Between 1 January and 31 August 2026, I4C recorded 21,928 digital arrest complaints and ₹647 crore in direct losses.
NEW DELHI: The Supreme Court has signalled that banks may have to pay digital arrest victims “not less than the amount lost” when due diligence fails. Hearing a suo-motu case on 29 and 30 October 2026, a bench led by Chief Justice of India Surya Kant also proposed prosecution of errant banks. Consequently, a 2017 rulebook written for a different kind of fraud now faces its sharpest test.
A letter that began the case
The case traces to a letter dated 21 September 2025. A senior citizen couple wrote to the Court after losing ₹1.055 crore between 3 and 16 September 2025. Fraudsters had posed as officials of the CBI and the ED and as judicial authorities over phone and video calls. Moreover, they displayed forged Supreme Court orders, a fake PMLA freeze order and fabricated Bombay High Court proceedings. Notably, the fraud has not stopped. The amicus curiae told the bench that a woman lost ₹2.5 crore within a single week this October.
What the bench proposed
Chief Justice of India Surya Kant said the Court was proposing to direct that “the bank will compensate the victim and suffer prosecution.” Justice Joymalya Bagchi stressed strict liability where deposit accounts help sustain cyber extortion. The bench, which also included Justice V. Mohana, asked the Reserve Bank of India for a list of all authorised financial institutions. Consequently, binding directions could cover every registered entity without impleading banks one by one. Furthermore, the Court wants unusual transactions halted and local police alerted automatically. It also wants the RBI to record action against negligent or complicit bank staff. The compensation and prosecution measures remain proposals.
Two numbers that do not sit easily together
The Union government cites a falling figure. Attorney General R. Venkataramani told the Court that coordinated efforts had cut digital arrest incidents by 50%. He urged the bench to let rulemaking conclude first. However, the Chief Justice cited net citizen losses of about ₹800 crore in 2026. Meanwhile, I4C data before the Court records 21,928 digital arrest complaints and ₹647 crore in direct losses between 1 January and 31 August 2026. The figures cover different scopes, yet both show a problem that persists.
Authorised, yet coerced
At the centre sits an RBI circular of 6 July 2017 on limiting customer liability. It was drafted for unauthorised debits caused by malware, skimming or data leaks. It imposes zero liability on customers where the bank is negligent and places the burden of proving customer negligence on the bank. In digital arrest cases, however, victims log in and authenticate the transfer themselves under terror. Banks have historically called such payments voluntary. The bench indicated that a coerced payment does not absolve a bank in two cases. One is a mule account that passed deficient KYC checks. The other is a monitoring system that failed to freeze an anomalous transfer.
Six steps and a 60-day cap
The RBI’s draft KYC Amendment Directions of September 2026, framed under Section 35A of the Banking Regulation Act, 1949, supply the machinery. A money mule account is one used, knowingly or unknowingly, to receive or move fraud proceeds. Notably, the holder’s intent is irrelevant. Banks must impose a debit hold immediately and notify the holder at once on digital channels. Subsequently, the holder has 20 calendar days to explain. Absent a freeze order from police or a court, the hold lifts on the 31st day after a police reference, and it is capped at 60 days. Finally, notification is targeted for 30 November 2026 and full compliance by 1 April 2027.
The price of protection
Monitoring systems can flag legitimate high-value transfers such as property purchases or medical emergencies. Meanwhile, fraud networks disperse funds within three to five minutes, which blunts manual verification. Compensation also carries moral hazard, since account holders could collude with accomplices and claim indemnity. Consequently, a verifiable test for “failure of due diligence” will matter as much as the principle itself.
What to watch
Several milestones will decide how far the principle travels. First, the RBI must submit its list of institutions by the next hearing. Second, final KYC directions are due on 30 November, and the Court intends to examine them before the process concludes. Likewise, it is unsettled whether strict liability will reach non-bank payment operators, prepaid issuers and digital lending apps. Furthermore, the Union Government on 30 October constituted a High Level Committee on Banking for Viksit Bharat under former Central Vigilance Commissioner Suresh N. Patel.
Encouragingly, the Court wants judicial directions to complement the RBI’s draft rules rather than replace them. If banks bear the cost of failed safeguards, the incentive to halt suspect money early strengthens. Ultimately, the first compensation order under the new regime will show whether the principle holds in practice.
About the Author
