View(s): The absence of complainants allows suspects to evade severe punishment under relevant laws; in most cases, they are prosecuted under immigration laws and deported By Namini Wijedasa, Tharushi Weerasinghe, S. Rubatheesan and Sandun Jayawardana In June 2024, the Criminal Investigation Department (CID) received a tip: in an unauthorised “computer lab” at the Lavinia Hotel in Kudapaduwa, Negombo, Chinese nationals were using Telegram, WhatsApp and other internet apps to conduct suspicious money transactions. Top secret The Chinese occupied all three floors of the property for a monthly rent of around Rs 3 million. They used a large room on the topmost level as their office. They financed a new perimeter fence, hired security guards, disabled CCTV and opened a shop inside so residents rarely left. Outsiders were barred. The Sunday Times examined the full record of the now-concluded case. The hotel proprietor, who turned state witness, said that in January 2024 a woman named “Lisa” asked to lease his property for a “technology institute”. An advance of Rs 27 million was paid. A Malaysian (not the one arrested) is named on the lease agreement. When the CID breached the building on June 28, the foreigners had locked themselves inside the third-floor “office”. Police gained access after a period of resistance. They immediately arrested 31 people—30 Chinese and one Malaysian. Nine others had fled. The only female suspect had with her the passport of another woman who wasn’t present. Police informed the Negombo Magistrate’s Court that they seized up to 17 phones per person, several all-in-one computers, two laptops and 19 phones with no identified owner. In the room of the Malaysian suspect were hundreds of unused Dialog SIM cards, in addition to 111 SIMs registered under Sri Lankan names. Chinese help The Attorney General’s Department helped direct investigations. Kelaniya University Chinese-language professors were hired as translators. The Chinese Embassy in Colombo provided assistance, including through a Chinese police investigation team that, among other things, extracted extensive evidence from the devices. The findings were turned over to the Sri Lankan government in a report. Raids are conducted and arrests are made but the scams continue The devices showed how the group enticed people into online chats and built relationships with them. There were chat scripts and guides on conducting conversations. The productions included 31 fake Chinese ID cards and passport photos made from one person’s image, with slightly changed ID numbers and dates of birth; a list of foreign bank accounts; and copies of chats in Skype, WeChat and Telegram. There were at least four conversations with women about daily life. Evidence of Binance activity was also handed over. (Police said money was converted to USDT and moved into foreign accounts). Extensive data Data recovered from the devices revealed, among other schemes, a scripted method for cultivating relationships with women online, moving conversations to private messaging and introducing the prospect of additional income. A “friend-making” guide outlines a persona for a man approaching a woman he has met online. He is presented as a fit, kind-hearted 30-year-old divorcee who is lonely after his wife emigrated. He has a daughter and lives with his parents in Zhuhai, China. The conversation uses lines such as “fate brought us together”. It suggests moving to a private WeChat because “my work and life are often separate”. The operator is encouraged to offer comfort, compliment the woman’s eyes and lips, and exchange photographs. One suggested line reads, “What I hate most is people who cheat and betray.” The character claims to sell high-end red wine from a Zhuhai showroom and to have interests in real estate, tourism and prepared dishes. The script then branches according to the woman’s occupation—housewife, employee, stay-at-home mother or self-employed—and whether her income is good or average. The woman would be asked if she lives alone, the distance between her home and workplace, and whether she drives. The persona claims to own a Porsche Panamera and a Toyota Alphard. No action on computer crime The Lavinia Hotel file was one of the more comprehensive court cases the Sunday Times examined in its six-month-long investigation of alleged Chinese-run scam centres in Sri Lanka. Admittedly, the case needed more police work. But it followed a clear procedure, engaged translators, secured official Chinese assistance and presented some evidence, corroborated by Chinese police investigators, that con games were being run. The CID initially listed the suspects under the