SC proposes that banks compensate digital arrest victims if they skip due diligence
In one line: The Supreme Court is weighing whether banks that fail to stop abnormal transfers should repay victims of digital arrest scams.
Published 30 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
On 29 October 2026, a three-judge Bench of Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana, hearing the Supreme Court's suo motu case on "digital arrest" scams, said it was proposing to direct that banks and other financial institutions compensate victims, and face prosecution, wherever a failure of due diligence on their part is proven. In a digital arrest, fraudsters pose as police or investigating officers on phone or video calls, tell victims they are under investigation and frighten them into transferring money. The idea has no legal basis: no law enforcement agency arrests anyone over a video call. The CJI asked why banks could not flag transactions that depart sharply from a customer's usual pattern and hold them until verified, remarking that a report filed after the fraud "will only be post-mortem". Amicus curiae N.S. Nappinai cited a recent case in which one woman lost ₹2.5 crore, and about ₹800 crore was cited as lost to such scams this year.
Attorney General R. Venkataramani opposed the Court imposing penalties on banks, arguing that deciding bank liability and framing the rules is the job of the Reserve Bank of India (RBI). He said the proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 were expected to be notified by 30 November 2026 and to be operational by 31 December 2026. The proposed safeguards include monitoring transactions against an account's established history, temporary suspension of unusual transactions, automated alerts to the police and physical verification. The Bench asked the RBI to explore a mechanism under which victims are compensated when a fraud results from a financial institution's negligence and to give a list of all authorised financial institutions, and directed States to file details of FIRs in digital arrest cases with the status of investigation and prosecution. WhatsApp told the Court it had banned about 9,400 suspicious accounts.
The case, In Re: Victims of Digital Arrest Related to Forged Documents (SMW (Crl.) 3/2025), is a suo motu writ that the Court has been monitoring for months. In February 2026 the Court called the siphoning of more than ₹54,000 crore through digital frauds "robbery or dacoity". On 4 August 2026 it gave the RBI four weeks to adopt a standard operating procedure (SOP) for banks to place temporary debit holds on accounts linked to cyber fraud, asked States to operationalise State Cyber Crime Coordination Centres and the e-Zero FIR system with the Indian Cyber Crime Coordination Centre (I4C), and asked an inter-departmental committee to examine a shared-liability compensation framework. The legal gap is real: the RBI's 2017 customer-protection circular limits customer liability only for "unauthorised" electronic transactions, while a digital arrest victim is pressured into making the transfer. The Court's view is that banks are best placed to stop abnormal transfers; the Centre's view is that the regulator, not the Court, should set liability rules.
Prelims facts
- On 29 October 2026, a Bench led by CJI Surya Kant proposed that banks compensate digital arrest victims and face prosecution where their failure of due diligence is proven.
- The Attorney General said the RBI (Know Your Customer) Amendment Directions, 2026 should be notified by 30 November and operational by 31 December 2026.
- The case is a suo motu writ, In Re: Victims of Digital Arrest Related to Forged Documents (SMW (Crl.) 3/2025).
- The RBI's circular of 6 July 2017 gives customers zero liability for unauthorised electronic transactions caused by the bank's fraud, negligence or deficiency.
- In August 2026 the Court gave the RBI four weeks to adopt an SOP for temporary debit holds on accounts linked to cyber fraud.
Quick recall
- Which Bench heard the digital arrest case on 29 October 2026?
- CJI Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana.
- What did the Court propose for banks?
- That banks compensate victims and face prosecution where a failure of due diligence is proven.
- Name of the RBI directions the Attorney General cited
- Reserve Bank of India (Know Your Customer) Amendment Directions, 2026.
- When are the KYC Amendment Directions expected to be operational?
- By 31 December 2026 (to be notified by 30 November 2026).
- Date of the RBI circular on limiting customer liability in unauthorised electronic transactions
- 6 July 2017.
- Within how many working days must a bank credit a disputed unauthorised amount after notice?
- 10 working days.
- How many suspicious accounts did WhatsApp say it had banned?
- About 9,400.
- Who is the amicus curiae in the digital arrest case?
- Senior Advocate N.S. Nappinai.
