dollars a year in Cambodia – roughly half its formal economy – and that senior officials and business elites benefit from it. A 2022 decision to drop Cambodia from the Financial Action Task Force’s money-laundering “grey list” only made the laundering easier.
The durability of a scam industry depends on its local host. Foreign operatives provide capital and trafficked labour, but they rely on local landlords, fixers, and sometimes officials for protection. Although many arrested in Sri Lanka are Chinese nationals, viewing the issue as limited to one nationality misses the point. Scam bosses flourish wherever local systems allow it, regardless of their origin. It is also worth remembering who staffs these operations. A UN human rights report this year documented torture, sexual violence and forced labour inside South-East Asian compounds. Many workers are trafficked through fake job adverts and then held against their will. When an operation relocates, that captive workforce often moves with it. A raid that treats everyone on the premises as a culprit therefore risks punishing the victims while the organisers who hold the passports and the profits slip away. Telling the trafficked from the traffickers is both a moral duty and the surest route to the people who run the network.
The costs of allowing the industry to settle would not be abstract. Sri Lanka’s recovery rests on precisely the flows a scam economy contaminates. Tourism has just recorded its best year ever, with 2.36 million arrivals and earnings above 3.2 billion dollars, while workers’ remittances remain the country’s top source of foreign exchange. Both run on trust: visitors who feel safe, correspondent banks that continue to clear Sri Lankan payments, and a diaspora willing to use formal channels. The timing sharpens the danger. The country has entered its third international evaluation on money laundering and terrorist financing this year, knowing that failure could return it to the Financial Action Task Force’s grey list – a list it escaped only in 2019, after a stint that also saw the European Union blacklist it. Officials concede that a repeat would raise the cost of every cross-border transaction, from trade finance to the remittances on which households depend. A visible cyber-fraud industry settling its accounts through unregulated value-transfer networks is exactly the finding that tips the balance in such an assessment.
Nor are Sri Lankans bystanders. The International Organization for Migration has repatriated successive groups of Sri Lankan men trafficked into Myanmar’s scam compounds after being lured by fake job offers in IT and customer service – proof that the industry’s recruiters already fish in local waters. At home, the operations have settled into rented properties ranging from luxury villas to office buildings, drawing landlords, brokers and fixers into their orbit. The targets are moving closer, too: authorities are investigating whether foreign syndicates were behind a cyberattack on the treasury that caused losses of around 2.5 million dollars, and officials worry that networks now defrauding victims in India, Vietnam and the Philippines will in time turn on Sri Lankans themselves. Every month of entrenchment converts these risks from hypothetical to structural.
Had these networks emerged a few years ago, they might have found political and business allies eager to integrate them into the local economy. However, under the current government, shielding criminals carries greater political risks. Raids alone won’t suffice, as they only displace operators to new locations.
The first task is border discipline that does not strangle the tourism on which the recovery depends. The networks exploit 30-day tourist visas now available to nationals of more than 40 countries, arriving in waves as ordinary visitors; the answer is not to close the door but to watch it, through advance screening of passengers against shared watch-lists, biometric registration at entry, and systematic follow-up on overstays and rapid repeat visits. Analysts have urged this, along with tighter control of the everyday infrastructure the operators depend on, starting with SIM cards that foreigners can still obtain with nothing more than a passport. Customs has shown what alertness looks like by intercepting travellers carrying hundreds of used phones and laptops – the toolkit of a scam floor. And the recent police advisory warning property owners against the misuse of rented premises should harden into genuine due-diligence duties for landlords and letting agents, so that a group of foreigners paying cash for a wired-up villa triggers a report rather than a shrug.
The second task is financial. Registration of undiyal and hawala operators must move from paper to practice, with supervision and real penalties for brokers who cannot account for their flows, and with the financial intelligence unit, police, immigration, and telecom and payment providers feeding a single operational picture rather than four separate ones. The FATF evaluation gives Colombo both a deadline and a template: beneficial-ownership transparency, effective prosecution and supervised remittance channels are precisely what starve a scam economy of its plumbing. Enforcement, meanwhile, must keep distinguishing the trafficked from the traffickers; screening detainees for signs of coercion is what turns a raid into intelligence about the organisers. And because the workforce, the victims and the profits all cross borders, so must the response: Beijing has pledged closer cooperation with Sri Lankan law enforcement, and Delhi, Kathmandu and Hanoi have as much reason to join, with their citizens both in the holding cells and on the victim lists. Done together, these measures would deny the industry what it needs most – a compliant host – and, pursued jointly with regional partners, they would shrink the map of places left to run to.
While Cambodia faces the complex dismantling of a deeply entrenched system, Sri Lanka has the opportunity to prevent criminal networks from infiltrating its property markets and businesses. Colombo’s actions will determine whether the island remains a temporary refuge or becomes a lasting part of Asia’s cybercrime landscape.
