The Supreme Court of India has told the Reserve Bank of India (RBI) that its upcoming rules on digital arrest fraud must make banks compensate victims in full when a bank’s lapse in due diligence enabled the crime. A bench led by Chief Justice of India Surya Kant set out this position on 29 October 2026, warning that it would otherwise impose liability by judicial order.
The bench, which also includes Justice Joymalya Bagchi and Justice V Mohana, is hearing a suo motu case opened after an elderly couple lost ₹1.05 crore to fraudsters who used forged court orders. The hearing comes as regulators step up scrutiny of security lapses, including RBI’s tighter cyber checks on bank-fintech APIs.
What the Supreme Court wants in RBI’s digital arrest fraud rules
In its order, the court said the regulatory measures proposed by the RBI must require financial institutions to indemnify digital arrest and cyber fraud victims with compensation of not less than the amount lost, where the fraud is found to have resulted from the institution’s failure to exercise due diligence. The bench said advisory guidelines alone would not change bank behaviour without enforceable penalties.
“The regulation must include a liability clause. Otherwise, we will enforce it through a judicial order,” the Chief Justice said. Justice Bagchi added that the court was weighing strict liability for institutions whose weak safeguards allowed banking services to be misused for cybercrime.
Prevention, not post-mortem
The bench questioned why transactions that sharply depart from a customer’s usual pattern cannot be stopped before money leaves the account. It listed safeguards it expects banks to adopt:
- Temporary suspension of unusual transactions that do not match an account’s past history
- Automatic alerts on such transactions to the nearest police station
- Physical verification to confirm a transaction is genuine before it goes through
- Personal liability and criminal prosecution for bank officials found colluding with fraudsters
Such controls would build on existing tools such as RBI’s AI-driven MuleHunter.ai for spotting mule accounts, but would shift the cost of failure onto the lender.
Where RBI’s framework stands
Attorney General R Venkataramani told the court that the RBI is expediting the framework, which is expected to take the form of the Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, and will address the liability of banks and their officials. The bench asked the RBI to place the draft and a list of authorised financial institutions before it, and directed states to report the status of FIRs in digital arrest cases. The matter will be heard again before 30 November 2026.
The gap the court is pointing at is large. A status report from the Indian Cybercrime Coordination Centre (I4C) and the Ministry of Home Affairs recorded 21,928 digital arrest complaints involving more than ₹647 crore on the National Cybercrime Reporting Portal in the first eight months of 2026. By comparison, the RBI’s revised compensation rules for electronic banking fraud, due from January, cap relief at ₹25,000 and only for losses up to ₹50,000.
Why it matters for banks
A mandatory liability clause would turn fraud prevention from a compliance checkbox into a direct balance-sheet risk. Banks would need stronger real-time transaction monitoring, behavioural analytics and faster coordination with law enforcement. The push lands in a tense month for the sector, after a ₹7.8 crore cyber fraud at Spandana Sphoorty and an earlier shift in fraud patterns from digital arrests to investment scams.
Key takeaways
- The Supreme Court wants banks to repay digital arrest victims at least the amount lost when the bank’s due diligence failed.
- It expects suspension of unusual transactions, police alerts and physical verification as mandatory safeguards.
- RBI must show its draft KYC amendment rules to the court, with the next hearing due before 30 November 2026.
FAQ
What is a digital arrest fraud?
Fraudsters pose as police or central agency officers on video calls, claim the victim is under investigation and pressure them into transferring money to “verify” funds.
Will banks now have to refund every cyber fraud loss?
No. The court’s position covers losses where the fraud resulted from the bank’s failure of due diligence; the final rules will depend on the RBI framework and any further court order.
Featured image: Supreme Court of India, New Delhi. Photo: Subhashish Panigrahi / Wikimedia Commons (CC BY-SA 4.0)
