Sri Lanka’s E-Commerce Boom: Who Is Protecting the Customer?
Behind the discounts, Facebook shops and doorstep deliveries lies a bigger question: Has Sri Lanka’s digital marketplace grown faster than the rules designed to protect it?
By Lakbima News Investigative Desk
September 7, 2026
A few years ago, buying something online in Sri Lanka often meant waiting for a website to load, entering a card number and wondering whether the package would actually arrive.
Today, the experience is completely different.
A dress appears on Facebook.
A watch is advertised on Instagram.
A small business owner takes orders through WhatsApp.
A customer pays by bank transfer or waits for cash-on-delivery.
A rider arrives at the door.
The transaction is over.
For the customer, it may have taken five minutes.
For the economy, something much bigger is happening.
Sri Lanka’s e-commerce market generated an estimated US$4.18 billion in 2025, according to ECDB, with growth of roughly 20–25% during the year. Electronics alone accounted for an estimated US$981 million of online revenue.
At the same time, Sri Lanka had 13.9 million internet users by October 2025, equivalent to 59.7% of the population, while social-media user identities reached about 9 million.
The online marketplace is no longer a niche.
It is becoming part of ordinary life.
But there is another side to this transformation.
Who is checking the seller?
Who protects the buyer when something goes wrong?
Who knows how much money is actually changing hands?
What happens to the customer’s phone number, address and payment information after the parcel arrives?
And perhaps the most uncomfortable question:
Has Sri Lanka built the rules for the digital economy quickly enough to match the speed at which the economy itself is moving online?
The new Sri Lankan shopping mall is a phone screen
The traditional shopping trip required a physical shop.
The seller had an address.
There was a signboard.
There were employees.
The customer could walk back into the shop if something went wrong.
Online commerce has changed that relationship.
A seller can operate from a home, a warehouse, a Facebook page or an Instagram account.
The customer may never know where the business actually exists.
That is not necessarily a bad thing.
In fact, it has opened the door for thousands of small businesses that could never afford a traditional retail outlet.
PickMe’s own annual report describes its digital logistics infrastructure as helping home-based entrepreneurs and small businesses reach customers without needing physical storefronts.
That is the positive side of the revolution.
A woman making cakes from her kitchen can suddenly reach customers across Colombo.
A young man selling phone accessories can start a business without renting a shop.
A farmer can potentially find customers outside his village.
A small clothing manufacturer can advertise directly to consumers.
The barriers to entry have fallen.
But something else has fallen too.
The physical distance between a legitimate small business and a fraudulent seller.
The Facebook shop problem
Sri Lanka’s online marketplace is not simply made up of major platforms.
A large part of the country’s digital commerce happens through social media.
A seller posts photographs.
A customer sends a message.
The seller asks for a name, address and telephone number.
The customer transfers money.
A courier delivers the product.
There may be no formal checkout page.
No verified seller badge.
No independent review system.
Sometimes not even a proper business address.
This creates a grey area that is difficult to regulate.
Sri Lanka’s Consumer Affairs Authority introduced specific e-commerce directions in 2023.
They require e-commerce entities and platform operators to provide important information including payment terms, delivery terms, cancellation and refund conditions, warranty information, privacy policies and dispute-resolution options. They also require appropriate payment-security measures and reasonable delivery arrangements.
On paper, the rules are significant.
But the question is enforcement.
If a consumer buys a Rs.8,000 product from a Facebook page that disappears the following week, who is responsible?
The platform?
The seller?
The payment provider?
The courier?
Or the consumer who trusted the advertisement?
The CAA can investigate. But can it reach everyone?
The Consumer Affairs Authority says it can investigate complaints concerning goods and services and can act on complaints or information about erroneous trade practices. It currently operates a consumer complaint system and hotline 1977.
The Authority’s legal division also conducts market investigations and raids and can prosecute traders who violate consumer law.
But online commerce creates a fundamental practical problem.
A physical shop is difficult to disappear from.
A social-media seller is not.
