“We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution,” the Supreme Court said in its order.
New Delhi: The Supreme Court on Thursday said banks must be made accountable to indemnify losses suffered by digital fraud victims, who should receive compensation of at least the amount lost if an investigation establishes that the offence resulted from a failure of due diligence by the financial institutions.
Observing that despite the fact that cyber crimes fell by 50 per cent, yet victims lost Rs 800 crore so far this year, a bench comprising Chief Justice Surya Kant and justices Joymalya Bagchi and V Mohana said the proposed Reserve Bank of India (RBI) regulatory framework must incorporate enforceable provisions for compensation, preventive intervention and institutional accountability.
The CJI said the bench would first examine the proposed RBI Know Your Customer (KYC) Amendment Directions, 2026, before permitting the regulatory process to proceed.
The directions are proposed to be notified by November 30 and operationalised by December 31.
The bench emphasised that the framework must go beyond general advisories and establish clear obligations on financial institutions, along with consequences for non-compliance.
“We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution,” it said in its order.
“These are all hypertechnical things. Unless there is a penal direction to these banks, they will never mend their ways,” the CJI said.
It also reiterated that banks must temporarily suspend transactions that are inconsistent with an account holder’s established transaction history, automatically report suspicious activity and undertake physical verification wherever necessary to establish the genuineness of a transaction.
“Fraud running into thousands of crores has taken place through digital arrest scams, and we are still unable to take very strong measures. Why can banks not be mandated to classify accounts into different groups? For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI,” the CJI said.
The observations came during the hearing of the suo motu proceedings titled In Re: Victims of Digital Arrest Related to Forged Documents, initiated to strengthen the institutional response to digital arrest scams and related cyber-enabled financial crimes.
During the hearing, the CJI questioned why banks could not intervene when an account holder suddenly sought to transfer a substantial sum that bore little resemblance to the person’s usual banking activity.
Describing banks as a “protective umbrella” for vulnerable customers, the CJI said financial institutions possess information about their account holders, including their transaction histories, and should use that knowledge to prevent fraud before money leaves an account.
He drew a distinction between commercial accounts, where transactions worth crores of rupees may be routine, and individual accounts belonging to retired persons or ordinary savers who typically withdraw relatively small amounts.
“If that person suddenly seeks to transfer a large amount through RTGS, why can there not be intervention,” the CJI asked.
The bench suggested that financial institutions could classify accounts according to their nature and transaction patterns and deploy technology, including artificial intelligence, to identify deviations that may indicate coercion or fraud.
It also called for a mechanism under which the nearest police station would be automatically alerted about suspicious high-value transactions involving customers potentially targeted by digital arrest fraudsters.
Local police could then verify whether the account holder was knowingly initiating the transaction, it said.
The CJI cautioned that retrospective investigations and reports would not be sufficient if institutions failed to prevent the transfer of funds in the first place.