Digital arrest: Supreme Court presses for bank compensation. What to do

On Thursday, 29 October 2026, the Supreme Court heard its suo motu case on digital arrest scams (In Re: Victims of Digital Arrest Related to Forged Documents) before a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana. The Court signalled that banks should answer for fraud losses where their own due diligence failed. The reports are clear that this is a direction for regulation that is still being drafted. It is not a final ruling that any bank must pay you today.

What the order records, as reported by LiveLaw and The420: the measures the Reserve Bank of India (RBI) is proposing must require financial institutions to indemnify victims of digital arrest and cyber fraud, with compensation of not less than the amount lost, where the fraud resulted from a failure of due diligence. The order does not itself order a bank to pay a particular customer. The bench also said it will first examine the RBI's proposed KYC Amendment Directions, 2026, and asked the RBI to list all authorised financial institutions for the next hearing.

The Chief Justice and Justice Bagchi went further in open court. According to LiveLaw, the Chief Justice said the Court wished to direct that banks compensate victims, and Justice Bagchi spoke of proposing strict liability on financial institutions. The Hans India reports the compensation as at least the amount lost where due diligence failed. These were oral remarks. The Attorney General opposed imposing liability through judicial directions and said the RBI should handle it through regulation. He said the RBI's measures are likely to be operationalised by December; The420 reports the KYC Amendment Directions are expected to be notified by 30 November.

The Court also pressed on prevention. Reports say the bench wants unusual transactions to be temporarily suspended, the police station to be notified automatically, and the genuineness of the transaction to be physically verified. The Chief Justice asked why a customer who usually withdraws small sums can suddenly withdraw a much larger amount without the bank raising an alert. The reports give no reliable loss figure from the bench, so we do not repeat any here.

How the scam works. A digital arrest begins with a call or video call from someone posing as a police officer or other law enforcement official. The victim is told they are linked to a serious crime and must stay on the call, often on video, and tell no one. In one case reported by PTI, the accused posed as police, told the victim he was involved in a human trafficking case, and duped him of Rs 2.39 crore. Fear and isolation do the work; the payment is then demanded as a deposit, a verification or a bail.

The scale is large. A written reply in the Rajya Sabha, reported by Inc42, put digital arrest complaints on the National Cyber Crime Reporting Portal at about 1.23 lakh, with losses of Rs 1,935.51 crore in 2024. Money lost to such scams is often moved on quickly, and freezing an account does not by itself mean a refund, which is why the question of who bears the loss matters.

The warning signs are consistent. A caller says you are under arrest or under investigation. You are asked to stay on video and not to disconnect. You are told to keep it secret from family and from the bank. You are sent official-looking letters or ID cards on WhatsApp. You are asked to move money to a safe or verification account. As a LiveLaw commentary puts it, digital arrest has no legal basis in India. No genuine agency arrests anyone over a video call.

What to do in the first hour. Stop the call and do not send any further money. Call 1930, the national cyber fraud helpline, immediately, because speed decides whether the receiving account can be frozen. Then file the complaint at cybercrime.gov.in. Call your own bank at once and ask it to flag the transfer and the receiving account. Keep the phone numbers, screenshots, payment receipts, transaction IDs and any files you were sent. Do not delete chats, and do not install any app you were told to install.

Do not rely on the proposed compensation yet. Nothing in the reports says a bank has to repay any customer today, and the RBI's measures are not yet in force. RBI's July 2017 circular on limiting customer liability gives zero liability for unauthorised electronic transactions reported within three working days, but it concerns unauthorised transactions and does not clearly cover payments you made yourself. Report quickly and keep a written record of when you told the bank, because the due diligence argument will turn on the facts of each case.

What the law says. Digital arrest is not a separate offence; police apply the existing provisions. LiveLaw lists BNS S. 318 (cheating), BNS S. 308 (extortion), BNS S. 204 (impersonating a public servant) and IT Act S. 66D (cheating by personation using a computer resource). The PTI report on the case above records an FIR invoking BNS S. 308(2), BNS S. 319(2), BNS S. 318(4) and IT Act S. 66D. The sections charged depend on the facts of each complaint, and the police decide them.

Why this matters to businesses and schools. If the RBI's measures arrive as the Court expects, banks will need to monitor unusual withdrawals and hold them for checks. Finance teams, school accounts staff and small firms should expect more verification calls and delays on large transfers, and should treat them as protection rather than obstruction. Staff who handle payments should also be told that no agency demands money over a call.

How Codesnag helps. Codesnag with VirtualVakil works on both sides of such an incident: protection before it and response after it. That means checking the phone or laptop for the remote-access apps and malicious files that scammers often push, securing hacked accounts, preserving the evidence, and helping you prepare a clear timeline for the police and the bank. We do not provide legal advice in this article. If you have just been targeted, call 1930 first; everything else can follow.