An account can be renamed.
A telephone number can be abandoned.
A page can be deleted.
A new page can appear tomorrow.
The person behind it may be difficult to identify.
This does not mean the CAA is powerless.
It means that enforcement designed around a physical marketplace faces a new challenge.
The marketplace has become partly invisible.
The scam economy hiding behind online shopping
The danger is not theoretical.
Sri Lanka’s cyber authorities are already seeing significant financial fraud online.
SLCERT reported 360 cyber-related financial fraud incidents during the first part of 2026, along with 40 reported WhatsApp account-hacking cases.
Sri Lanka Police has warned about fraudulent advertisements, fake offers and giveaways, malicious links, imitation websites, QR-code fraud, phishing messages and fake banking websites.
Police have also warned that criminals can misuse photographs of senior government officials and celebrities to create credibility.
The Central Bank has separately launched its “Be Scam Proof” campaign, warning that financial scams are becoming increasingly sophisticated and can involve impersonation, digital intrusion, fake investment schemes and attempts to obtain money or personal information.
This matters to e-commerce because the customer does not always know where a shopping transaction ends and a financial scam begins.
A fake seller can be a fraud.
A fake payment link can be a fraud.
A fake courier message can be a fraud.
A fake Customs message can be a fraud.
Sri Lanka Customs has even published a specific warning that it does not request customs payments through bank transfers to personal accounts via SMS, email or telephone.
The scammer does not necessarily need to steal a customer’s credit-card number.
Sometimes the customer’s trust is enough.
The parcel that arrives is not always the product that was advertised
There is another problem that consumers know very well.
The photograph looks excellent.
The description sounds impressive.
The price looks irresistible.
Then the parcel arrives.
The material is cheaper.
The colour is different.
The size is wrong.
The product appears used.
The advertised brand is nowhere to be found.
Or the product simply does not work.
The Morning reported in August that the CAA was receiving increasing complaints involving fake products, misleading advertising, delivery delays, damaged goods and refund disputes as online shopping expands.
That is a warning sign for an industry that depends almost entirely on trust.
A physical shop allows the customer to touch the product.
Online shopping replaces that physical inspection with photographs, descriptions and reviews.
If those are unreliable, the foundation of the transaction becomes unreliable too.
Fake reviews could become the next battleground
There is another problem that deserves much more attention in Sri Lanka.
Reviews.
For many customers, the five stars underneath a product are more important than the advertisement itself.
But how does a consumer know whether those reviews are genuine?
Were they written by real customers?
Were they incentivised?
Were negative reviews removed?
Are the photographs actually from previous customers?
Or were they copied from another website?
A 2024 academic study of Sri Lankan e-commerce users found that reviews and recommendations from people’s close circles strongly influenced online purchasing decisions. The research also identified concerns involving outdated information, unexpected charges, refund delays, unauthorised deductions and the storage of card details.
That means trust itself has become a form of currency.
And wherever trust becomes valuable, manipulation becomes possible.
Sri Lanka does not need to assume that widespread fake reviews exist.
But regulators and platforms should be asking a simple question:
Can consumers distinguish a genuine recommendation from manufactured confidence?
The cash-on-delivery paradox
Sri Lanka has developed an unusual relationship with online shopping.
People want the convenience of the internet.
But many still do not completely trust the internet with their money.
That is why cash-on-delivery remains important.
Research published on Sri Lankan consumers found a strong preference for cash-on-delivery and highlighted concerns about security, privacy and credibility.
At first glance, COD appears safer.
You don’t pay until the parcel arrives.
But it creates another problem.
The customer may not be able to properly inspect the product before handing over the money.
And if the customer refuses the parcel, the seller or platform has already incurred delivery costs.
This creates an entire secondary problem:
failed deliveries and returned parcels.
For a major platform, those costs may be manageable.
For a small home-based entrepreneur selling products for a few thousand rupees, repeated failed deliveries can destroy the business.
So the same system that protects customers can also put pressure on small sellers.
