SC asks WhatsApp, intermediaries for plan to curb digital arrest scams

The Supreme Court has directed WhatsApp and other digital intermediaries to inform it about the measures they propose to implement to prevent digital arrest scams and related cybercrimes, while also asking them to submit their proposals to the Indian Cybercrime Coordination Centre (I4C).

A bench headed by Chief Justice of India Surya Kant, and comprising Justices Joymalya Bagchi and V Mohana, issued the directions in an order arising from the October 29 hearing of a suo motu case titled In Re: Victims of Digital Arrest Related to Forged Documents.

The court has listed the matter for further consideration on November 23.

"WhatsApp LLC (A Meta company) and other concerned intermediaries are also directed to apprise this Court of the measures they propose to undertake to prevent the digital arrest scams and related cybercrimes. They shall also simultaneously submit their proposals to the I4C," the bench said.

𝗪𝗵𝗮𝘁𝘀𝗔𝗽𝗽 𝗼𝘂𝘁𝗹𝗶𝗻𝗲𝘀 𝗽𝗿𝗲𝘃𝗲𝗻𝘁𝗶𝘃𝗲 𝘀𝘁𝗲𝗽𝘀

Senior advocate Kapil Sibal, appearing for WhatsApp, informed the court that the messaging platform had already taken action against 9,400 accounts as part of its efforts to prevent cyber fraud.

He submitted that WhatsApp would file an affidavit detailing the measures undertaken and the additional safeguards being developed.

Sibal also said the platform was working on software designed to identify suspicious accounts and alert users to potential fraudulent activity.

The court's directions seek to involve digital platforms more directly in efforts to identify and prevent scams in which fraudsters impersonate law enforcement or government officials to intimidate victims into transferring money.

𝗕𝗮𝗻𝗸𝘀 𝗺𝘂𝘀𝘁 𝗰𝗼𝗺𝗽𝗲𝗻𝘀𝗮𝘁𝗲 𝘃𝗶𝗰𝘁𝗶𝗺𝘀

In its October 29 order, the Supreme Court also emphasised that financial institutions must be held accountable when digital arrest scams or other cyber frauds occur because of their failure to exercise due diligence.

The bench said the regulatory measures proposed by the Reserve Bank of India (RBI) must include enforceable provisions requiring banks and other financial institutions to compensate affected customers where institutional negligence is established.

"We reiterate and emphasize that the regulatory measures proposed by the Reserve Bank of India (RBI) must mandate and incorporate suitable provisions that require financial institutions to indemnify victims of digital arrest scams and other cyber frauds and pay suitable compensation not less than the amount lost by the customer, where it is established that the fraud or crime occurred due to the failure on the part of the financial institution to exercise due diligence in preventing or reporting the act/incident," the court said.

The bench stressed that compensation should not be discretionary in cases where an investigation establishes that a financial institution failed to take appropriate preventive or reporting measures.

𝗦𝗖 𝗳𝗹𝗮𝗴𝘀 𝘂𝗻𝘂𝘀𝘂𝗮𝗹 𝗯𝗮𝗻𝗸 𝘁𝗿𝗮𝗻𝘀𝗮𝗰𝘁𝗶𝗼𝗻𝘀

During the hearing, the Chief Justice questioned why banks could not intervene when customers suddenly attempted to transfer unusually large amounts inconsistent with their established transaction histories.

The bench observed that financial institutions possessed sufficient information about their customers to identify suspicious transactions and take preventive action before funds were transferred.

"We have also emphasised in the past various preventive safeguards that must be mandated for every financial institution. These may include temporarily suspending unusual or suspicious transactions inconsistent with the account's past transaction history, automatically intimating such transactions to the nearest police station, and subsequently physically verifying the reported transactions to ascertain their genuineness," the order stated.

The Chief Justice described banks as a "protective umbrella" for vulnerable customers and stressed that their responsibilities extended beyond merely processing financial transactions.

The court also noted that although cybercrimes had declined by 50 per cent, victims had lost approximately Rs 800 crore so far this year.

It said the proposed RBI regulatory framework must incorporate enforceable provisions covering compensation, preventive intervention and institutional accountability.

𝗥𝗕𝗜 𝗮𝘀𝗸𝗲𝗱 𝘁𝗼 𝘀𝘂𝗯𝗺𝗶𝘁 𝗹𝗶𝘀𝘁 𝗼𝗳 𝗯𝗮𝗻𝗸𝘀

To ensure effective implementation of the proposed safeguards, the Supreme Court directed the RBI to submit a list of all authorised financial institutions before the next hearing.

The bench also indicated that it would examine the proposed RBI Know Your Customer (KYC) Amendment Directions, 2026, before allowing the regulatory process to proceed.

The proposed directions are scheduled to be notified by November 30 and operationalised by December 31.

Attorney General R Venkataramani, appearing for the Centre and other authorities, informed the bench that substantial work had already been undertaken to strengthen the detection of suspicious transactions and improve preventive mechanisms within the banking system.

𝗦𝘁𝗮𝘁𝗲𝘀 𝘁𝗼 𝘀𝘂𝗯𝗺𝗶𝘁 𝗰𝘆𝗯𝗲𝗿𝗰𝗿𝗶𝗺𝗲 𝗿𝗲𝗽𝗼𝗿𝘁𝘀

The Supreme Court also directed law enforcement agencies across all states and Union territories to submit reports detailing FIRs registered in digital arrest scam cases and the status of investigations arising from them.

The agencies have been asked to provide recommendations for improving the prevention, detection and prosecution of such offences.

Directors General of Police of all states and Union territories have been instructed to ensure compliance with the directions.

The reports must be submitted to the inter-departmental committee coordinating the government's response to digital arrest scams. Copies of reports furnished to the Supreme Court must also be forwarded to the committee.

The matter will be taken up again on November 23, when the court is expected to consider the responses of digital intermediaries, financial regulators and law enforcement agencies.