Penal Code for having carried out cheating offences; under the Computer Crimes Act; and the Prevention of Money Laundering Act. But the Hotel Lavinia case is a textbook example of why Sri Lanka has repeatedly failed to successfully prosecute any transnational cyber scam cases. The defence maintained the suspects did digital marketing, collecting data and selling it to marketing companies, and that the SIM cards were not in use. They questioned gaps in the evidence. And they successfully argued that there was no complainant, as required by the cheating sections of the Penal Code. The suspects were only charged under the Immigration and Emigration Act, either for not having a valid visa or for failing to comply with the conditions of their visa/entry endorsement. Some had expired work visas. The others were on tourist visas. All were deported. The State said that any computer crime or money laundering charges would be brought in the High Court, not the Magistrate’s Court, and would happen after further investigation, including analysis of the devices by the Government Analyst’s Department and the CID Computer Crimes Division. This hasn’t happened yet. Sri Lankan victims U8 brand item at a restaurant Some cases do have Sri Lankan complainants. In August this year, the AG indicted six people in the Colombo High Court over an online investment scheme which alleges it took more than Rs 9.1 million from 15 people, promising them returns in cryptocurrency. Two of the accused are Sri Lankan. The other four are Chinese, who will be tried in absentia—because when the case (20955/01/24) was before Colombo Chief Magistrate Thilina Gamage, he granted the defence’s request to lift the travel ban imposed on them. And they left the country. The High Court indictment alleges that the first accused, a Sri Lankan, set up social media groups on WhatsApp and Telegram under the name “Web Lanka Digital Marketing 38″, which he used to promote investment schemes online, claiming those who deposited money would receive returns in cryptocurrency. Called “TikTok task” scams, recruiters promise high daily earnings for simple online actions, such as liking videos or boosting posts. Small payments are made to build trust. Victims are then persuaded to deposit their own money to access higher-paying tasks or to withdraw supposed earnings. Once larger sums are transferred, accounts are frozen, further payments demanded or victims blocked. The individual losses of the 15 complainants range from Rs 19,290 to more than Rs 5.85 million. The first accused faces one cheating charge under Section 403 of the Penal Code for each complainant. The other five are each charged with abetting every one of those offences. The indictment also brings charges under the Prevention of Money Laundering Act, alleging that between June 1 and 24, 2004, in Colombo and Negombo, the accused conspired with others unknown to the prosecution to launder the Rs 9.1 million by receiving or investing it in Sri Lanka or abroad. Among the 74 witnesses named, one has an address in Nanning, China, while two Pakistanis—who were employed as cooks—are listed with refugee registration numbers issued by the UN refugee agency, UNHCR. Enter U8 A U8 brand sticker on a tuk-tuk On May 2 this year, the Welikada police raided a heavily guarded seven-storey building in Medawelikada Road, Rajagiriya. They arrested 120 foreigners—89 men and 31 women. Among them were Chinese, Vietnamese, Malaysian, Madagascan, Filipino, Thai and Cambodian nationals. Of the suspects, 92 entered on business, tourist or residence visas, while 28 allegedly had no travel documents. The DIE told police that business visas do not authorise employment in Sri Lanka. We attended a hearing at Magistrate’s Court No. 4, Hulftsdorp. Reporting facts was Chief Police Inspector Saman Jayasinghe, then Officer-in-Charge of the Welikada police station. Reading from the B report—which called the place a “cyber farm”—he alleged the group ran an internet fraud, tricking people into transferring money between bank accounts. Some escaped from the fifth floor, taking laptops and phones with them. Money was found at the scene. The location was sealed off. Neither the area grama niladhari nor officials of the Kotte Pradeshiya Sabha could enter. Two defence bail lawyers said three other companies connected to the raided operation are King Kong (Pvt) Ltd, Tengle Electronics Technology Co (Pvt) Ltd and Knight Global (Pvt) Ltd. Computers on the first, second and fifth floors had internet access and were linked to a common server. Each floor had a supervisor, with staff working 6am and 6pm shifts. Some were driven from Kollupitiya, Bambalapitiya