Sri Lanka is increasingly coming under scrutiny as a potential new base for international cybercrime networks, with law enforcement agencies raising concerns over the growing presence of organised criminal groups linked to Chinese nationals. A recent murder investigation has brought renewed attention to the activities of transnational cybercrime syndicates operating from the island nation and highlighted fears that criminal rivalries that once played out in other parts of Southeast Asia could now be spreading to Sri Lanka.
The concerns intensified after the body of a Chinese national was recovered from Karandana in Sri Lanka’s Sabaragamuwa Province on July 23. Investigators identified the deceased as a suspected member of an international Chinese cybercrime syndicate. According to investigators, the man had entered Sri Lanka using a Cambodian passport under the name “Hao Pon”, but the document was later found to be fraudulent. Police also recovered another passport issued by Suriname that carried the same photograph but a different identity.
The investigation has provided authorities with a glimpse into the international nature of the networks allegedly operating in the region. Police believe Hao Pon had spent a considerable period in Cambodia, where he was reportedly involved in businesses including resorts and beauty salons that allegedly served as legitimate fronts for wider cybercrime activities. Investigators suspect that he was involved in recruiting Chinese hackers and organising cyber fraud operations that generated substantial sums of money.
Authorities believe Hao Pon may have moved to Sri Lanka after coming under pressure from a rival criminal network in Cambodia. According to the investigation, he allegedly earned millions of dollars through cyber fraud but failed to hand over a significant share of the proceeds to another network that was supplying data for scam operations. This dispute is believed to have triggered the pursuit that eventually reached Sri Lanka.
Police suspect that Hao Pon had been attempting to establish a similar cybercrime operation in Sri Lanka. Shortly before his death, he had reportedly begun the process of registering a company called “Ora”, which investigators believe could have been used as a cover for future operations. His movements and lifestyle also attracted attention. He reportedly travelled with a Chinese chef, a physiotherapist and a driver, while his Vietnamese girlfriend was also staying with him.
The situation reportedly escalated when members of the rival Chinese criminal network arrived in Sri Lanka in April in search of him. Aware that he was being followed, Hao Pon allegedly changed residences frequently before staying at a luxury apartment in Colombo.
On the night of July 22, he travelled in a luxury SUV towards the Colombo Port City waterfront, accompanied by his driver and two Chinese nationals described as his physiotherapist and security personnel. While he was fishing near the Port City suspension bridge after midnight, a group of armed men reportedly arrived in a van and abducted him. His body was subsequently found in the Eheliyagoda area.
The murder has added to wider concerns over the relocation of cybercrime operations from traditional centres in Southeast Asia. Intensified crackdowns in countries such as Cambodia and Myanmar have reportedly forced criminal networks to search for alternative locations. Sri Lanka, with its tourism infrastructure, relatively accessible visa arrangements and established telecommunications network, has increasingly attracted attention as one such destination.
Sri Lankan authorities have already undertaken a series of raids targeting suspected cybercrime activities. Nearly 1,000 foreign nationals, including Chinese, Cambodian, Myanmar and Vietnamese citizens, have reportedly been arrested in recent months in connection with various investigations. The arrests have heightened concerns that international criminal groups may be attempting to establish a larger and more permanent presence in the country.
The developments have prompted senior law enforcement officials to warn Sri Lanka’s leadership about the need for immediate action. Authorities are increasingly concerned that the issue could extend beyond online fraud and become a broader national security challenge involving organised crime, money laundering, immigration violations, human trafficking and violent disputes between rival syndicates.
The case has also highlighted the difficulties faced by authorities in monitoring transnational criminal organisations that operate across multiple countries. Criminal groups can move personnel, money and infrastructure relatively quickly when law enforcement pressure increases in one location. The emergence of Sri Lanka as a possible new operational base therefore represents a challenge not only for the island nation but also for countries whose citizens are targeted by sophisticated online fraud networks.
The latest developments have placed greater pressure on Sri Lankan agencies to strengthen immigration monitoring, financial investigations, cybercrime enforcement and cooperation with international law enforcement bodies. The murder investigation could ultimately provide authorities with important information about the structure and reach of the criminal networks operating in the region, while also determining whether Sri Lanka is becoming a temporary transit point or a more established base for international cybercrime syndicates.
