New Delhi: The Supreme Court on Thursday said banks must be made accountable to indemnify losses suffered by digital fraud victims, who should receive compensation of at least the amount lost if an investigation establishes that the offence resulted from a failure of due diligence by the financial institutions.
Observing that despite the fact that cyber crimes fell by 50 per cent, yet victims lost Rs 800 crore so far this year, a bench comprising Chief Justice Surya Kant and justices Joymalya Bagchi and V Mohana said the proposed Reserve Bank of India (RBI) regulatory framework must incorporate enforceable provisions for compensation, preventive intervention and institutional accountability.
The CJI said the bench would first examine the proposed RBI Know Your Customer (KYC) Amendment Directions, 2026, before permitting the regulatory process to proceed.
The directions are proposed to be notified by November 30 and operationalised by December 31.
The bench emphasised that the framework must go beyond general advisories and establish clear obligations on financial institutions, along with consequences for non-compliance.
“We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution,” it said in its order.
“These are all hypertechnical things. Unless there is a penal direction to these banks, they will never mend their ways,” the CJI said.
It also reiterated that banks must temporarily suspend transactions that are inconsistent with an account holder’s established transaction history, automatically report suspicious activity and undertake physical verification wherever necessary to establish the genuineness of a transaction.
“Fraud running into thousands of crores has taken place through digital arrest scams, and we are still unable to take very strong measures. Why can banks not be mandated to classify accounts into different groups? For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI,” the CJI said.
The observations came during the hearing of the suo motu proceedings titled In Re: Victims of Digital Arrest Related to Forged Documents, initiated to strengthen the institutional response to digital arrest scams and related cyber-enabled financial crimes.
During the hearing, the CJI questioned why banks could not intervene when an account holder suddenly sought to transfer a substantial sum that bore little resemblance to the person’s usual banking activity.
Describing banks as a “protective umbrella” for vulnerable customers, the CJI said financial institutions possess information about their account holders, including their transaction histories, and should use that knowledge to prevent fraud before money leaves an account.
He drew a distinction between commercial accounts, where transactions worth crores of rupees may be routine, and individual accounts belonging to retired persons or ordinary savers who typically withdraw relatively small amounts.
“If that person suddenly seeks to transfer a large amount through RTGS, why can there not be intervention,” the CJI asked.
The bench suggested that financial institutions could classify accounts according to their nature and transaction patterns and deploy technology, including artificial intelligence, to identify deviations that may indicate coercion or fraud.
It also called for a mechanism under which the nearest police station would be automatically alerted about suspicious high-value transactions involving customers potentially targeted by digital arrest fraudsters.
Local police could then verify whether the account holder was knowingly initiating the transaction, it said.
The CJI cautioned that retrospective investigations and reports would not be sufficient if institutions failed to prevent the transfer of funds in the first place.
“A report would only be a post-mortem. We are concerned with prevention,” he said.
Attorney General R Venkataramani, appearing for the Centre and other authorities, told the bench that substantial work had been undertaken to improve the detection of suspicious transactions and strengthen preventive mechanisms within the banking system.
The CJI, however, questioned whether the proposed measures contained sufficiently strong accountability provisions and whether they would result in meaningful action against institutions that failed to comply.
“What are the accountability clauses in the guidelines? If a bank fails to comply, what is its accountability,” the CJI asked.
He further questioned whether the proposed framework would require a bank to compensate a victim in cases of digital arrest fraud.
The attorney general submitted that the RBI was examining banking liability and the liability of individual bank officials, including personal liability and criminal prosecution where an employee was found to have colluded in a fraud.
“The regulation must include a liability clause. Otherwise, we will enforce it through a judicial order,” the CJI said.
The attorney general said that the government was not defending banking negligence or collusion and was examining the various aspects of prevention and accountability.
The court emphasised that the RBI’s proposed directions must spell out the extent of institutional liability, the safeguards available to customers and the process through which compliance would be enforced.
The bench said it did not intend to require every individual bank to be impleaded in the proceedings. Instead, it directed the RBI to submit a list of all authorised financial institutions by the next hearing so that any directions issued by the court could apply across the sector.
The CJI identified two areas requiring particular attention: the accountability of banks and the continued use of mule accounts to receive and transfer proceeds of cybercrime.
Mule accounts, often operated or obtained through deceptive means, are used by fraudsters to move money between accounts and make the tracing and recovery of stolen funds more difficult.
The bench also directed the law enforcement agencies of all states and Union territories to submit reports detailing FIRs registered in digital arrest scam cases and the investigations arising from them.
The agencies have also been asked to provide suggestions for the prevention, detection and prosecution of such offences.
The DGPs of all states and Union territories have been directed to ensure compliance.
The reports must be submitted to the inter-departmental committee coordinating the government’s response, with reports furnished to the court also being forwarded to the committee, the bench directed.
Senior advocate Kapil Sibal, appearing for WhatsApp, told the bench the platform had taken preventive measures, including action against 9,400 accounts, and would file an affidavit detailing the steps undertaken.
He said the platform was working on software to identify suspicious accounts and warn users.
