“I deposited money to receive a gift based on a message received on my social media account. I completely trusted their conversation. After that, I put money into it. However, suddenly a large sum of money in my bank account was transferred to another account. I could no longer reach the telephone number of the person who contacted me. Later, I realized that I had fallen victim to a large-scale scam.” This is just the story of one citizen in Sri Lanka who fell victim to a computer financial fraud. According to official data obtained under the Right to Information Act (RTI) from the Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT), 7,431 complaints regarding computer financial frauds alone were received by the organization between 2022 and July 31, 2026. Against the backdrop of our investigative revelations regarding the growing computer financial crimes in Sri Lanka and the foreign nationals, predominantly Chinese citizens, and local criminals behind these syndicates, the police have managed to arrest yet another group of computer financial criminals operating in Sri Lanka in recent days.
The Dangerous Growth of Cybercrimes and CERT Data Analysis
CID data confirms that a large number of illegally operated call centers (Illegal Call Centers / Boiler Rooms) operate secretly behind the rapid rise of cybercrimes and computer financial frauds in Sri Lanka. Following the severe crackdowns in Southeast Asian countries, these international criminal syndicates have decentralized their main operational hubs to Sri Lanka. The number of online financial fraud complaints reported to the Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT) has grown massively year by year: However, analysis of the data and information officially provided by all these institutions makes it clear that these activities are spearheaded by an organized group led by Chinese nationals. Accordingly, the data analysis shows that 1,427 complaints were recorded in 2022. In 2023, complaints stood at 1,609, and CID raids led to the arrest of several local criminals, including 7 foreign nationals. In 2024, complaints to Sri Lanka CERT surged to 2,241, while CID raids resulted in the arrest of 253 foreigners (132 of whom were Chinese nationals). Similarly, 1,817 complaints were reported in 2025. Up to July 31, 2026, 337 complaints have been received, and by April 3, 2026, alone, 292 foreigners had been arrested (152 of whom were Chinese nationals).
The fact that 284 out of the total 408 individuals arrested during raids conducted by the Computer Crimes Investigation Division of the Criminal Investigation Department (CID) from 2021 to July 31, 2026, were Chinese nationals (69.6%) clearly highlights the primary force behind this racket. Additionally, 59 Sri Lankans and 49 Vietnamese nationals were also arrested during these operations.
The Cyber Attack Targeting the General Treasury
This network does not stop merely at defrauding individuals. A massive blow has been dealt to the country’s economy through the disappearance of a large sum of US$ 2.5 million from the domestic General Treasury via a fake email domain (exportfinance-av.com), alongside the daily plundering of large sums of money and individuals’ privacy in the country, and the use of SIM Boxes by these criminals to send fake messages to thousands of people at once. This financial irregularity was executed by deceiving General Treasury officials while paying a loan installment obtained under Australian financial facilities. Complaints regarding these frauds occurring against the public at the regional level are frequently made at a very low level. A primary reason for this is that police officers stationed at many division levels lack sufficient knowledge to apprehend these criminals, and even when complaints are made, proper investigations are often not carried out.
Modus Operandi and Threats to Privacy
These criminals lure foreigners to the country by advertising high-paying jobs like ‘Data Entry’ or ‘Online Marketing’ via social media, confiscate their passports, and hold them like slaves inside isolated luxury hotels and bungalows (in areas such as Hanthana, Iranawila, and Panadura). Not only that; through a method known as “Pig Butchering” (financial investment scams), they build romantic relationships or close friendships with targets, trick them into depositing money into fake cryptocurrency platforms, and then disappear with the funds. Furthermore, by hacking WhatsApp and Facebook accounts via Phishing links, rackets involving depositing money into private bank accounts in Sri Lanka from the victims’ acquaintances are continuously operated with the assistance of local and foreign criminals.
Solutions and International Cooperation
If we are to defeat this dark network and prevent Sri Lanka from becoming a haven for cybercriminals, we must act immediately. Strict attention must be paid to making it mandatory to report the visa and employment details of foreigners to the local police when renting houses or apartments to them. Strict control over the importation of SIM Box equipment, limiting the number of SIM cards an individual can obtain, establishing a tracking mechanism for Chinese nationals visiting the country by joining hands with global cybersecurity networks such as APCERT (Asia Pacific CERT) and FIRST, and setting up joint cyber investigation units with Chinese and Indian security forces along with Interpol. The government must also act to urgently revise cyber laws and digital crime investigation mechanisms to suit current technological requirements. Ensuring national security and safeguarding the security of the citizens of this country by preventing our motherland—once known as the pearl of the Indian Ocean and a tourist paradise—from becoming a “digital sweatshop” for international cybercriminals is the responsibility of everyone.
(Rahul Samantha Hettiarachchi)