The courier became part of the e-commerce economy
The e-commerce revolution is also a logistics revolution.
The product has to travel from the seller to the customer.
That has created opportunities for courier companies and platforms such as PickMe.
PickMe’s last-mile service explicitly targets small and medium businesses and provides delivery, tracking and cash-on-delivery options.
The economic significance is easy to overlook.
Every online order creates a chain:
seller → warehouse → courier → rider → customer
Each stage creates employment.
But each stage can also create responsibility.
If a product is damaged during delivery, who pays?
If the customer says the parcel was never delivered, who proves what happened?
If cash is collected, when does the seller receive it?
If a customer claims the parcel contained the wrong item, what evidence exists?
The digital transaction may be invisible.
The physical parcel is not.
That means logistics records could become extremely important evidence in consumer disputes.
The tax question nobody likes discussing
Now we reach the uncomfortable part.
How much of Sri Lanka’s online economy is visible to the tax authorities?
There is no evidence that the entire e-commerce sector is avoiding tax.
That would be irresponsible to claim.
But the structure of social-commerce creates obvious challenges.
A registered company selling through a formal platform is relatively easy to identify.
A small business selling through Facebook or WhatsApp can be considerably harder to monitor.
If a person sells ten products a month, that is one thing.
What happens when the same person sells hundreds?
What happens when payments arrive directly into personal bank accounts?
What happens when several social-media pages are operated by the same person?
What happens when the business has no formal website?
These are not accusations.
They are questions about the visibility of the digital economy.
The Government knows the problem is bigger than shopping websites
The Government itself has acknowledged that cross-border e-commerce has grown significantly.
In July 2025, the Cabinet noted increased imports through cross-border e-commerce and said Sri Lanka needed a better framework for collecting tax revenue while supporting the economic benefits of e-commerce.
The Cabinet also acknowledged that revised Customs procedures had produced delays, higher transaction costs and reduced transparency and predictability for consumers and small importers. It approved a committee to examine transitional relief and a long-term regulatory framework.
That admission is important.
The problem is not simply:
“Are Sri Lankans buying things online?”
The problem is now:
“How does Sri Lanka regulate an economy in which the seller, buyer, payment system and supplier may all be in different countries?”
Buying from overseas is another layer of complexity
Sri Lanka Customs now has a dedicated online-buyers guide explaining duties, exemptions, prohibited items and procedures for parcels purchased online.
It states that imported goods can be subject to duties and taxes and warns consumers that Customs does not request payments into personal bank accounts.
For consumers, this creates an important lesson.
The price shown on an overseas website may not be the final cost.
There can be:
customs duties
VAT
courier charges
licensing requirements
restricted-item rules
delays
exchange-rate differences
A consumer who sees a US$100 product online may ultimately pay considerably more.
And the Government is now trying to make sure that this rapidly growing cross-border trade does not become a hole in the tax system.
Sri Lanka is already taxing the digital economy
The tax system itself is changing.
Sri Lanka amended the VAT framework to cover supplies of services by non-resident persons through electronic platforms.
The Inland Revenue Department’s published framework includes online stores, payment gateways, order-fulfilment services, e-commerce platforms and marketplace platforms among services that can fall within the electronic-platform VAT regime.
The implementation timeline has, however, been subject to changes and legislative developments.
The IRD announced in 2025 that the planned October 2025 implementation for VAT on non-resident digital services had been postponed to April 1, 2026, pending parliamentary approval.
Parliament subsequently considered further VAT amendments concerning non-resident digital service providers.
This illustrates the difficulty facing policymakers.
Technology changes in months.
Tax legislation takes longer.
The data problem may be even more serious than the product problem
Think about what an online seller knows about a customer.
Name.
Telephone number.
Home address.
Email address.
Shopping history.
Payment information.
Sometimes NIC information.
Sometimes photographs.
Sometimes location data.
Sometimes conversations.
For a major platform, these records may be protected by sophisticated systems.
But what happens when a customer orders from a small social-media seller?
