Digital Arrest Fraud: Supreme Court Wants Banks to Compensate Victims
A video call from a fake "CBI officer", a fake "court order", and a life's savings moved to strangers' accounts: this is the digital arrest scam. On 29 October 2026 the Supreme Court told the Reserve Bank of India that its new cyber-fraud rules must make banks pay victims back where the bank failed to do its checks. Here is what the Court said, what the RBI's draft rules on money mule accounts contain, and what you can do today if you are cheated.
What the Supreme Court said on 29 October 2026
Hearing its own (suo motu) case on digital arrest scams, a bench headed by Chief Justice Surya Kant said the RBI's proposed framework must spell out a bank's financial liability. Where an inquiry shows that the fraud happened because a bank or financial institution failed in due diligence, for example by letting a fake or "mule" account run, it should compensate the victim at least for the amount lost. "Unless there is a penal direction to these banks, they will never mend their ways," the CJI remarked.
The Court will first examine the RBI's proposed Know Your Customer (KYC) Amendment Directions, 2026, which the RBI plans to notify by 30 November and bring into force by 31 December 2026, as reported. The RBI must list all authorised financial institutions so that the Court's directions can bind the whole sector, and every State and Union Territory must report the FIRs and investigations in digital arrest cases. No final order on compensation had been passed when we checked.
At a GlanceDigital Arrest Case in the Supreme Court: Key Facts
| Point | Fact |
|---|---|
| Case | Supreme Court's suo motu case on digital arrest scams |
| Hearing | 29 October 2026, bench headed by CJI Surya Kant |
| Main message | Banks should compensate victims where fraud resulted from the bank's failure of due diligence |
| RBI rules under review | Draft KYC Amendment Directions, 2026 (SOP for suspected money mule accounts) |
| Timeline (as reported) | Notify by 30 November 2026; in force by 31 December 2026 |
| Other directions | RBI to list all authorised institutions; States/UTs to report FIRs and probes |
| Helpline | 1930 and cybercrime.gov.in |
| Final order | Not yet; matter continues |
There is no such thing as a "digital arrest" in Indian law. Police, CBI, ED or customs never arrest anyone on a video call or ask for money to "verify" your account. The scam works only because the money lands in bank accounts opened with fake or borrowed KYC, called mule accounts. The Court's point is simple: if a bank let such an account open or run without proper checks, the bank should share the loss.
🏠 Everyday analogy
If a housing society's guard lets a stranger in without checking any ID and a flat is robbed, residents expect the security agency to answer for it. The thief is the criminal, but the guard who skipped the check is also responsible.
🇮🇳 Real Indian example
Retired people in Delhi, Hyderabad and Bengaluru have lost lakhs, and in some cases crores, after being kept on video calls for days by fraudsters posing as officers. The money usually passes through several mule accounts within minutes.
RBI RulesRBI's Draft Rules on Money Mule Accounts (KYC Amendment Directions, 2026)
- 1Flag
A transaction of Rs 1,000 or more flagged by the bank's monitoring systems, including AI/ML tools, is treated as a suspected mule transaction.
- 2Hold
The bank can put a temporary debit hold on the money, or on the whole account if it looks like a mule account.
- 3Notice
The account holder is told and gets 20 days to explain.
- 4Decision
The bank must decide within 10 days of the reply.
- 5Outer limit
The hold cannot last beyond 60 days unless a law enforcement agency directs otherwise.
- 6Report
Banks must file a Suspicious Transaction Report when they find a mule account.
Your Rights TodayBank Liability in Cyber Fraud Under RBI's 2017 Rules
| Situation (RBI circular, 6 July 2017) | Your liability |
|---|---|
| Fraud due to the bank's own fault or negligence | Zero, even if you report late |
| Third-party breach, you report within 3 working days | Zero |
| Third-party breach, you report in 4 to 7 working days | Limited to a capped amount (depends on account type) |
| Loss due to your own negligence, such as sharing OTP or PIN | You bear the loss until you report it to the bank |
The 2017 rules cover unauthorised transactions. In a digital arrest scam the victim is frightened into making the transfer personally, so banks often say the transaction was "authorised" and refuse to pay. That gap is why the Supreme Court wants the new rules to put liability on banks that let mule accounts operate.
What To DoCheated in a Digital Arrest Scam? Do This at Once
- 1Call 1930 immediately
Report on the National Cyber Crime Helpline 1930 or cybercrime.gov.in. The first hours decide whether money can be frozen.
- 2Tell your bank in writing
Email or write to your bank's fraud desk the same day; note the complaint number. Reporting within 3 working days protects your rights.
