Digital Arrest Scam? Supreme Court Wants Banks to Refund Your Full Loss
The Supreme Court has told RBI its new cyber-fraud rules must make banks repay digital arrest victims at least the full amount lost when bank safeguards fail. Rules due by 31 December 2026.
On this page 8 sections
The Supreme Court on 29 October 2026 told the RBI that its new cyber-fraud rules must make banks repay “digital arrest” victims at least the full amount they lost — whenever weak safeguards or poor due diligence by the bank helped the fraud go through. RBI has offered to notify the rules by 30 November and enforce them from 31 December 2026. Here is what changes, what it does not cover yet, and what to do today if you or a parent is targeted.
In one line: today, RBI’s zero-liability rule protects you only for unauthorised transactions. Digital arrest victims usually press “pay” themselves under threat, so banks refuse refunds. The court wants that gap closed with a bank liability clause — “otherwise, we will enforce it through a judicial order.”
Key takeaways
- Who: CJI Surya Kant, Justice Joymalya Bagchi and Justice V Mohana, in the suo motu case on digital arrest scams.
- What: compensation “not less than” the amount lost when the bank’s due diligence failed.
- Bank duties proposed: hold unusual transactions, auto-alert police, physically verify before release.
- When: RBI to notify by 30 Nov 2026, in force by 31 Dec 2026; next hearing 30 Nov 2026.
- Not yet law: old frauds are not automatically refunded. Report fast — call 1930.
What exactly did the Supreme Court say?
The case began in October 2025 after a senior-citizen couple from Ambala lost ₹1.05 crore to people posing as CBI, ED and court officials, complete with forged judicial orders. The court later handed the investigation of digital arrest scams across India to the CBI. At the 29 October hearing, the Bench went further and focused on the banks that let the money leave.
- Compensation: RBI’s proposed framework should require banks and other financial institutions to pay “suitable compensation not less than equivalent to the amount lost” where a lack of safeguards or due diligence contributed to the fraud.
- Liability on the bank, not just the officer: the Chief Justice said the victim’s account should see a “zero debit” and the institution must pay. “The bank will have to pay. That is the only way.”
- Strict liability: Justice Bagchi said the court would “put up a strict liability on the financial institutions.”
- Every regulated entity: RBI must file a list of all authorised financial institutions so the directions bind all of them without making each a party.
- Action on staff: RBI must report what action was taken against bank employees involved in such cases.
New safeguards banks may have to follow
The Bench asked why a bank would not act immediately when, for example, a pensioner suddenly moves lakhs out of an account that normally sees small withdrawals. The safeguards it wants built into the rules:
| Safeguard | What it means for you |
|---|---|
| Temporary hold on unusual transactions | A large transfer that does not match your past pattern may be paused before it leaves |
| Automatic alert to the nearest police station | Suspicious transfers get flagged without you filing first |
| Physical verification | The bank may call or meet you to confirm a big transfer is genuine |
| Mule-account checks (RBI draft, Sept 2026) | Banks flag suspected mule transactions of ₹1,000+, using AI tools; holds up to 60 days |
| Government proposals before December | One-hour delay on payments of ₹10,000+ and a “kill switch” to disable digital payments |
Expect a little more friction on large transfers once these rules arrive — a short delay or a verification call is the trade-off for a bank that has to pay if it misses the red flags.
Why victims could not get refunds until now
RBI’s 2017 customer-protection circular already gives zero liability for unauthorised electronic transactions — if the bank was at fault, or if a third-party breach is reported within 3 working days. But in a digital arrest, the victim is frightened into sending the money themselves. That counts as an authorised transaction, so the 2017 shield does not apply and banks have been able to say no.
| When you report an unauthorised transaction | Your maximum loss (RBI 2017 rules) |
|---|---|
| Bank’s fault or negligence (any time) | ₹0 |
| Third-party breach, reported within 3 working days | ₹0 |
| Reported in 4–7 working days, basic savings (BSBD) account | ₹5,000 or the amount, whichever is lower |
| Reported in 4–7 working days, regular savings account or card limit up to ₹5 lakh | ₹10,000 or the amount, whichever is lower |
| Reported in 4–7 working days, card limit above ₹5 lakh / larger current accounts | ₹25,000 or the amount, whichever is lower |
| Reported after 7 working days | As per the bank’s board-approved policy |
The bank must also credit the disputed amount (a “shadow reversal”) within 10 working days of your report and close the complaint within 90 days. The new rules the court is pushing would extend protection to the “authorised under pressure” cases that this table leaves out.
How big is the problem?
- Net loss to the economy from these scams this year: almost ₹800 crore, as reported from the hearing.
- Last November, the court put total extortion through digital arrests at over ₹3,000 crore.
- The Centre told the court that 9,400 accounts had been blocked with help from WhatsApp, MeitY and DoT, and that complaints had fallen by about half.
- The amicus curiae cited a woman who lost ₹2.5 crore just a week before the hearing.
What you should do today
Remember the basic rule: no police officer, CBI, ED, RBI or court ever “arrests” anyone on a video call, and no agency asks you to move money to a “safe” or “verification” account. If someone does, hang up and call 1930.
- Talk to elderly parents this week. Most victims in the court’s case list are senior citizens and pensioners.
- Set lower transfer limits on net banking and UPI for accounts that do not need high limits.
- Keep a written record of every complaint number — the new rules will reward people who can show they reported quickly.
- Check your credit report after any fraud; scammers sometimes take loans in the victim’s name. See how to read and fix your CIBIL report.
What happens next
The Attorney General told the court RBI can notify the proposed KYC Amendment Directions, 2026 by 30 November and bring them into force by 31 December. The National Cybercrime Reporting Portal upgrade is also due by 31 December. The court will hear the case again on 30 November 2026, when it will see RBI’s draft. Key open questions: who decides whether a bank “failed due diligence”, whether wallets and payment apps are covered, and whether genuine customers get compensation when their payments are held by mistake. We will update this story after the next hearing — also see the money rules changing from 1 November.
Frequently asked questions
Will I get my money back if I lost it to a digital arrest scam earlier?
Not automatically. The Supreme Court’s direction is about RBI’s upcoming rules, expected from 31 December 2026. Earlier victims should still file with 1930 and cybercrime.gov.in and complain in writing to the bank, because funds frozen in mule accounts can be returned through the police and courts.
What is a digital arrest scam?
Fraudsters pose as police, CBI, ED, customs or judges on video calls, claim you are linked to a crime, keep you “under arrest” on camera for hours, and force you to transfer money to “verify” it. No real agency does this.
Does RBI’s zero liability rule cover UPI fraud?
It covers unauthorised electronic transactions, including UPI, if the bank was at fault or you report within 3 working days. It does not cover payments you approved yourself, even under pressure — that is the gap the court wants closed.
How fast should I report a fraud?
Immediately. Call 1930 within the first hour if you can, then inform your bank. Under RBI rules, reporting within 3 working days keeps your liability at zero for unauthorised transactions.
Where do I complain if my bank refuses?
If the bank rejects your complaint or does not reply within 30 days, file a complaint with the RBI Ombudsman at cms.rbi.org.in. It is free.
Related guides and calculators
- 1 November 2026 money rule changes
- How to improve your CIBIL score
- FD rates after the RBI repo hike
- EPFO’s startup investment plan explained
Sources: Business Standard · MediaNama · RBI 2017 circular. Last checked 31 October 2026. Figures are estimates for guidance, not tax or financial advice. How we research and fact-check.
This guide is for information only and isn’t financial advice. Rates, fees and rules change — always confirm on the official website before you decide. Read our disclaimer.