Prelims practice question
With reference to the RBI's 2017 framework on limiting customers' liability in unauthorised electronic banking transactions, consider the following statements:
1. A customer has zero liability when the unauthorised transaction results from contributory fraud, negligence or deficiency on the part of the bank.
2. Where the loss is due to the customer's negligence, such as sharing payment credentials, the customer bears the entire loss until the transaction is reported to the bank.
3. The burden of proving customer liability lies on the customer.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (a) 1 and 2 only. Statement 1 is correct: the 6 July 2017 circular gives zero liability where the bank's own fraud, negligence or deficiency caused the loss, whether or not the customer reports it. Statement 2 is correct: if the customer shared credentials, the customer bears the loss until reporting, and the bank bears losses after that. Statement 3 is incorrect: the circular puts the burden of proving customer liability on the bank.
Use this in UPSC Mains: previous-year questions
Recurring theme: Cyber-enabled financial fraud, bank accountability and the State's response to cyber crime
- How to use this
Use digital arrest scams to show that a cyber security strategy must cover financial fraud, bank safeguards and coordination, not only networks and infrastructure.
- The Supreme Court called the siphoning of over ₹54,000 crore through digital frauds "robbery or dacoity" (February 2026).
- In August 2026 the Court ordered States to operationalise State Cyber Crime Coordination Centres and e-Zero FIRs with I4C.
- The RBI (KYC) Amendment Directions, 2026 add transaction monitoring and holds on unusual transfers, due to be operational by 31 December 2026.
- How to use this
Cite digital arrest scams as a case where emerging technology speeds the movement of illicit money, and tighter KYC and debit holds are the domestic response.
- Victims are coerced into transferring money that is quickly moved onward, which is why the Court wants unusual transactions held until verified.
- The Court gave the RBI four weeks in August 2026 to adopt an SOP for temporary debit holds on accounts linked to cyber fraud.
Both questions deal with misuse of digital platforms; WhatsApp's ban on about 9,400 suspicious accounts shows the role of intermediaries.
Mains practice question
Digital arrest scams exploit fear rather than technology. Discuss whether banks should be held liable to compensate victims of such frauds, and suggest a framework for shared liability. (250 words)
Model answer
In a digital arrest scam, fraudsters posing as officials frighten victims into transferring money. On 29 October 2026 the Supreme Court proposed that banks compensate victims where their failure of due diligence is proven.
Why banks can be held liable
- Best placed to stop the money: banks see transfers that depart sharply from an account's history; the CJI said a report after the fraud "will only be post-mortem".
- Scale of loss: the Court described the siphoning of over ₹54,000 crore through digital frauds as "robbery or dacoity" (February 2026).
- Gap in current rules: the RBI's 2017 circular protects customers only in unauthorised transactions; coerced victims authorise the transfer themselves.
Concerns
- Regulatory domain: the Attorney General argued liability rules belong to the RBI, not the Court.
- Moral hazard: blanket compensation may weaken customer caution.
- Cost and friction: holding transactions may delay genuine payments.
A shared-liability framework
- Bank: monitor transactions against account history, hold unusual transfers, alert police, as proposed in the RBI (KYC) Amendment Directions, 2026 (due by 31 December 2026).
- Telecom and platforms: act on fraudulent accounts; WhatsApp reported banning about 9,400 suspicious accounts.
- State: State Cyber Crime Coordination Centres, e-Zero FIRs with I4C, and quick debit holds under the RBI SOP ordered in August 2026.
- Compensation: liability graded by fault, as with the 2017 circular's zero and limited liability tiers.
- Awareness: no agency arrests anyone over a video call; Legal Services bodies are to spread this message.
Liability should follow fault: banks that ignore red flags should pay, while prevention rests with every link in the chain.
The basics
Why this matters
Digital arrest scams turn a phone into a weapon of fear. The victim is told, often on a video call, that they are under investigation and must transfer money to "clear" their name. The Supreme Court is now asking a hard question: when a bank lets an obviously abnormal transfer go through, who should bear the loss?
How the scam works
The trick is not technical hacking. It is social engineering: persuading a person to act against their own interest. The fraudster creates urgency and isolation and directs the victim to move money into accounts controlled by the gang, often "mule" accounts opened in other people's names.
