Sri Lankan law enforcement has intensified its battle against organised cybercriminal enterprises, with police announcing the arrest of 1,093 foreign nationals involved in online fraud and financial crimes across 27 separate operations so far in 2026. The sharp escalation signals both the growing sophistication of cross-border digital crime networks and a determined governmental response to dismantle operations that have extended their reach far beyond the island's shores.
Police spokesperson F.U. Wootler revealed the figures during a media briefing on Thursday, underscoring how cybercrime has evolved into one of the most pressing security threats facing the South Asian nation. The operations represent coordinated efforts guided by Sri Lanka's Defence Ministry and Inspector General of Police, reflecting the scale at which authorities now view digital fraud as a national security priority rather than merely a law enforcement matter.
The trajectory of arrests demonstrates an alarming acceleration in foreign criminal involvement on the island. In 2024, Sri Lankan police documented 573 arrests linked to cybercrime across 26 incidents, while 2025 saw only 26 foreign nationals arrested in two separate cases. The explosion to 1,093 arrests in 2026 suggests either a dramatic intensification of criminal activity or a marked improvement in police detection and enforcement capabilities—likely a combination of both factors.
According to police briefings, these international scam networks have developed sophisticated operational models that leverage digital platforms, social media channels, and online financial systems to prey on vulnerable victims both within Sri Lanka and across neighbouring countries. The regional dimension carries particular relevance for Malaysian policymakers and security agencies, as such networks typically operate across multiple Southeast Asian jurisdictions, targeting expatriates, small business owners, and retail investors throughout the region.
A striking pattern has emerged in how these criminal enterprises conduct their activities. Rather than operating purely from remote locations, organised gangs have systematically rented residential houses, apartment complexes, hotel rooms, and commercial spaces to establish physical bases from which they coordinate their fraudulent operations. This hybrid approach—combining digital sophistication with traditional physical infrastructure—allows criminals to maintain operational continuity, store equipment, and conduct team coordination activities while maintaining plausible deniability about their true purpose to landlords and authorities.
In response, Sri Lankan police have implemented a multi-pronged strategy that extends beyond traditional arrests and prosecutions. Authorities are actively pursuing deportation and repatriation procedures for foreign nationals apprehended in these operations, effectively dismantling criminal cells by removing key personnel from the country. This approach prevents these individuals from immediately resuming operations or relocating to other jurisdictions within the region.
Recognising that property infrastructure serves as critical enablement for cybercriminal networks, police have launched a community-engagement campaign targeting landlords, homeowners, hotel operators, and commercial property owners. Officers are urging this stakeholder group to exercise heightened diligence when evaluating prospective tenants from foreign countries, emphasising the importance of rigorous identity verification and document authentication before leasing arrangements are finalised.
Legal obligations underscore these recommendations. Property owners in Sri Lanka face statutory requirements to notify the nearest police station whenever foreign nationals take up residence or vacate premises under their ownership or management. This notification framework creates an early-warning system that allows police to monitor patterns of short-term foreign occupancy that might indicate criminal activity, while simultaneously imposing accountability on property owners who facilitate criminal operations through negligence or complicity.
The implications of Sri Lanka's cybercrime surge extend throughout Southeast Asia, where similar networks frequently operate across porous digital borders. Malaysian law enforcement and intelligence agencies have documented comparable patterns involving foreign-based scam operations targeting Malaysian citizens and businesses. The Sri Lankan experience demonstrates both the vulnerability of the region to organised international cybercrime and the potential effectiveness of coordinated, intelligence-led enforcement approaches that combine traditional police work with community mobilisation and strategic deportations.
The data released by Sri Lankan police also highlights troubling questions about visa and immigration control procedures. The fact that 1,093 foreign nationals could establish themselves sufficiently in the country to operate sophisticated scam networks raises concerns about whether screening processes adequately identify individuals with criminal intent or prior involvement in cybercrime. This carries direct implications for regional immigration cooperation and information-sharing protocols that Malaysia and other ASEAN nations maintain with Sri Lanka and broader international law enforcement bodies.
Looking forward, Sri Lanka's aggressive approach to dismantling cybercriminal infrastructure offers a potential model for other regional governments grappling with similar challenges. By treating cybercrime as a national security matter worthy of coordinated Defence Ministry involvement, by targeting the physical infrastructure that enables digital crime, and by mobilising the private property-owning community as force multipliers for law enforcement, Sri Lanka has demonstrated that organised online scam networks, while technically sophisticated, remain dependent upon real-world logistical support systems that can be systematically disrupted.
For Malaysian readers and policymakers, the Sri Lankan experience underscores an uncomfortable reality: cybercriminal networks operating against targets in Malaysia frequently maintain operational bases in neighbouring countries, including Sri Lanka. As digital fraud increasingly merges with transnational organised crime, regional security cooperation and intelligence-sharing become essential. Sri Lanka's willingness to conduct aggressive enforcement operations and publicly disclose the scale of foreign criminal activity sets an example that other Southeast Asian nations might productively emulate in their own cybersecurity strategies.