and Dehiwala in luxury, air-conditioned vans with darkened windows; others lived on the premises. The operation provided food, transport and security guards. Seven witnesses gave statements: security guards, cleaners and an electrician, all of whom said they didn’t know what work was being done there. U8 branding appeared on carpets and serviettes. The online gambling platform offers sports betting, casino games, slots and card games. The same livery was spotted at a Negombo restaurant during our inquiries into suspected scam centres there. U8 branding also features on hoardings along the Colombo-Katunayake Expressway and stickers on three-wheelers. Food was delivered by U8GF.COM, which is an instance of U8. All suspects were subsequently released. Our attempts to get a case update from police failed. Whither the police? On May 27—just 25 days after the raid—CI Jayasinghe was arrested by the Colombo Central Crime Investigation Bureau (CCIB) allegedly for extorting money from Chinese nationals (of the same case) in exchange for the return of their passports. After a spell in remand, he was transferred to the Police Field Force. The CCIB investigation alleged that CI Jayasinghe retained 19 passports without recording them as police productions are reporting them to court at the appropriate time. He is accused of using a female intermediary to collect money (allegedly Rs 300,000 for each travel document) from the passport holders. It was not immediately clear whether charges had been filed in court against the former OIC. It became clear during the course of our reporting that authorities must take a closer look at possible corruption across the police force, in connection with suspected scam centres. Cybercrime sleuths face uphill task in unravelling scamsAccessing devices and analysing data remain major challenges for Sri Lankan law enforcement.“The volume of devices in each raid is so high, usually about 200 phones and laptops, and we simply do not have the resources to process all of them,” said Assistant Superintendent of Police Chandima Arumapperuma, head of the Computer Crime Investigation Division (CCID).The CCID relies on its own barebones facility and an overburdened Government Analyst’s Department. The US Federal Bureau of Investigation recently sent a small number of devices to Thailand for analysis. The FBI partners with the Royal Thai police and national leadership on intelligence exchanges, joint investigations, and regional anti-scam efforts. The outcome of the analysis is not known. “We take random samples from every raid and send them either to the Government Analyst, our inhouse facility or CERT [Sri Lanka Computer Emergency Readiness Team],” ASP Arumapperuma said. The CCID uses phone-reading software, but its licence is limited because of privacy and human rights concerns, and the provider has restricted clearance for Sri Lanka. “CERT has not given us any reports yet, and this is why courts also don’t have a lot of evidence to rule on and prosecute with,” she said. A shortage of translators is another obstacle: “The [Chinese] embassy has offered to fund translators but we have trouble finding them, so getting statements from suspects has been hard.” Suspected scam centres have operated in Colombo and Kandy since 2021/22, ASP Arumapperuma said. Passports of many foreign suspects showed previous travel to Cambodia and Myanmar, established scam hubs. Operations initially centred on rural areas, with raids reported in Mihintale, Anuradhapura, Ambakandawila, Iranawila, Midigama, Hikkaduwa, Aluthgama, Kalpitiya, Negombo, Gandara, Thalalla, Dungalpitiya, Baddegama, Waskaduwa, Teldeniya and Chilaw, among other locations. One raid earlier this year uncovered signs of “pig-butchering” scams on some devices. These combine online investment and romance fraud, with criminals cultivating victims’ trust and affection over weeks or months before stealing their money. “We found evidence of fake dating,” ASP Arumapperuma said. “It could be one of the more successfully prosecuted cases. They also had translation machines on site.” In May, the Sunday Times attended Fort Magistrate’s Court proceedings involving 74 Vietnamese nationals arrested at a Kollupitiya housing complex on Uttarananda Mawatha. The group comprised 41 men and 33 women, aged 19 to 39. Police alleged they were involved in online financial scams and computer-related offences, in breach of their visa conditions. A Peruvian woman who provided Spanish translation services was also arrested but released on bail earlier. The court was told the purported targets of the scams were Spanish speakers. Suspects are generally arrested for immigration