Supreme Court: RBI's new rules must make banks compensate digital arrest victims when they fail

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Hearing the digital arrest case on 29 October, the Supreme Court said RBI's coming rules must require banks to make good victims' losses where the bank or its staff failed in due diligence. RBI's measures are expected by December. What changes, and what does not yet.

01 / What happened

On 29 October 2026, a bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana heard the Supreme Court's own case on digital arrest scams (In Re: Victims of Digital Arrest Related to Forged Documents), LiveLaw, Business Standard, The Week and MediaNama reported.

• In the order: the court recorded that the regulatory measures RBI is framing must require banks and other financial institutions to indemnify digital arrest and cyber fraud victims where the institution or its officials were negligent in due diligence, with compensation not less than the amount lost, LiveLaw reported.
• Said in court, not ordered: the Chief Justice said a victim's debit should be zero and banks should bear the loss and face prosecution where due diligence failed; Justice Bagchi said the court was proposing strict liability. The Chief Justice also asked why banks do not hold an unusual transaction and alert the local police until the customer confirms it.
• The government's side: Attorney General R Venkataramani told the court that RBI, MeitY and the Department of Telecommunications are working on measures, that RBI's are likely to be in place by December, and that banks are now flagging suspicious transactions.

02 / Why it matters

Today, RBI's limited-liability rules protect you mainly when money leaves your account without your involvement. In a digital arrest, the victim is frightened into sending the money themselves, so banks usually treat it as an 'authorised' payment and refuse to refund it. If RBI's new rules follow the court, a bank that ignored clear warning signs, such as a pensioner suddenly moving lakhs to a new account, could have to pay the victim back.

Separately, RBI's refund rules that start on 1 January 2027 already include one-time compensation of up to ₹25,000 for some people who were tricked, for example into sharing an OTP, on losses up to ₹50,000; our RBI refund rules explainer sets out who qualifies.

MediaNama also reported directions to hold transactions that sharply deviate from an account's history, and dates for RBI's KYC amendment directions (notified by 30 November, in force by 31 December). We found those details in one report only, and the order has not yet been published on the Supreme Court's website. RBI's draft KYC Amendment Directions of September 2026 had proposed temporary debit holds on accounts linked to mule activity.

03 / Confirmed vs. claimed

Reported (four outlets, from the hearing and the order): the bench, the order's line on indemnity where banks failed in due diligence, the Attorney General's December timeline. Reported (one outlet, MediaNama): the 30 November and 31 December dates and other directions. Oral remarks, not orders: zero debit for victims and prosecution of banks. Confirmed (RBI): the September 2026 draft KYC amendments, open for comments until 2 October. We will update this report when the order is published.

04 / What to do now

• No official ever arrests or questions you on a video call. If someone says you are under 'digital arrest', hang up and call 1930. Our digital arrest guide explains the call.
• If you already lost money, report it on 1930 and cybercrime.gov.in at once, and write to your bank asking it to treat the transfers as fraud and say what checks it ran. Keep that letter: if RBI's rules make banks liable for missed checks, it is your record.
• For how refunds work today and from 1 January 2027, read our RBI refund rules explainer, and on frozen money, how money on hold is released.
• Background: the Supreme Court and CBI cases so far.