If you’ve received a suspicious call from someone claiming to be from your bank, Amazon, a government agency, or a cryptocurrency investment company, there is a real chance that call originated from a building much like the one Sri Lanka police raided in Colombo this week.
Sri Lanka authorities arrested 37 Chinese nationals — aged 23 to 44 — operating a sophisticated online fraud center in the country’s capital. The suspects had entered Sri Lanka on tourist visas and were working without authorization. The raid, which concluded by May 5, 2026, is one of the most significant fraud compound busts in South Asian history — and it signals a geographic shift in how criminal scam networks are organizing themselves.
What Is a Scam Center?
For readers unfamiliar with the term, a scam center (also called a scam compound or fraud factory) is a physical facility — often resembling a corporate call center — where workers make high volumes of fraudulent contact with potential victims. They operate shifts. They have managers. They use scripts. They have targets.
Inside a typical operation, workers are assigned to specific scam types — investment fraud, technical support scams, romance scams, customs impersonation, or government agency impersonation — and spend eight to twelve hours per day contacting people via phone, text, messaging apps like WhatsApp and Telegram, and social media. The most sophisticated operations maintain entire fake personas over weeks or months before attempting to extract money.
Workers are recruited from across Asia, often lured by fake job postings promising legitimate work in customer service or IT. Some arrive voluntarily; others are trafficked. Both categories end up doing the same thing: running scams against people who live thousands of miles away.
Why Sri Lanka, and Why Now
For the past several years, the global epicentre of scam compound activity has been Southeast Asia — particularly Myanmar’s Kokang region, the Cambodia-Thailand border zone, and parts of Laos and the Philippines. Billions of dollars in annual fraud revenue have flowed through these locations.
But international pressure is working — at least partially. INTERPOL’s Operation Shadow Storm, US Treasury sanctions, and coordinated pressure from China (which has pushed Myanmar authorities to crack down on compounds that defraud Chinese nationals) have made these traditional hubs significantly more hostile.
The response from criminal operators has not been to stop. It has been to move.
Sri Lanka offers several things the Myanmar-Cambodia corridor increasingly doesn’t:
- Relative political stability and less international scrutiny (until now)
- Tourist visa access for Chinese nationals, which provides easy entry cover
- English-language infrastructure — Sri Lanka’s bilingual workforce makes it easier to run scams targeting English-speaking victims in the US, UK, Canada, and Australia
- Proximity to India — one of the world’s largest pools of scam targets, particularly for tech support and customs scams
- Less developed fraud enforcement capability compared to countries that have been dealing with this problem for years
The Sri Lanka bust follows a clear pattern: Colombo has been appearing more frequently in fraud-adjacent contexts over the past 12 months. This is not an isolated incident — it is an early indicator.
The Tourist Visa Entry Vector
The 37 arrested suspects entered Sri Lanka on tourist visas — a method that has become standard operating procedure for scam compound staffing across the region. Here is why it works:
Tourist visas are typically available on arrival or through simple online applications. They require minimal documentation — a passport, a return ticket, proof of funds. No employer sponsorship, no background check, no labor registration. A worker can land in Colombo, take a taxi to a rented office building, and be making fraudulent calls within 24 hours.
This entry method is not unique to Sri Lanka. It is how scam centers are staffed across Southeast and South Asia. The countries that have cracked down hardest on it — Thailand, for instance — have done so by requiring employers to sponsor work permits and by increasing scrutiny on Chinese nationals staying beyond tourist visa limits. Sri Lanka’s enforcement in this area was, until this week, essentially nonexistent.
The bust suggests Sri Lankan law enforcement is now aware of the pattern and actively responding. Whether this results in systemic changes to how tourist visa overstays are monitored — or whether it remains a one-time raid — will determine whether Sri Lanka becomes a scam hub or manages to avoid that designation.
What This Means If You’re Getting Suspicious Calls
If you are receiving unsolicited calls from numbers with unusual prefixes, or contacts through WhatsApp, Telegram, or Instagram from people you don’t recognize, here is what you should understand:
The person calling you is likely a worker following a script, not an independent scammer. Scam centers operate like businesses. Your caller has a quota, a supervisor, and a payment structure tied to successful fraud completions. They will be persistent, professional-sounding, and patient. That patience is a red flag, not reassurance — legitimate companies do not spend weeks building rapport before asking for money.
The call may sound local but isn’t. Voice-over-IP technology allows scam centers to display any caller ID they choose, including local numbers in your country, numbers that match the IRS, your bank, or Amazon’s customer service line. The number on your screen tells you nothing about where the call originated.
The scripts are updated constantly. Scam center operations track what is working in real time. If Amazon impersonation scams are generating high returns one month and customs clearance scams the next, the scripts change accordingly. Do not assume a scam type that sounds new is therefore legitimate.
Red Flags of a Scam Center Call
- Urgency is manufactured — you’re told you must act now, today, within the hour, or your account will be closed, you’ll be arrested, or your package will be destroyed
- Payment in unusual forms — gift cards, cryptocurrency, wire transfer to a personal account — is always a scam
- They ask you not to tell anyone — banks, family members, or law enforcement — “for your own protection”
- They already know something about you — a name, last four digits of a card, your address — but use it to build false trust rather than to identify themselves to you
- They cannot give you a callback number that you independently verified from the company’s official website
- The “government agent” calls from a non-government number — real IRS, Social Security, or customs agents do not call to demand immediate payment
How to Protect Yourself
- Hang up. If a call seems suspicious, end it. Call the company or agency back directly using the number on their official website or on the back of your card.
- Never give your account numbers, Social Security number, or passwords to someone who called you unsolicited — regardless of what they claim.
- Never pay via gift card. No legitimate government agency, utility company, or business accepts gift cards as payment. Ever.
- Report suspicious numbers to your carrier and to the FTC. This data feeds the call-blocking systems that protect future potential victims.
- Talk to elderly relatives. Seniors are disproportionately targeted and disproportionately impacted. A five-minute conversation about what these calls sound like can save someone their life savings.
How to Report
- US: FTC at reportfraud.ftc.gov or IC3 at ic3.gov
- UK: Action Fraud at actionfraud.police.uk
- Australia: Scamwatch at scamwatch.gov.au/report-a-scam
- Canada: Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca
Sources
- Meyka, Sri Lanka Online Fraud Bust: 37 Chinese Nationals Arrested in Colombo (May 5, 2026)
- INTERPOL Operation Shadow Storm reporting (March 2026)
- UNODC, Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking, and Illicit Cryptocurrency (2024)
ScamWatch HQ keeps consumers ahead of fraud trends. If you’ve been targeted by a scam, report it to the FTC, IC3, or your country’s equivalent.