offences, ASP Arumapperuma said. During raids, virtual servers are often switched off remotely, passwords withheld and physical servers are nowhere to be found. Internet connections typically run through Dialog, SLT or Starlink. “We have also been unable to trace how the devices enter Sri Lanka, as nobody claims ownership once they are confiscated,” she said. With inadequate storage facilities, police sometimes have to keep confiscated devices in sealed rooms at the premises where they were found. “Investigations are underfunded and there are no laws to prosecute,” she said. “The Attorney General says the Computer Crimes Act only applies to Sri Lankans. They recommend deportations, so the onus is on the Immigration Department to ensure those applying for visas have legitimate documents.” “Not a single scam case has yet been proved in court,” ASP Arumapperuma said. Some suspects are issued “court visas” allowing them to remain in Sri Lanka until proceedings conclude, but these do not prevent them from working. Police have also found no evidence of trafficking, she said. “And if there is no immigration violation or crime prosecutable under Sri Lankan law, the raids also have no result,” she said. With the Sunday Times observing a recent decline in police raids, and allegations that the Welikada OIC extorted Chinese nationals, we asked whether corruption was a factor. “CIABOC [Commission to Investigate Allegations of Bribery or Corruption] runs disciplinary inquiries into police officers who are accused or suspected of accepting bribes in relation to scam centres,” ASP Arumapperuma said. “We have not been asked to stop raid but there seem to be less people coming in.” China court cases highlight Lanka connection Chinese court judgments provide evidence of links between Sri Lanka and Chinese online fraud networks dating back to at least 2020, with the country variously serving as an operational base, a relocation destination and a market targeted by fraudsters. Five judgments published on China’s online judicial database, covering offences between 2019 and 2024, detail how criminal groups operated across several countries, recruited participants and moved proceeds from fraud. The clearest evidence of operations in Sri Lanka comes from a Cixi City Court judgment in Zhejiang Province in January 2021. Seven Chinese nationals convicted in the case travelled to Sri Lanka between February and May 2020 and joined a fraud syndicate organised by individuals identified as “Brother Cai” and “Old Boss Chen”. The gang lured victims into stock-market discussion groups, posing as investment mentors and successful traders before directing them to deposit money through Fuqiang Securities, a fake trading app. While the defendants were in Sri Lanka, five victims lost a combined RMB 2.517mn (about US$365,000). All seven received prison terms of three to four-and-a-half years and were ordered to pay RMB 595,000 in restitution. A Shanghai court judgment in August 2025 sentenced a man to four years and three months for fraud, finding that he had joined the Oriental Group, also known as the KG Group, in the Philippines in March 2022. The case points to Sri Lanka becoming a destination for relocated criminal operations. The group targeted Chinese nationals through social media and investment chat groups, directing them to a fraudulent stock-to-lottery platform and persuading them to make increasingly large deposits. One victim lost more than RMB 2mn and another RMB 4.9mn. Around October 2024, the group moved from the Philippines to Sri Lanka and Malaysia, with the convict accompanying it. He remained abroad until returning to China in March 2025, when he was arrested. The judgment does not specify which members moved to Sri Lanka or Malaysia, or what the convict did here. Both documented frauds predated the relocation, but his conviction establishes his membership of a group that subsequently moved operations to Sri Lanka. A third judgment shows Sri Lankans being targeted by a Chinese-based operation. In July 2022, a man identified as Liu X agreed to act as an agent for an online platform called “shopeest”, defrauding people in Sri Lanka. He rented premises in Ji’an, Jiangxi Province, and recruited six others. The platform offered rebates for completing online tasks but demanded security deposits to advance to higher membership levels. Once sufficient money had been collected, it would shut down and retain the deposits. Liu persuaded Sri Lankan customers to deposit money and recruit others, while his associates handled administration, technical coordination and customer service. Between July and September 2022, the operation sent 120,694 