The Supreme Court has said the Reserve Bank of India’s (RBI) new rules must require banks to compensate digital arrest and cyber fraud victims when a bank’s failure to exercise due diligence enables the fraud.

“The regulatory measures proposed by the RBI must mandate financial institutions to indemnify digital arrest or cyber fraud victims with suitable compensation not less than equivalent to the amount lost by the customer, in the event it is found that such fraud or crime has taken place as a result of the failure of due diligence on behalf of the financial institution,” the court said in its October 29 order, Verdictum reported.

A bench comprising Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana is hearing the case, which the court took up on its own in October 2025. In digital arrest scams, fraudsters pose as police or government officials over video calls, tell victims they are under “arrest” and pressure them into transferring money.

What did the court say banks must do?

The court said every financial institution must be required to:

• Hold unusual transactions: Temporarily suspend transactions that are out of line with an account’s past activity.
• Alert the police: Automatically inform the nearest police station about such transactions.
• Verify before release: Physically verify whether the transaction is genuine.

“We will put up a strict liability on the financial institutions,” Justice Bagchi said during the hearing. Chief Justice Kant said banks would never mend their ways unless they faced penalties. He said liability must fall on the bank itself, not just the officer involved, with “zero debit” in the victim’s account.

He also accused the RBI of soft-pedalling because it was consulting banks while the court was seeking action against them. “For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI,” he said.

The Chief Justice expressed doubts about whether rules alone would work. He said RBI master circulars already exist for frauds such as builder-buyer scams, but their implementation is doubtful. He asked the Centre to explain how far the new rules go beyond these circulars and what mechanisms would ensure that banks comply. The Attorney General said the RBI’s directions would bind banks, leaving them no discretion, and that the proposals address the liability of both banks and their officers.

Why does the compensation direction matter?

The RBI’s existing rules do not cover most digital arrest victims. Its 2017 circular provides customers with zero liability only for unauthorised transactions caused by a bank’s fraud or negligence. Digital arrest victims usually make the transfers themselves under pressure. The circular does not address payments that customers authorise after being deceived.

What has the court asked for?

• List of banks: The RBI must list all authorised financial institutions so that the court’s directions apply to all of them without requiring each institution to be made a party to the case.
• Action against staff: At the government’s suggestion, the RBI must report what action banks have taken against employees involved in digital arrest cases. The Chief Justice said bank staff were themselves part of these scams.
• Centre’s affidavit: The Union government must detail the steps it has taken. These include blocking 9,400 accounts in coordination with WhatsApp, the Ministry of Electronics and Information Technology (MeitY) and the Department of Telecommunications (DoT). They also include the development of software to flag accounts impersonating government agencies.
• Police reports: State police must report the cases registered and the status of investigations.

When the Attorney General referred to reports already filed, the Chief Justice said a report was only a post-mortem and that the court’s concern was prevention.

“We are not disagreeing with the directions sought by the amicus. We only need some time. We should not issue directions that ultimately prove ineffective,” Attorney General R Venkataramani said.

What rules is the RBI bringing in?

The court wants to examine the RBI’s proposed Know Your Customer (KYC) Amendment Directions, 2026 before issuing its own directions. The RBI must notify the directions by November 30 and bring them into force by December 31. The government also expects the National Cybercrime Reporting Portal (NCRP), where victims report fraud, to be completed by December 31.

The RBI released a draft in September, after the court directed it in August to adopt a standard operating procedure on mule accounts, which fraudsters use to move stolen money. The court called mule accounts a major problem and noted that the RBI had issued strict instructions to prevent the creation of new ones.

The draft requires banks to flag suspected mule transactions of Rs 1,000 or more, including through AI tools. It also allows them to place temporary holds on funds for up to 60 days, unless the police direct otherwise. As drafted, the rules would have taken effect only on April 1, 2027.

The government also proposed adopting safeguards from the RBI’s discussion paper on digital payments before December. These include a one-hour delay on payments of Rs 10,000 or more, allowing customers to cancel them, and a “kill switch” to disable all digital payments at once.

How big is the problem?

“The biggest financial fraud on the economy of the country that has taken place through these digital arrests, running into thousands of crores of rupees and still we are not able to take very strong measures,” Chief Justice Kant said.

The court noted that the net loss to the economy from these scams this year was still almost Rs 800 crore. Last November, it put the total amount extorted from victims at over Rs 3,000 crore and asked the RBI why it was not using AI to identify and freeze accounts used by fraudsters.

The amicus curiae said the scams were continuing “unabated”. She cited the case of a woman who lost Rs 2.5 crore the previous week. She also referred to a victim who was approached by someone posing as a Central Bureau of Investigation (CBI) officer and was then shown a forged Supreme Court order bearing the name of the then Chief Justice.

“Someone tells you over the phone that you are arrested, and you accept that you are arrested. You are in a democratic country. Go to the police and ensure that the person is arrested,” Chief Justice Kant said.

The case began with a complaint from a senior citizen couple in Ambala who lost Rs 1.05 crore to fraudsters posing as CBI, Enforcement Directorate and judicial officials. In December 2025, the court directed the CBI to investigate digital arrest scams across India.

Questions the direction raises:

• Due diligence: Who will decide whether a bank failed to exercise due diligence, and will the victim have to prove it?
• Payment apps: Will the direction cover payment apps and wallets or only banks?
• Privacy: Banks would automatically report “unusual” transactions to the police. How would this requirement fit with the Digital Personal Data Protection (DPDP) Act?
• Wrongful holds: What happens to customers whose genuine payments are held by mistake? The RBI’s draft does not provide for compensation in such cases.

Also read: