The Supreme Court on Thursday said banks must be held accountable for losses suffered by victims of digital fraud and directed that the proposed regulatory framework provide compensation of at least the amount lost whenever an investigation establishes that the crime resulted from a financial institution's failure to exercise due diligence.
A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana observed that financial institutions must take greater responsibility for preventing cyber fraud, particularly digital arrest scams targeting elderly people and individual account holders.
The court noted that although cybercrime incidents had declined by 50 per cent, victims had lost approximately Rs 800 crore so far this year, underscoring the need for stronger preventive safeguards.
The bench said it would examine the proposed Reserve Bank of India (RBI) Know Your Customer (KYC) Amendment Directions, 2026, before allowing the regulatory process to proceed. The directions are expected to be notified by November 30 and operationalised by December 31.
๐๐ฎ๐ป๐ธ๐ ๐บ๐๐๐ ๐ฏ๐ฒ๐ฎ๐ฟ ๐น๐ถ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐
In its order, the court emphasised that the RBI's proposed framework must contain enforceable provisions requiring financial institutions to compensate victims when negligence on their part contributes to fraud.
"We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution," the bench said.
The Chief Justice expressed dissatisfaction with regulatory approaches that relied primarily on advisories without imposing consequences for non-compliance.
"These are all hypertechnical things. Unless there is a penal direction to these banks, they will never mend their ways," he observed.
The court stressed that the proposed regulations must clearly define institutional responsibility, customer safeguards and mechanisms for enforcing compliance.
๐ฆ๐๐๐ฝ๐ถ๐ฐ๐ถ๐ผ๐๐ ๐๐ฟ๐ฎ๐ป๐๐ฎ๐ฐ๐๐ถ๐ผ๐ป๐ ๐ถ๐ป ๐ณ๐ผ๐ฐ๐๐
The bench reiterated that banks should temporarily suspend transactions that deviate sharply from a customer's established banking behaviour and automatically report suspicious activity.
It also suggested physical verification wherever necessary to determine whether an account holder was voluntarily initiating a transaction.
The Chief Justice questioned why banks could not intervene when an individual who normally made small withdrawals suddenly attempted to transfer a substantial amount through the Real Time Gross Settlement (RTGS) system.
He distinguished between commercial accounts, where transactions involving crores of rupees may be routine, and accounts maintained by pensioners, retired persons and ordinary savers.
"If that person suddenly seeks to transfer a large amount through RTGS, why can there not be intervention," the CJI asked.
Describing banks as a "protective umbrella" for vulnerable customers, he said financial institutions already possessed transaction histories and other information that could help identify unusual activity.
The bench suggested classifying accounts according to transaction patterns and using technology, including artificial intelligence, to detect possible fraud.
๐ฃ๐ผ๐น๐ถ๐ฐ๐ฒ ๐ฎ๐น๐ฒ๐ฟ๐๐ ๐ฝ๐ฟ๐ผ๐ฝ๐ผ๐๐ฒ๐ฑ
The Supreme Court also called for a mechanism to automatically alert the nearest police station when suspicious high-value transactions were detected in accounts potentially targeted by digital arrest fraudsters.
Police could then verify whether the account holder was knowingly transferring the money or acting under coercion, the bench suggested.
The Chief Justice said financial institutions should focus on preventing fraudulent transfers rather than merely investigating losses after the money had disappeared.
"A report would only be a post-mortem. We are concerned with prevention," he said.
The observations came during suo motu proceedings titled In Re: Victims of Digital Arrest Related to Forged Documents, initiated to examine institutional responses to digital arrest scams and related cyber-enabled financial crimes.
๐ฅ๐๐ ๐ฎ๐๐ธ๐ฒ๐ฑ ๐๐ผ ๐ณ๐ถ๐ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐๐ฎ๐ฏ๐ถ๐น๐ถ๐๐
Attorney General R Venkataramani, appearing for the Centre and other authorities, informed the bench that considerable work had been undertaken to strengthen detection systems and preventive measures within the banking sector.
The Chief Justice, however, questioned whether the proposed regulations would impose meaningful consequences on institutions failing to comply with their obligations.
"What are the accountability clauses in the guidelines? If a bank fails to comply, what is its accountability," he asked.
The Attorney General submitted that the RBI was examining both institutional liability and the responsibility of individual bank officials, including possible personal liability and criminal prosecution where collusion was established.
"The regulation must include a liability clause. Otherwise, we will enforce it through a judicial order," the CJI warned.
Venkataramani said the government was not defending banking negligence or collusion and was examining measures to improve prevention and accountability.
The bench also directed the RBI to submit a list of all authorised financial institutions before the next hearing so that any judicial directions could apply across the banking sector without requiring each institution to be individually impleaded.
๐ ๐๐น๐ฒ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐๐ ๐๐ป๐ฑ๐ฒ๐ฟ ๐๐ฐ๐ฟ๐๐๐ถ๐ป๐
The Chief Justice identified the continued operation of mule accounts as another major concern requiring regulatory and investigative attention.
Such accounts are used by fraudsters to receive and transfer stolen funds, often through multiple transactions designed to conceal the money trail and complicate recovery.
The court said banking accountability and the detection of mule accounts must form central components of the proposed framework.
It directed law enforcement agencies across all states and Union Territories to submit reports detailing FIRs registered in digital arrest scam cases and the progress of investigations.
The agencies were also asked to provide recommendations for improving the prevention, detection and prosecution of such offences.
Directors General of Police of all states and Union Territories have been instructed to ensure compliance with these directions.
The reports must be submitted to the inter-departmental committee coordinating the government's response, with copies furnished to the court also being forwarded to the committee.
๐ช๐ต๐ฎ๐๐๐๐ฝ๐ฝ ๐ผ๐๐๐น๐ถ๐ป๐ฒ๐ ๐๐ฎ๐ณ๐ฒ๐ด๐๐ฎ๐ฟ๐ฑ๐
Senior advocate Kapil Sibal, appearing for WhatsApp, informed the court that the messaging platform had taken preventive measures against suspicious activity, including action involving 9,400 accounts.
He said WhatsApp was developing software capable of identifying suspicious accounts and warning users about potential fraudulent activity.
The platform would file an affidavit detailing the preventive steps already undertaken and the additional safeguards being developed, Sibal told the bench.
The Supreme Court maintained that effective prevention, institutional accountability and timely intervention were essential to protecting customers from increasingly sophisticated digital financial crimes.