fraudulent messages before Chinese police uncovered it. All seven were convicted of attempted fraud because the scheme was stopped before money was collected. Liu received five years in prison; the others were sentenced to between 10 months and three years and four months, with some sentences suspended. A February 2026 Sichuan court judgment identified Colombo as one of the locations where Chuangshi Technology operated and recruited workers between 2021 and 2024. The defendant, however, worked at the group’s sites in Laos and never visited Sri Lanka. He received a seven-month suspended sentence for fraud. A separate 2021 money-laundering conviction concerned a victim in Sri Lanka who lost RMB 170,904 in an online foreign-exchange investment scam in October 2019. Seven Chinese nationals were convicted of concealing and transferring the proceeds, most of which passed through bank accounts and cash withdrawals in China’s Fujian Province. None of the five judgments identifies a specific building or company in Sri Lanka, establishes who facilitated the groups’ entry or whether local individuals assisted them, or indicates whether Sri Lankan authorities investigated the activities described. Computer Crimes Act: Its scope and limitations Authorities involved in the arrests of suspected scam centre operators claim Sri Lanka’s Computer Crimes Act (CCA)—which was passed in 2007 and never amended—does not cover the offences being committed. Experts, however, dispute this, saying the law is broad enough to prosecute at least some of those involved. The CCA criminalises unauthorised access to computers and computer systems, the theft, alteration, deletion or interception of data, damage to systems and the misuse of information obtained through unauthorised access. It also covers attempts, aiding and abetting, and conspiracy to commit such offences. CCID Director Chandima Arumaperuma claimed the AG’s Department had advised law enforcement authorities that only Sri Lankan nationals could be prosecuted under the Act. However, Section 2 expressly extends its application to “a person committing the offence while being present in Sri Lanka or outside Sri Lanka”. Police Spokesman ASP F.U. Wootler, meanwhile, told the Sunday Times that suspects arrested at scam centres were not being dealt with under the Act because victims had to lodge complaints in person. As most victims were overseas, this posed difficulties, he said. But the Act does not require victims to be in Sri Lanka. Section 2(d) defines a victim as a person resident in Sri Lanka or overseas. Former Sri Lanka-CERT Chairman Jayantha Fernando, who once represented Sri Lanka at the Budapest Cybercrime Convention in Strasbourg, said the Act had broad extraterritorial application and could cover computer-related offences committed against victims overseas. “Section 2 gives the Act broad extraterritorial reach for offences under Sections 3 to 10, including computer-enabled offences such as cheating and criminal misappropriation under other written Sri Lankan laws,” he said. However, Mr Fernando cautioned that applying the Act would depend on the specific offences and the evidence investigators could establish. Section 4, which covers offences under other written laws committed using computers or technology, could present interpretation difficulties where the underlying offence is deemed as such in another country. The Interpretation Ordinance defines “written law” in terms of legislation enacted by Sri Lanka’s own legislature, potentially limiting the application of this provision to offences under Sri Lankan law. Section 3, however, is broadly worded and can cover unauthorised access to information even where the computer system is overseas, Mr. Fernando said. Whether an offence has been committed would depend on whether investigators can establish its specific legal elements. Other provisions could be relevant. Section 8 criminalises illegal interception, while Section 9 covers the use of devices, including computers and programmes, to commit offences under the Act. This could include using such devices to gain unauthorised access under Section 3. The Act also provides investigative powers and mechanisms for international cooperation in obtaining electronic evidence, which can be used alongside the Mutual Assistance in Criminal Matters Act No. 25 of 2002, amended in 2018. But Mr Fernando said amendments to the Computer Crimes Act were long overdue. Reforms had been pursued under successive governments, including the present administration, but progress remained slow. Experts also pointed to shortcomings in investigations, with cases often abandoned before sufficient