Executive Summary: Displacement Has a Destination

For three years the story of transnational scam compounds has been a Southeast Asian story — Myawaddy, Sihanoukville, the Golden Triangle SEZ. Through 2025 and into 2026, sustained pressure from Chinese, Thai and Cambodian authorities finally began to make those locations uncomfortable.

The industry did not shut down. It moved.

In 2026, Sri Lanka has become one of the clearest destinations for displaced scam operations — and the numbers show how quickly it happened. Sri Lankan police report that more than 1,000 foreign nationals were arrested from scam centres in the first five months of 2026, against roughly 430 arrests in all of 2024 and fewer still in 2025. First-quarter arrests alone exceeded half of the entire 2025 total. Analysts tracking the trajectory expect the year to close above 600 recorded cases, exceeding 2024 and 2025 combined.

This is not a country slowly developing a fraud problem. It is a country that had a fully-formed foreign fraud industry arrive on its doorstep in about eighteen months.

The Raids: A Timeline of an Invasion

The 2026 enforcement record reads like a map of the takeover.

March 2026 — 135 Chinese nationals arrested in scam operations.

April 2026 — 152 foreign nationals, primarily Chinese, arrested at a hotel in Chilaw, on the west coast north of Colombo, which police found operating as a functioning scam centre.

2 May 2026 — Rajagiriya, Colombo. Officers raided a multi-storey residential complex on Meda Welikada Road and detained around 120 foreign nationals from China, Vietnam, Malaysia, Cambodia, the Philippines, Thailand and Madagascar. Laptops and mobile phones were seized.

3 May 2026 — Talangama, Colombo. 37 Chinese nationals arrested; police confiscated 35 tablets, 147 mobile phones and 100 SIM cards.

12 May 2026 — police announced a further 221 foreigners arrested across four locations, the majority Indian nationals.

Two details in that record matter more than the headline counts. The first is the nationality spread at Rajagiriya — seven countries in one apartment block, including Madagascar. That is the signature of a mature trafficking pipeline, not a local operation. The second is the hardware ratio at Talangama: 147 phones and 100 SIM cards for 37 people. This is industrial account-farming infrastructure, the raw material of pig-butchering and investment fraud at scale.

Why Sri Lanka

Every relocation decision comes down to friction, and Sri Lanka offered less of it than the alternatives.

Visas. Sri Lanka’s tourist visa regime is unusually accommodating — 30 days on arrival, extendable up to six months. For an operation that needs to rotate dozens of foreign workers through a location continuously, that is close to ideal, and it requires no forged documents or corrupt border arrangement.

Connectivity. The island has dependable, high-speed telecommunications infrastructure. Scam centres are, fundamentally, call centres; bandwidth is a hard requirement, and it is the thing the Myanmar border regions could never reliably supply.

Cost. Sri Lanka’s post-crisis economy left affordable housing and commercial space widely available, including the kind of multi-storey residential blocks and off-season coastal hotels that can absorb a hundred workers without attracting notice.

Law. Sri Lanka’s cybercrime legislation predates the modern compound model. It was not written with pig butchering, romance-investment hybrids, or organised transnational scam centres in mind, and prosecutors are working with tools designed for a different era of offence.

That combination — legal entry, good internet, cheap space, dated law — is exactly the profile the industry looks for.

What They’re Actually Running

The operations raided in Sri Lanka are not primarily targeting Sri Lankans. They are export businesses, running the standard modern playbook against victims in wealthier markets:

Pig butchering (romance-investment fraud) — long-form relationship building over messaging apps, moving into a fake trading or crypto platform showing fabricated gains, ending when the victim tries to withdraw.

Fake investment platforms and illegal gambling sites, which double as laundering channels as well as fraud products.

Account and identity farming — the SIM and handset volumes seized suggest bulk creation of verified accounts on social, dating and financial platforms, which are themselves a saleable commodity.

The Indian-national arrests in May point to a second, distinct stream: operations aimed at the Indian market, which has its own enormous domestic fraud economy and a shared language and time zone advantage.

The Human Question

Sri Lanka is now confronting the issue every host country eventually faces: how many of the people arrested are perpetrators, and how many are victims?

The Southeast Asian compound model runs substantially on trafficked labour — workers recruited with fake job offers, stripped of passports, and held under debt bondage and physical coercion. The presence of Madagascan and Southeast Asian nationals in a Colombo apartment block is precisely the demographic that has been trafficked into compounds elsewhere.

Sri Lankan authorities have said those responsible will be prosecuted under the country’s Cybercrimes Act. Whether the system can reliably distinguish a network manager from a coerced worker — and whether it has the victim-identification and repatriation machinery to act on that distinction — is the open question of the next twelve months. Getting it wrong means prosecuting trafficking victims as fraudsters.

The Other Front: Sri Lanka as Target

While foreign networks set up on the island, Sri Lankan institutions were being attacked directly. Between December 2025 and March 2026, the Ministry of Finance’s External Resources Department suffered an email system compromise — a classic business email compromise against government payment flows. Investigators recorded USD 2.5 million diverted from an Australia-bound payment, USD 625,000 missing from a US Postal Service payment, and a further attempted interception of a payment to India that was successfully blocked.

That is a reminder that the compound story and the fraud-victim story are not separate. A country hosting fraud infrastructure is not thereby protected from it.

Protecting Yourself

If you are in Sri Lanka and encounter an unusual concentration of foreign nationals in a residential or hotel property, report it. Local tips have driven several of the 2026 raids. The Sri Lanka CERT and police cybercrime division take reports.

Treat any job offer involving relocation to Sri Lanka, Cambodia, Myanmar or Laos for “customer service,” “data entry,” or “crypto support” as a trafficking risk. Verify the employer’s legal registration independently, never surrender your passport, and tell someone at home your exact address before you travel. Legitimate employers do not confiscate documents on arrival.

For everyone else: the compound moved, the script didn’t. If someone you met through a dating app, a wrong-number text, or a social platform introduces you to a trading or crypto opportunity, it is a pig-butchering approach regardless of which country the servers sit in. No exceptions, no matter how long you have been talking.

Verify withdrawals early and small. The single most reliable test of a trading platform is attempting a small withdrawal in the first week. Delays, fees, “tax clearances,” or requests for a further deposit to release funds mean the money is already gone.

For organisations: BEC is still the highest-value attack going. The Sri Lankan finance ministry losses came from email compromise, not malware. Enforce out-of-band verification on every change to payment instructions, no matter how senior the sender appears.

Sri Lanka’s experience is the clearest available proof that crackdowns on scam compounds displace the industry rather than end it. The next host country is already being evaluated on visas, bandwidth, rent, and the age of its criminal code.