At an MWC Shanghai roundtable on scams and fraud across China and APAC, Sri Lanka’s Digital Economy Deputy Minister Eng. Eranga Weeraratne put a specific, mechanical ask to GSMA — and a blunter admission than the room expected.
A year ago, Sri Lanka would have joined a conversation about scams and fraud as a consumer-protection story — a country worried about its own citizens being targeted. At MWC Shanghai’s roundtable on safeguarding digital trust, Deputy Minister Eranga Weeraratne arrived instead with what he called a harder, more uncomfortable vantage point. As enforcement has tightened across parts of Southeast Asia, organised scam operations have begun relocating to Sri Lanka. In the first months of this year, police removed well over a thousand foreign nationals from scam operations on Sri Lankan soil — more than the previous two years combined.
That statistic, he told the room, is the clearest evidence yet that scams are not a problem any single country can legislate its way out of. Pressure in one jurisdiction simply pushes the operation to the next one with good connectivity and, often, softer enforcement. “Scams are not a national problem with national solutions. They are a displacement problem,” he added.
The Deputy Minister was specific about direction — a distinction he said is easy to miss in a regional conversation. Scam operations physically based on Sri Lankan soil are overwhelmingly targeting victims outside the country. At the same time, Sri Lankan citizens are being targeted by scam operations based abroad. Perpetrator, victim, and enforcement jurisdiction, in other words, rarely sit in the same country — which is exactly why he argued individual nations acting alone will keep losing ground, and why regional collaboration on intelligence sharing, technological support, joint capacity-building for investigators, and coordinated law-enforcement operations has to move from aspiration to infrastructure.
Over 1,000 foreign nationals removed from scam operations on Sri Lankan soil so far this year — more than the previous two years combined.
The blind spots: OTT channels
Weeraratne pointed to a structural gap that, in his framing, no telecom regulator can currently close alone. A growing share of scam contact now happens over OTT applications — channels that sit entirely outside the reach of Sri Lanka’s telecom regulator or its telecom operators. And even where authorities can act, blacklisting a confirmed scam source through today’s processes takes far longer than these operations move.
The ask: A platform brokered by GSMA
Given that mobile remains the primary channel through which victims are first contacted, Weeraratne put a concrete proposal to GSMA directly: play an active role as the platform. A shared digital mechanism would connect OTT and social media players with national law-enforcement authorities — telecom regulators or police — with a simple, three-step mechanism.
How the takedown mechanism would work
A national law-enforcement agency identifies and confirms a scam source.
The agency uploads that source to a shared, GSMA-brokered platform.
OTT and social media players block the source or content under an agreed service-level agreement — without a fresh investigation on their end that would only delay the response.
Building the defence industry
On the enabling environment, Weeraratne was blunt: the government cannot, and should not, try to build all of this itself. Sri Lanka’s most effective capability so far — a national scam-shield platform — was built locally, by industry, with a global cloud partner, not inside a ministry. The state’s job, he argued, is to be the orchestrator: telecom networks already sit on the signals that catch fraud early, and frameworks like Open Gateway and the ACAST taskforce show how that intelligence becomes real-time protection for banks and platforms. Policymakers’ job is to make it commercially rational to build these tools — through procurement, regulatory clarity, and treating fraud prevention as critical national infrastructure rather than a cost centre.
AI: Out-build, not out regulate
On artificial intelligence, he described a genuinely double-edged tool. Attackers are already industrialising AI — synthetic identities, voice cloning, deepfaking, social engineering at scale — and no country will out-regulate that. The only real answer, he said, is to out-build it: strong digital identity and e-KYC to make impersonation harder, anchored in privacy, with countries strengthening one another through shared tools, not intelligence alone. “Trust is being eroded faster than we are rebuilding it,” he said.
Weeraratne closed with one commitment and one ask. The commitment: Sri Lanka intends to harden its own jurisdiction. The ask: that the region make real-time, cross-sector, cross-border intelligence sharing the default, not the exception — starting, he suggested, with GSMA in the room to broker exactly that kind of platform.