evidence is collected. The difficulties of obtaining evidence across borders could partly explain why authorities have relied on immigration offences, including visa violations, to deal with foreign nationals arrested at suspected scam centres rather than pursue more complex prosecutions under the Computer Crimes Act. Computer Crimes Act: Its scope and limitationsAuthorities involved in the arrests of suspected scam centre operators claim Sri Lanka’s Computer Crimes Act (CCA)—which was passed in 2007 and never amended—does not cover the offences being committed. Experts, however, dispute this, saying the law is broad enough to prosecute at least some of those involved. The CCA criminalises unauthorised access to computers and computer systems, the theft, alteration, deletion or interception of data, damage to systems and the misuse of information obtained through unauthorised access. It also covers attempts, aiding and abetting, and conspiracy to commit such offences. CCID Director Chandima Arumaperuma claimed the AG’s Department had advised law enforcement authorities that only Sri Lankan nationals could be prosecuted under the Act. However, Section 2 expressly extends its application to “a person committing the offence while being present in Sri Lanka or outside Sri Lanka”. Police Spokesman ASP F.U. Wootler, meanwhile, told the Sunday Times that suspects arrested at scam centres were not being dealt with under the Act because victims had to lodge complaints in person. As most victims were overseas, this posed difficulties, he said. But the Act does not require victims to be in Sri Lanka. Section 2(d) defines a victim as a person resident in Sri Lanka or overseas. Former Sri Lanka-CERT Chairman Jayantha Fernando, who once represented Sri Lanka at the Budapest Cybercrime Convention in Strasbourg, said the Act had broad extraterritorial application and could cover computer-related offences committed against victims overseas. “Section 2 gives the Act broad extraterritorial reach for offences under Sections 3 to 10, including computer-enabled offences such as cheating and criminal misappropriation under other written Sri Lankan laws,” he said. However, Mr Fernando cautioned that applying the Act would depend on the specific offences and the evidence investigators could establish. Section 4, which covers offences under other written laws committed using computers or technology, could present interpretation difficulties where the underlying offence is deemed as such in another country. The Interpretation Ordinance defines “written law” in terms of legislation enacted by Sri Lanka’s own legislature, potentially limiting the application of this provision to offences under Sri Lankan law. Section 3, however, is broadly worded and can cover unauthorised access to information even where the computer system is overseas, Mr. Fernando said. Whether an offence has been committed would depend on whether investigators can establish its specific legal elements. Other provisions could be relevant. Section 8 criminalises illegal interception, while Section 9 covers the use of devices, including computers and programmes, to commit offences under the Act. This could include using such devices to gain unauthorised access under Section 3. The Act also provides investigative powers and mechanisms for international cooperation in obtaining electronic evidence, which can be used alongside the Mutual Assistance in Criminal Matters Act No. 25 of 2002, amended in 2018. But Mr Fernando said amendments to the Computer Crimes Act were long overdue. Reforms had been pursued under successive governments, including the present administration, but progress remained slow. Experts also pointed to shortcomings in investigations, with cases often abandoned before sufficient evidence is collected. The difficulties of obtaining evidence across borders could partly explain why authorities have relied on immigration offences, including visa violations, to deal with foreign nationals arrested at suspected scam centres rather than pursue more complex prosecutions under the Computer Crimes Act. The best way to say that you found the home of your dreams is by finding it on Hitad.lk. We have listings for apartments for sale or rent in Sri Lanka, no matter what locale you’re looking for! Whether you live in Colombo, Galle, Kandy, Matara, Jaffna and more – we’ve got them all! (function(d, s, id) {
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) return;
js = d.createElement(s); js.id = id;
js.src = “//connect.facebook.net/en_US/all.js#xfbml=1”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
Click Here For The Original Source.
——————————————————–
