As Cambodia’s scam compounds come under siege, the criminal networks behind them are testing a new island base

July 2026

Organized crime rarely disappears under pressure — it relocates. That basic rule is now reshaping the geography of Asia’s online fraud industry. As Cambodia, squeezed by both Beijing and Washington, starts dismantling the fortified compounds that made it synonymous with cyber-scam operations, the networks behind those compounds are scouting new territory. The evidence increasingly points to one destination in particular: Sri Lanka.

The Numbers Tell the Story

The scale of the shift is hard to ignore. Since the start of 2026, Sri Lankan police have arrested more than a thousand foreign nationals suspected of involvement in cyber fraud — a dramatic jump from roughly 430 arrests across the whole of 2024. Most of those detained are Chinese, Vietnamese, and Indian nationals.

To put the Cambodian side of the equation in perspective, the US Institute of Peace estimates the scam industry there generates roughly $12.5 billion a year — equivalent to about half the country’s formal economy — with senior officials and business elites reportedly benefiting from its proceeds. A 2022 decision to remove Cambodia from the Financial Action Task Force’s money-laundering “grey list” arguably made it easier for illicit funds to move through the country’s financial system.

Why Sri Lanka, Specifically?

Sri Lanka offers a combination of conditions that make it unusually convenient for displaced scam operators. The island maintains relaxed entry rules for visitors from dozens of countries and is actively working to expand visa-free travel as part of its tourism recovery strategy. It also has fast, reliable internet infrastructure and no shortage of rental property in its cities and along the coast.

Crucially, Sri Lanka is still recovering from the worst economic crisis in its history since independence. That leaves landlords eager for tenants and few intermediaries willing to ask hard questions of foreign renters who pay well and on time. Because the state maintains full control over its territory — unlike the more porous border regions of Myanmar — operators in Sri Lanka can’t build the walled, fortress-like compounds seen elsewhere in the region. Instead, reporting suggests they operate covertly: wiring an apartment for a few weeks of activity, then abandoning it the moment police attention gets too close.

Investigators have also flagged concerns around undiyal, an informal money-transfer system functionally similar to hawala, as a channel that could make illicit financial flows harder to trace.

A Pattern of Displacement, Not Disappearance

Sri Lanka isn’t the only landing spot. Reporting indicates that networks previously based in Myanmar, Cambodia, and the Philippines have all contributed to the buildup of operations now surfacing on the island. Fraud compounds of this kind typically run several schemes in parallel — romance scams, fake cryptocurrency investment platforms, and so-called “pig butchering” schemes that slowly build a victim’s trust before draining their finances.

Beijing’s embassy in Colombo has publicly acknowledged the trend, noting that illicit activity in Sri Lanka appears to have increased following enforcement actions in Cambodia, Myanmar, and the United Arab Emirates, and pledging closer cooperation with Sri Lankan law enforcement. Sri Lankan officials, meanwhile, have begun warning property owners that renting space to suspected scam operators could expose them to prosecution for aiding criminal activity.

It’s Not Just About Nationality

While many of those arrested in Sri Lanka are Chinese nationals, framing this purely as a nationality issue risks missing the more important structural point: scam operations flourish wherever local systems allow them to, regardless of who runs them. Foreign operators typically bring capital and, in the worst cases, trafficked labor — but their operations depend just as heavily on local landlords, fixers, and, in some documented cases, complicit officials who provide cover.

This matters because it’s also worth remembering who ends up staffing these operations on the ground. A UN human rights report issued this year documented torture, sexual violence, and forced labor inside scam compounds across Southeast Asia, with estimates suggesting at least 300,000 people have been trafficked into this system. Sri Lankan authorities say they haven’t yet identified evidence of foreign nationals being trafficked into compounds on the island itself, though dozens of Sri Lankans have been rescued from scam operations abroad over the past year.

The core policy question isn’t whether foreign criminal networks are present — it’s whether local conditions make it easy or hard for them to operate. That answer is still being written.

Enforcement Gaps: Deportation Isn’t Prosecution

One structural weakness already showing up in Sri Lanka’s response: many enforcement actions end in deportation rather than criminal prosecution, allowing suspects to avoid facing trial altogether. Analysts and digital rights advocates have urged Sri Lankan authorities to strengthen cybercrime legislation, deepen intelligence-sharing with regional partners, and expand public-awareness efforts aimed at communities vulnerable to recruitment into these schemes — including Sri Lankans themselves, given the country’s ongoing economic strain and youth unemployment.

Local Sri Lankan citizens aren’t only potential recruits into scam operations; they’re also frequent targets. Authorities have separately warned of SMS and WhatsApp scams impersonating government platforms to harvest bank details and one-time passcodes, along with a range of phishing schemes that spoof caller IDs, mimic official bank promotions, and even impersonate senior government officials.

A Narrow Window

Cambodia’s challenge now is dismantling a deeply entrenched system, one interwoven with elite economic interests and years of institutional tolerance. Sri Lanka’s situation is different — and arguably more favorable. Because these networks are only beginning to test the island as a base, the state still has a genuine opportunity to prevent them from becoming embedded in its property markets and business networks before they reach Cambodia-level entrenchment.

Whether Colombo seizes that opportunity will determine a great deal: whether Sri Lanka remains a temporary stopover for displaced criminal networks, or becomes a durable and lasting part of Asia’s cybercrime landscape. The early numbers — arrests up more than twofold in a matter of months — suggest the window for decisive action is open, but likely won’t stay that way indefinitely.