Digital Arrest| Supreme Court Says RBI Rules Must Make Banks Compensate Victims Not Less Than Amount Lost Where Due Diligence Fails

The Supreme Court directed that the regulatory measures proposed by the Reserve Bank of India (RBI) must mandate financial institutions to indemnify victims of digital arrest and cyber fraud with compensation not less than the amount lost, where the fraud was found to have occurred due to the institution’s failure of due diligence.

The Court, while hearing the matter, stated that it was inclined to issue certain directions sought by the Amicus Curiae and the Union of India, but first wished to examine the proposed RBI (Know Your Customer) Amendment Directions, 2026, which are to be notified by November 30, 2026 and operationalised by December 31, 2026.

The Court also directed the RBI to submit, on the next date of hearing, a list of all authorised financial institutions, observing that the banks need not be impleaded individually and that the directions would be notified for implementation by all of them.

O August 4, 2026, the Court issued comprehensive interim directions to streamline investigation, account freezing, and victim restitution.

The Bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana ordered, "With reference to the various suggestions and consequential directions that were proposed to be sought by the learned amicus curiae through her note dated 14th October 2026, the learned Attorney General has submitted a note dated 28th October 2026, suggesting some proposed directions on behalf of the Union of India. While we are inclined to issue certain directions as requested by the amicus curiae as well as by the Union of India, as of now, firstly, we would like to examine the proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, which are proposed to be notified by 30th November 2026 and to be operationalized by 31st December 2026. We may emphasize that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify digital arrest or cyber fraud victims with suitable compensation not less than equivalent to the amount lost by the customer, in the event it is found that such fraud or crime has taken place as a result of the failure of due diligence on behalf of the financial institution."

AG R Venkataramani appeared for the Union of India

The Court added, "It has also been emphasized by us in the past that some measures—like the temporary suspension of a proposed transaction wherever it takes place unusually in an account contrary to its past track record, automated information of such transactions being processed to the neighboring police station, followed by physical verification and ascertainment of the genuineness of such transactions—are some of the preventive measures that must be mandated for every financial institution. In order to ensure that the regulatory measures proposed by the RBI, along with the directions issued by us, are given effect without any delay, we also direct the RBI to submit a list of all authorized financial institutions on the next date of hearing."

The Court noted that despite all these good efforts, the net loss suffered by the country's economy even this year is almost ₹800 crores. There are two gray areas where bank responsibility and these directions must be implemented properly—mule accounts being a major problem. The RBI was asked to look into this very closely, and strict instructions have been issued regarding closing new mule accounts.

Amicus Curiae submitted that she continued to receive inputs indicating that digital arrest scams were taking place unabated. She accordingly sought a direction requiring the State law enforcement agencies to report on the registration of FIRs, the status of investigations, and their suggestions for prevention, protection and prosecution.

CJI observed that awareness campaigns, newspaper reports and social media information were available in abundance, and enquired why people were still being trapped.

Amicus Curiae submitted that she had received information of a scam during the previous week in which a woman lost ₹2.5 crore, and that educated persons were also falling victim.

CJI enquired how a person could be arrested through a mobile phone and whether the victims failed to appreciate this basic position. Amicus Curiae submitted that certain psychologists had also offered explanations regarding the state of mind of the victims. The CJI observed, "Someone tells you over the phone that you are arrested, and you accept that you are arrested. You are in a democratic country. Go to the police and ensure that the person is arrested."

Amicus Curiae further submitted that, on the previous day, she had received an email from a victim who was first approached by a person impersonating a CBI officer, whereafter a forged order of this Court, bearing the name of the then CJI, was used.

The CJI observed that members of the public could visit the website of this Court to verify whether such an order existed, and that, even assuming that this Court had passed a drastic order, a person would ordinarily contact someone before acting upon it.

Venkataramani submitted that awareness programmes were being conducted regularly and that the agencies and the public were extending their assistance.

CJI observed that banks knew their account holders and the balances held by them, and that it was their duty to act as a protective umbrella. He recalled that the Court had earlier asked why banks did not halt and verify a transaction when a withdrawal of such money was attempted.

Attorney General submitted that this was being done, that several rules which did not exist earlier were now in place and were being operationalised, and that considerable progress had been made. He submitted that he had requested the RBI to expedite and complete the rule-making process, and that I4C was working round the clock.

To which the Court observed that a report would only be a post-mortem and that the concern of the Court was prevention.

Attorney General submitted that preventive steps operated at three levels: awareness, intervention by banks, and measures where money had nevertheless been transferred. He submitted that the endeavour was to operationalise the RBI and MeitY rules by around December. He submitted that the Union proposed only a partial modification of the Amicus Curiae’s prayer for immediate operationalisation of the RBI directions, namely that the RBI be directed to notify the draft directions in accordance with law by November 30, 2026, and operationalise them at the earliest.