- 1ContactA caller claims the victim is linked to a crime under investigation.
- 2ImpersonationFake police or investigating officers appear on a video call.
- 3IsolationThe victim is pressured to stay on the call and tell no one.
- 4TransferMoney is moved to gang-controlled accounts to "verify" or "settle" the case.
- 5LayeringFunds are quickly split across other accounts, making recovery hard.
Why existing rules fall short
The RBI's circular of 6 July 2017 protects customers in unauthorised electronic transactions: zero liability if the bank was at fault, or if a third-party breach is reported within three working days. But a digital arrest victim usually makes the transfer personally, under pressure. That is why the Court is looking at the bank's duty of care, not just the customer's consent. See RBI's limited liability framework and Know Your Customer norms.
- Credentials stolen or system breached
- Covered by the 2017 RBI circular
- Bank must credit the amount within 10 working days after notice
- Victim makes the payment under fear
- Falls outside the 'unauthorised' tiers
- Court now probing banks' due diligence
The institutional response
The Court is using its Suo motu jurisdiction of the Supreme Court to coordinate the RBI, the Department of Telecommunications, the Ministry of Electronics and IT, the CBI and the States. The Indian Cyber Crime Coordination Centre (I4C) runs the national system for reporting cyber fraud and freezing funds.
- 6 July 2017RBI circular limits customer liability in unauthorised e-banking transactions
- February 2026Court calls ₹54,000 crore of digital fraud "robbery or dacoity"
- 4 August 2026RBI given four weeks to adopt an SOP on temporary debit holds
- 29 October 2026Bench proposes that banks compensate victims if due diligence fails
- 31 December 2026Target for the RBI KYC Amendment Directions to become operational
Go deeper
Why it matters for UPSC
The story sits at the meeting point of GS3 cyber security, banking regulation and GS2 judicial intervention. It also tests a classic Mains theme: should the Court frame rules, or leave them to the regulator?
The core idea
Digital arrest is social engineering: victims are frightened into paying. Because they make the payment themselves, the RBI's limited liability framework for unauthorised transactions does not neatly apply. The Court is therefore asking whether banks, which hold the data to spot abnormal transfers under Know Your Customer norms, owe a duty to hold such payments. It is acting through its Suo motu jurisdiction of the Supreme Court, coordinating agencies such as the Indian Cyber Crime Coordination Centre (I4C).
Numbers and dates to remember
- 29 October 2026: Bench of CJI Surya Kant, Justices Joymalya Bagchi and V. Mohana proposes bank compensation.
- ₹2.5 crore: loss in one recent case cited by the amicus; about ₹800 crore lost this year, as cited in Court.
- ₹54,000 crore: digital fraud the Court called "robbery or dacoity" (February 2026).
- 30 November and 31 December 2026: notification and operational targets for the RBI KYC Amendment Directions.
- About 9,400: suspicious accounts WhatsApp said it banned.
Where to go next
- RBI's limited liability framework: the 2017 rules on who pays for unauthorised e-banking losses.
- Know Your Customer norms: the customer checks banks must run, now being tightened.
- Suo motu jurisdiction of the Supreme Court: how the Court takes up a matter on its own.
- Indian Cyber Crime Coordination Centre (I4C): the MHA body at the centre of cyber fraud response.
Go deeper: Court-made liability or regulator-made rules?
For a judicial push. Losses are large and rising: the Court cited more than ₹54,000 crore lost to digital frauds. Banks see every transfer and can compare it with an account's history; the CJI asked why abnormal transactions are not held until verified. The RBI's limited liability framework already accepts that a bank at fault should bear the loss; extending that logic to coerced transfers keeps the principle intact. The Court's August 2026 directions show that judicial deadlines move agencies: the RBI was given four weeks to adopt a debit-hold SOP.
For leaving it to the RBI. The Attorney General argued that liability and its regulation fall within the RBI's domain. The RBI is already amending its Know Your Customer norms, with directions due to be operational by 31 December 2026. Rules set by the regulator can be consulted, tested and revised; court orders are harder to adjust. Holding many payments could also add friction for genuine customers.
A middle path. The August 2026 order asked an inter-departmental committee to examine a shared-liability and compensation framework, with banks, telecom companies and platforms each bearing a share linked to fault. The Indian Cyber Crime Coordination Centre (I4C) reported ₹18.05 crore restored across 36,290 cases, showing that quick freezing works but recovers only a fraction. The Suo motu jurisdiction of the Supreme Court lets the Court keep the pressure on while the regulator writes the detailed rules.
RBI's limited liability framework
The 2017 rules on who pays for unauthorised e-banking losses.
In one line: An RBI circular of 6 July 2017 decides how much of an unauthorised electronic banking loss a customer must bear.
The three tiers
- Zero liability: if the bank's own fraud, negligence or deficiency caused the loss, whether or not it is reported; or if a third-party breach is reported within three working days.
- Limited liability: for a third-party breach reported in four to seven working days, capped at the transaction value or a fixed amount from ₹5,000 to ₹25,000 by account type, whichever is lower.
- Customer negligence: if the customer shared credentials, the customer bears the loss until reporting it.
Duties on the bank
The bank must credit the disputed amount within 10 working days of notice, resolve the complaint within a Board-approved period of at most 90 days, and carry the burden of proving customer liability.
Why it is in the news
The framework covers only unauthorised transactions. Digital arrest victims are pressured into making the transfer themselves, so the Court is looking at banks' due diligence instead.
Where to go next
Know Your Customer norms
The customer checks banks must run, now being tightened.
In one line: Know Your Customer (KYC) norms require banks to verify who their customers are and to watch how their accounts are used.
What KYC covers
KYC is not just collecting identity documents when an account is opened. It includes ongoing due diligence: checking whether an account's transactions fit the customer's profile and reporting suspicious activity. These duties flow from the Prevention of Money-laundering Act, 2002 and are set out by the RBI in its KYC Directions.
Why it is in the news
Fraud money in digital arrest scams usually lands in "mule" accounts. The proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 would add transaction monitoring against an account's established history, temporary suspension of unusual transactions, automated alerts to the police and physical verification. The Attorney General told the Supreme Court they should be notified by 30 November 2026 and operational by 31 December 2026.
Where to go next
- RBI's limited liability framework
- Indian Cyber Crime Coordination Centre (I4C)
Suo motu jurisdiction of the Supreme Court
How the Court takes up a matter on its own.
In one line: "Suo motu" means "on its own motion": the Court starts a case itself, without a formal petition from an affected party.
How it works
The Supreme Court often registers such cases as suo motu writ petitions, drawing on its power under Article 32 to enforce fundamental rights and its power under Article 142 to pass orders for "complete justice". It appoints an amicus curiae (friend of the court) to assist, and issues continuing directions to governments and regulators, reviewing compliance at each hearing.
Why it is in the news
The digital arrest matter is registered as SMW (Crl.) 3/2025. Through it the Court has set deadlines for the RBI, States and central ministries. Critics of such continuing mandamus say it blurs the line between courts and the executive; supporters say it fills gaps where agencies move slowly.
Where to go next
- Indian Cyber Crime Coordination Centre (I4C)
- RBI's limited liability framework
Suo motu jurisdiction of the Supreme Court: every story that connects to it (2)
Indian Cyber Crime Coordination Centre (I4C)
The MHA body at the centre of cyber fraud response.
In one line: I4C is the Ministry of Home Affairs body that coordinates the response of police, banks and other agencies to cyber crime.
What it does
I4C links State police forces with banks and payment firms so that money reported as stolen can be traced and frozen quickly. It works with States on the e-Zero FIR system, which is meant to turn online complaints of cyber financial fraud into FIRs faster.
Why it is in the news
In August 2026 the Supreme Court asked States and Union Territories to notify State Cyber Crime Coordination Centres and adopt e-Zero FIRs with I4C within four weeks. I4C reported that ₹18.05 crore had been restored across 36,290 cases, with 57 banks taking part. On 29 October 2026 the Attorney General told the Court that I4C was working on the problem continuously.
Where to go next
Indian Cyber Crime Coordination Centre (I4C): every story that connects to it (2)
Take the 30 October 2026 quiz: 30 Prelims-style questions with answers