SC on Digital Arrest: Banks Must Pay If Checks Fail

Quick Answer: No, the Supreme Court has not ordered an automatic refund for every digital-arrest victim. On 29 October 2026 it said RBI's forthcoming rules must require financial institutions to compensate victims with not less than the amount lost where an investigation establishes that the fraud resulted from a failure of due diligence by the institution. Those RBI rules are proposed to be notified by 30 November and operationalised by 31 December 2026, and the court will examine them first. Intro: A "digital arrest" is not a real legal process. Fraudsters pose as police, CBI, Enforcement Directorate or court officials on video calls, claim you are under arrest or under investigation, show forged documents, and frighten you into transferring money. The Supreme Court has been hearing the problem on its own initiative since October 2025, after an elderly Haryana couple reportedly lost about Rs 1.05 crore to callers posing as CBI officers. The 29 October order matters because it shifts the question from "were you careless?" to "did the bank do its checks?" — but only in the specific circumstances the court described. Reading it as a blanket refund promise would mislead victims at exactly the moment they need clear steps.

What the court actually said

A bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana, hearing the suo motu case "In Re: Victims of Digital Arrest Related to Forged Documents", said the proposed RBI regulatory framework must go beyond general advisories and set enforceable obligations, with consequences for non-compliance. The court's words, as quoted from its order, were that the measures "must mandate financial institutions to indemnify digital arrest or cyber fraud victims with suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution." Two conditions are doing all the work in that sentence: compensation at least equal to the loss, and only where due-diligence failure is established. Neither condition is automatic, and neither is decided by a headline. The court also noted that cybercrime cases had fallen by about 50%, yet victims had still lost almost Rs 800 crore so far this year — a reminder that fewer cases does not mean smaller harm.

What happens on 30 November and 31 December

The court said it would first examine the proposed RBI (Know Your Customer) Amendment Directions, 2026, before permitting the regulatory process to proceed. Those directions are proposed to be notified by 30 November 2026 and operationalised by 31 December 2026. The court also asked RBI to file a list of all authorised financial institutions at the next hearing, so directions can apply across the banking sector without each bank being added to the case individually. Claims filed today therefore run under the existing rules below.

What already protects you today

The existing RBI framework on customer liability in unauthorised electronic banking transactions already draws lines based on whose fault the loss was and how quickly you reported it. Where the loss is due to the bank's fault, the customer's liability is zero. Where it is a third-party breach — neither the bank's nor the customer's fault — and you report within three working days of receiving the bank's communication, liability is also zero, with a shadow or provisional credit due within 10 working days in zero-liability cases. Reporting in 4 to 7 working days caps liability, at Rs 5,000 to Rs 25,000 depending on account type, and beyond 7 working days the bank's board-approved policy applies. Where the loss is due to your own negligence, such as sharing an OTP or password, you bear the loss until you report it — and the burden of proving negligence lies with the bank, not with a bare claim that an OTP was sent. That framework is exactly why the digital-arrest cases are hard: victims are coerced into authorising transfers themselves, so banks have often treated the payment as customer-authorised. The Supreme Court's point is that coercion plus a bank's missed due-diligence checks should not end the inquiry there.

If you are targeted: stop, do not transfer

No police officer, ED officer, customs officer or judge will interrogate you on a video call and demand an immediate transfer to avoid arrest. Real law enforcement serves notices through proper channels; it does not keep you on a video call while you move money. If a caller claims you are digitally arrested, end the call, do not share OTPs, screen-share, or transfer anything, and do not let the caller keep you on the line while you "verify" by moving funds. Tell a family member immediately — isolation is part of the scam's method, and breaking it is the fastest protection.

If money has already gone: the five steps

First, call the national cybercrime helpline 1930 immediately and file a complaint on the National Cybercrime Reporting Portal at cybercrime.gov.in. Speed matters because banks and police can sometimes freeze onward movement only in the first hours. Second, inform your bank in writing through its official channel, keep the complaint number, and ask for the transaction trail and the bank's investigation reference. Third, file a police complaint and keep the FIR or acknowledgement number. Fourth, preserve everything: call logs, screenshots, the numbers and account details you were given, and your bank statements — do not delete chats to "clean up". Fifth, if the bank rejects your claim or does not resolve it, escalate through the bank's grievance process and then to the RBI Integrated Ombudsman at cms.rbi.org.in or toll-free 14448, where compensation of up to Rs 30 lakh plus up to Rs 3 lakh for mental agony and expenses can be awarded where deficiency is established.

Educational content only — not financial advice. Consult a SEBI-registered investment adviser for personal guidance; investments are subject to market risk. This article explains court directions and complaint routes; it is not legal advice for any individual case — consult a lawyer for case-specific guidance. Sources: The Tribune (30 October 2026); Verdictum report of the Supreme Court order of 29 October 2026; MediaNama (30 October 2026); RBI circular on customer protection — limiting liability of customers in unauthorised electronic banking transactions (2017 framework, as summarised in the article); RBI Integrated Ombudsman Scheme 2026 details as previously verified.