He submitted that the SOP had already been circulated and placed before the Court, that the directions would address KYC and mule accounts, and that the NCRP portal was expected to be completed by December 31, though it could be expedited.

CJI Kant said that these were hypertechnical matters and that, unless a penal direction was issued to the banks, they would never mend their ways.

Attorney General also submitted that banking liability and the liability of bank officers were addressed in the proposals. He further submitted that, regarding the RBI discussion paper on digital payment safeguards, including the lag-credit mechanism, the Union proposed adoption after reviewing stakeholder comments, with a deadline before December. He submitted that the modifications sought were not substantially at variance with the Amicus Curiae’s proposals.

The CJI observed that bank officials and employees were themselves involved, and that there was soft-pedalling by the RBI, as it was consulting the banks while the Court was asking for action against them.

The Attorney General submitted that the Union proposed that the RBI place on record, before the next date of hearing, the action taken by the respective banks against errant employees found to be involved in digital arrest cases.

Chief Justice Kant remarked, "The biggest financial fraud on the economy of the country that has taken place through these digital arrests, running into thousands of crores of rupees and still we are not able to take very strong measures. Why can banks not be mandated to classify accounts into different groups? For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI...Tell us your regulation. Do they provide that in the event of an unusual transactions taking place in the case of an individual account...the bank will stall that transaction. Therefore, and for automatic information will go to the local police station..."

AG R Venkataramani added, "We are not disagreeing with the directions sought by the amicus. We only need some time. We should not issue directions that ultimately prove ineffective."

Justice Bagchi added, "We will put up a strict liability on the financial institutions. We are only talking of financial services rendered by the bank in the form of a savings account, in the form of any service, any other financial product which the bank is selling to the customer, is misused for the purpose of a digital arrest or cyber fraud, the strict liability clause will be the failure of the bank to instill."

The AG submitted that the RBI directions had been finalised and needed time for implementation, that he had examined them and suggested changes, and that compliance would be the responsibility of the banks under RBI supervision. The CJI observed that compliance must be mandatory, that liability could not be confined to an individual officer, and that the bank must also be liable, with zero debit in the victim’s account. The AG submitted that the guidelines or directions were binding on banks, who had no discretion in the matter.

The CJI observed that, in builder-buyer frauds, subvention schemes and project-linked loans, master circulars existed but their implementation was doubtful. The AG submitted that the Union sought to go beyond the master circulars. The CJI directed that the Union show how far it was going beyond them and what process would ensure compliance. He further stated that the regulator must formulate a mandatory provision requiring an unusual transaction to be suspended until the full verification protocol was followed.

The AG submitted that the status report dated March 30 and the SOP addressed these concerns, and that time till November 30 was sought, as the NCRP portal, reminders and routing of information had to be operationalised. He submitted that the SOP had been examined by the RBI and discussed in the inter-departmental committee, that the October 30 deadline be extended by one month, and that I4C was obtaining inputs almost daily from law enforcement agencies and banks.

The Court directed, "The Union of India shall place its affidavit on record detailing the steps already taken, including the blocking of 9,400 accounts involving WhatsApp, MeitY, and DoT. Furthermore, software is being developed to identify accounts impersonating law enforcement officers or government agencies, providing warnings to consumers."

Accordingly, the Court also directed the police authorities to file a report and listed the matter for compliance for a further date of the hearing.

Background

The Court was hearing the matter concerning the "digital arrest" scam targeting an elderly couple in Haryana. In October, 2025, the Court had taken suo motu cognizance and emphasized that the present case is not a solitary instance and the same is happening across the country.

A senior citizen couple, who have been defrauded of their life savings through a “digital arrest” scam had written to the Supreme Court. The victims alleged that they were contacted by persons impersonating CBI officers, ED officials and judicial authorities through telephone and video calls. The fraudsters displayed forged orders of the Supreme Court through WhatsApp and video conferencing. Under threat of arrest and property seizure, based upon those forged documents, the victims were coerced to transfer Rs.1,05,50,000 through multiple bank transactions.

On November 3, 2025, the Court said that it needed to deal with digital arrest cases with an iron hand as it expressed shock over the scale of such cybercrime cases in the country, with over Rs 3000 crore allegedly extorted from victims, including senior citizens.

The Court had also asked the CBI to carry out a unified pan-India probe into digital arrest scam cases and asked the RBI as to why it was not using Artificial Intelligence to find out and freeze bank accounts used by cyber criminals. It had issued notice to the Reserve Bank of India (RBI) and sought its response as to why Artificial Intelligence (AI) or machine learning technology was not employed to freeze bank accounts used in cyber fraud cases.

Cause Title: In Re Victims of Digital Arrest Related To Forged Documents [SMW(Crl) No. 3/2025]