Where is the information stored?
On a phone?
A spreadsheet?
WhatsApp?
A cloud account?
Who has access to it?
How long is it kept?
Is it sold?
Is it shared with a courier?
Is it copied to another employee’s phone?
These questions become increasingly important because Sri Lanka now has a dedicated Data Protection Authority and the Personal Data Protection Act.
The Data Protection Authority says the legislation is intended to protect personal data and build trust in the country’s digital economy.
The 2025 amendment to the law changed the commencement framework, and the DPA’s current material records a further 2026 commencement order.
In other words, Sri Lanka is building the privacy framework.
But the transition is still underway.
For e-commerce companies, that means privacy compliance is no longer something that can simply be postponed indefinitely.
The biggest platforms have an advantage
There is an important distinction between a marketplace and an individual seller.
Large platforms can build:
payment systems
seller verification
customer support
refunds
dispute mechanisms
ratings
fraud detection
logistics networks
Kapruka, for example, says it has thousands of partner sellers and provides online purchasing, fulfilment and island-wide delivery infrastructure.
PickMe has similarly built digital infrastructure that allows small businesses to access delivery and logistics without maintaining their own delivery fleet.
This is one of the strongest arguments for formal platforms.
They create an intermediary.
And intermediaries create accountability.
But they also create another question.
How much responsibility should a platform bear for the conduct of the sellers using it?
If a marketplace hosts thousands of merchants, it cannot physically inspect every item.
But should it verify the identity of every seller?
Should it verify business registration?
Should it monitor repeated complaints?
Should it remove sellers who repeatedly sell counterfeit goods?
Should it compensate consumers when a seller disappears?
These are increasingly important regulatory questions.
The counterfeit problem
Online commerce also makes it easier for counterfeit goods to reach consumers.
A fake watch does not need a physical shop.
A fake cosmetic product does not need a shopping mall.
A counterfeit electronic accessory can be advertised from a bedroom.
Sri Lanka Customs explicitly states that counterfeit goods are prohibited imports and can be forfeited. Its Consumer Protection Unit also provides a mechanism for rights holders to register intellectual-property rights with Customs so suspected counterfeit shipments can be detained.
But the physical-border model becomes more difficult when commerce is fragmented across thousands of small parcels.
A container carrying counterfeit goods can be targeted.
A stream of small online orders is more complicated.
That is another reason cross-border e-commerce is becoming a regulatory challenge.
The possibility of a “shadow e-commerce economy”
There is a theory worth examining carefully.
Not a theory that Sri Lanka’s e-commerce industry is illegal.
It is not.
Rather, the possibility that a parallel layer of commerce is developing outside the most visible formal platforms.
Imagine thousands of individuals who:
advertise through social media;
accept orders through messaging apps;
receive bank transfers or cash;
use third-party couriers;
import small quantities;
operate without a physical storefront;
and disappear or change identities when problems arise.
Individually, each transaction may be small.
Collectively, the market could become significant.
The authorities would then face a difficult problem:
The economy exists, but the database does not fully capture it.
That is the real investigative question.
Not “Are online sellers criminals?”
But:
How much of the digital economy can the State actually see?
Three possible futures
There are three broad directions Sri Lanka could take.
The first: regulation catches up
The Government could establish stronger seller identification, better platform accountability, improved Customs integration, clearer refund rules and stronger data protection.
That could increase consumer confidence.
The second: regulation becomes too heavy
If compliance becomes expensive and complicated, small entrepreneurs may be pushed out of formal e-commerce.
The biggest platforms could become even more dominant.
That would protect consumers in some respects while reducing competition.
The third: the informal market keeps growing
Consumers continue buying through social media because it is cheap and convenient.
Small sellers continue operating outside formal systems.
The Government struggles to collect taxes and enforce consumer rights.
Scammers exploit the gaps.
This is the scenario policymakers should probably fear most.
What Sri Lanka should be able to answer
A mature e-commerce economy should eventually be able to answer some basic questions.
How many online sellers operate in Sri Lanka?
How many are registered businesses?
How many operate primarily through Facebook, Instagram or WhatsApp?
How many consumer complaints relate specifically to online transactions?
How much money is spent online each year?
How much is domestic and how much is cross-border?
How much tax is collected from online commerce?
How many counterfeit products are seized from online sellers?
How many online shopping scams are reported?
How many consumers successfully obtain refunds?
And perhaps the most important:
How much personal data is being collected by online sellers who have no formal privacy infrastructure?
Without these numbers, Sri Lanka is attempting to regulate an economy that it cannot fully measure.
The human cost behind the statistics
For policymakers, e-commerce is a digital-economy success story.
For a young entrepreneur, it may be the first business they have ever owned.
For a mother in a rural town, it can mean buying something without travelling to Colombo.
For a Sri Lankan living overseas, it can mean ordering a birthday cake for a parent back home.
For an elderly person, it can mean having groceries delivered to the doorstep.
For a courier rider, every order is income.
For a small manufacturer, every online customer can mean another month of survival.
But for another Sri Lankan, online shopping may mean:
A package that never arrives.
A seller who stops answering messages.
Rs.15,000 transferred to an unknown bank account.
A counterfeit phone battery.
A product that looks nothing like the photograph.
A refund that never comes.
Or a telephone number and home address sitting permanently on somebody else’s phone.
That is why the future of Sri Lankan e-commerce should not be measured only by sales.
It should be measured by trust.
The investigation Sri Lanka needs next
The country does not necessarily need another speech about becoming a digital economy.
It needs data.
The Government should consider bringing together the Consumer Affairs Authority, Central Bank, Customs, Inland Revenue Department, police, SLCERT, Data Protection Authority and relevant digital-economy agencies to produce a comprehensive picture of online commerce.
The objective should not be to punish small businesses for existing online.
It should be to separate the legitimate digital entrepreneur from the anonymous scammer.
That means creating a system in which:
good sellers become easier to identify,
bad sellers become harder to hide,
consumers can obtain redress,
taxes can be collected fairly,
personal information is protected,
and small businesses can continue to grow.
Sri Lanka already has many of the individual pieces.
The CAA has e-commerce directions.
Customs has online-buyer guidance.
The Central Bank has digital-payment infrastructure and scam-awareness programmes.
The Data Protection Authority exists.
SLCERT and the Police investigate cyber fraud.
Digital payment infrastructure is expanding; for example, CBSL reported that JustPay Web was introduced to allow bank-account-linked payments through browser-based merchant applications, while JustPay transaction volumes and values have grown substantially since 2020.
The pieces are there.
The question is whether they are connected.
The real test of Sri Lanka’s digital economy
Sri Lanka does not have to choose between regulation and innovation.
It needs both.
The country should not make it impossible for a teenager selling handmade jewellery online to start a business.
But neither should it create a marketplace where an anonymous seller can take thousands of rupees from customers and disappear without leaving a trace.
The future of e-commerce will not ultimately be decided by how many apps Sri Lanka has.
It will be decided by whether people trust the screen in front of them.
Because the biggest transaction in online shopping is not the payment.
It is the transfer of trust.
The customer gives a stranger money.
The customer gives a stranger an address.
Sometimes the customer gives a stranger personal information.
In return, the customer expects a product to arrive exactly as promised.
That simple exchange is becoming one of the foundations of Sri Lanka’s modern economy.
And if Sri Lanka wants its e-commerce sector to become a serious part of the country’s economic future, there is one question that must remain at the centre of the discussion:
When something goes wrong, who stands between the customer and the screen?
Lakbima News investigative note
This report does not allege that Sri Lanka’s e-commerce industry is generally fraudulent, tax-evading or unsafe. The investigation examines structural vulnerabilities created by rapid growth in online commerce. Where allegations, complaints or risks are discussed, they are identified as such. Market-size figures are estimates from commercial market research and should not be treated as official Government statistics.