- 3File an FIR
Go to the local police station or cyber cell; cheating by personation is a crime under Section 66D IT Act and Section 319 BNS.
- 4Keep evidence
Save call logs, screenshots, account numbers, UTR numbers of every transfer.
- 5RBI Ombudsman
If the bank does not reply in 30 days or rejects your claim, complain at cms.rbi.org.in.
Official TextSection 66D IT Act and Article 142: The Law Behind the Case
Information Technology Act, 2000, Section 66D. Punishment for cheating by personation by using computer resource.
Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.
Constitution of India, Article 142(1) (extract).
The Supreme Court in the exercise of its jurisdiction may pass such decree or make such order as is necessary for doing complete justice in any cause or matter pending before it ...
- Article 142 lets the Supreme Court pass orders needed for "complete justice"; it is the basis for the Court's wide directions to the RBI, CBI and States in this suo motu case.
- Article 21 (right to life and personal liberty) has been read to include a life of dignity and security; victims' savings and mental health are at stake here.
- The RBI's power to give binding directions to banks comes from Section 35A of the Banking Regulation Act, 1949.
- Under the new criminal laws, cheating is Section 318 BNS and cheating by personation is Section 319 BNS; posing as a public servant is Section 204 BNS.
Why It MattersBank Liability for Cyber Fraud: Arguments For and Against
For bank liability
- Mule accounts open only when KYC checks fail
- Banks have the data and AI tools to spot odd transfers
- Victims, often elderly, cannot fight banks alone
- Penalties push banks to tighten checks
Concerns raised
- Victims did authorise the transfer themselves
- Risk of fake claims and moral hazard
- Higher costs may be passed to all customers
- Fraudsters move money abroad within minutes
UPSC CornerDigital Arrest and Bank Liability for UPSC Prelims and Mains
- Prelims: 1930 = National Cyber Crime Helpline; portal cybercrime.gov.in, run under I4C (Ministry of Home Affairs).
- Prelims: RBI zero-liability rule (2017): report an unauthorised e-transaction within 3 working days.
- Prelims: Section 66D IT Act = cheating by personation using a computer resource: up to 3 years and fine up to Rs 1 lakh.
- Prelims: A money mule is a person whose bank account is used to receive and pass on proceeds of crime.
- Mains (GS III): "Cyber fraud is as much a regulatory failure as a policing failure." Discuss with reference to digital arrest scams and the Supreme Court's push for bank liability.
Practice MCQTest Yourself: Digital Arrest: Banks to Compensate?
With reference to the digital arrest case in the Supreme Court in October 2026, consider the following statements: (1) Indian law allows investigating agencies to place a person under arrest through a video call. (2) The Court said banks should compensate victims where the fraud resulted from the bank's failure of due diligence. (3) RBI's draft rules propose a temporary hold on suspected money mule accounts. Which of the statements given above is/are correct?
Doubts ClearedFrequently Asked Questions
What did the Supreme Court say about digital arrest fraud on 29 October 2026?
It told the RBI that its new cyber-fraud rules must make banks and financial institutions compensate victims, at least for the amount lost, where the fraud happened because the institution failed in due diligence.
Is digital arrest legal in India?
No. There is no provision for arrest by video call. Police, CBI, ED or customs never ask you to stay on a call or transfer money to verify your account. Any such call is a scam.
Will banks now refund digital arrest victims?
Not automatically yet. The Court has asked the RBI to build bank liability into its rules, expected to be notified by 30 November 2026. Until then, report quickly, complain to your bank and use the RBI Ombudsman.
What is a money mule account?
A bank account, often opened with fake or borrowed documents, used by fraudsters to receive and quickly pass on stolen money. RBI's draft rules let banks put a temporary hold on such accounts.
What should I do first if I lose money to a digital arrest scam?
Call 1930 or report on cybercrime.gov.in at once, inform your bank in writing within 3 working days, file an FIR, and keep all transaction details.
Sources and further readingSources We Checked
Facts checked against the reports below on 30 October 2026. The Court's remarks are from news reports of the hearing; we had not seen a written order. We will update this page when the RBI notifies its final rules or the Court passes an order.
- Business Standard: SC asks RBI to make banks compensate victims of digital arrest, cyber fraud (29 Oct 2026)
- DT Next (PTI): Banks must compensate digital fraud victims for loss if due-diligence failure established: SC (29 Oct 2026)
- Bombay Samachar: Banks must compensate digital fraud victims if due diligence fails: SC (29 Oct 2026)
- MediaNama: RBI draft sets 60-day limit on cyber fraud bank holds (Sep 2026)
- law.asia: Draft rule changes on freezing suspected fraud money (RBI KYC Amendment Directions)
- RBI: Customer Protection, Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017)