Supreme Court asks RBI and Whatsapp to strenghten measures against digital arrest fraud

RMAI Risk Insights | 11 November 2026

The Supreme Court of India has intensified its examination of digital arrest fraud, asking RBI to strengthen financial-institution accountability and directing WhatsApp and other intermediaries to explain how they intend to prevent these scams.

In its order dated 29 October 2026, reported widely on 10 November, the Court emphasised that financial institutions should compensate victims when a failure to exercise appropriate due diligence in preventing or reporting cyber fraud is established.

The Court also discussed temporarily suspending unusual transactions, notifying police and verifying suspicious transfers.

These developments raise an important question for banks:

If a customer transfers money under criminal intimidation, what responsibility does the bank have to detect the warning signs before the funds disappear?

1. What Triggered the Supreme Court’s Intervention?

The proceedings originated from a complaint involving a senior citizen couple who allegedly lost ₹1,05,50,000 to digital arrest scammers between 3 and 16 September 2025.

According to the Supreme Court’s order of 17 October 2025, the fraudsters impersonated CBI, Enforcement Directorate and judicial officials through telephone and video calls. They allegedly displayed forged court documents, threatened the couple with arrest and property seizure, and coerced them into making multiple bank transfers.

The Court took suo motu cognisance of the matter, recognising the wider threat posed by organised cybercriminal networks impersonating law enforcement agencies.

Case Snapshot

Particulars	Details
Case	In Re: Victims of Digital Arrest Related to Forged Documents
Proceedings	Suo Motu Writ Petition (Criminal) No. 3/2025
Original reported victim loss	₹1.055 crore
Initial Supreme Court order	17 October 2025
Latest material order	29 October 2026
Latest public reporting	10 November 2026
Institutions involved in current directions	RBI, WhatsApp, other intermediaries and law enforcement
Next hearing reported	23 November 2026
Status	Continuing judicial proceedings

The proceedings concern a broader systemic response, not a judicial finding that a particular bank or platform has already been proved negligent.

2. What Has the Supreme Court Directed?

The Court’s latest order addresses four interconnected areas.

Financial Institution Accountability

The Court reiterated that RBI’s proposed regulatory measures should contain provisions requiring financial institutions to indemnify victims where fraud is established to have resulted from the institution’s failure to exercise due diligence in prevention or reporting.

In such circumstances, the Court indicated that compensation should not be less than the customer’s established loss.

This is conditional liability, not automatic reimbursement for every cyber-fraud complaint.

Preventive Transaction Controls

The Court identified potential safeguards including:

Temporarily suspending unusual transactions inconsistent with an account’s historical behaviour.
Reporting suspicious activity to the appropriate police authority.
Undertaking verification to establish transaction genuineness.

The detailed procedures, legal safeguards and operational requirements must be determined through the applicable regulatory framework.

WhatsApp and Digital Intermediaries

WhatsApp and other concerned intermediaries were directed to submit proposed measures for preventing digital arrest scams and related cybercrimes.

The proposals must also be shared with the Indian Cyber Crime Coordination Centre (I4C).

According to court reporting, WhatsApp’s counsel described action against approximately 9,400 accounts and further efforts to identify suspicious activity.

These were representations concerning preventive measures, not findings that WhatsApp caused the frauds.

Law Enforcement Coordination

State and Union Territory law enforcement agencies were directed to provide information concerning registered FIRs, investigations and proposed preventive measures.

RBI was also directed to supply a list of authorised financial institutions for consideration at the next hearing.

3. How Does a Digital Arrest Scam Work?

A digital arrest scam is a form of impersonation-based financial extortion.

Criminals pose as police officers, investigating officials or judicial authorities, often using video calls, forged documents and threats of immediate arrest.

A typical incident follows a recognisable sequence:

Impersonation: The victim receives a call alleging involvement in money laundering, illegal parcels or another serious offence.

Intimidation: Fraudsters use fake identification, fabricated court orders or staged official settings to create fear.

Isolation: The victim may be instructed to remain continuously connected through a video call and avoid discussing the matter with family members.

Payment demand: The criminals demand transfers to purported verification, investigation or settlement accounts.

Movement of proceeds: Funds may be transferred through multiple beneficiary accounts, including suspected money-mule networks.

There is no lawful procedure known as digital arrest in India. Genuine law enforcement agencies do not require citizens to transfer money to avoid arrest.

For banks, the crucial difficulty is that a victim may personally authenticate a transaction while acting under coercion.

A valid OTP or payment instruction does not necessarily establish that the customer is acting freely.

4. Why Is Bank Accountability Becoming Central?

Banks possess information about account activity that fraudsters and victims may not fully appreciate.

This includes historical transaction amounts, usual beneficiaries, account activity, transaction frequency and changes in customer behaviour.

Consider a customer who ordinarily transfers ₹20,000–₹50,000 monthly but suddenly initiates several high-value transfers to unfamiliar accounts.

Such behaviour does not establish fraud. It may reflect a legitimate property purchase, investment or family requirement.

However, the significant deviation could warrant risk-based verification.

The Supreme Court’s intervention highlights the importance of distinguishing transaction authentication from effective fraud prevention.

A bank may correctly authenticate the account holder while still needing to assess whether unusual activity merits further examination.

The question for risk managers is whether monitoring systems recognise material anomalies, escalate them appropriately and provide a defensible record of the institution’s response.

5. RBI’s Existing and Proposed Regulatory Framework

Several developments must be distinguished.

RBI’s 2026 Fraud Risk Management Directions

RBI’s Commercial Banks – Fraud Risk Management Directions, 2026, issued on 31 July, strengthen governance, early detection, fraud reporting and monitoring.

The directions include an Early Warning Signal framework addressing non-credit-related banking transactions.

Separate directions apply to other categories of regulated entities.

Proposed KYC Measures for Mule Accounts

On 11 September 2026, RBI issued draft KYC Amendment Directions concerning suspected money-mule accounts.

The draft proposed a Standard Operating Procedure for temporary debit holds, transaction monitoring, law-enforcement coordination and customer grievance handling.

The draft is not equivalent to a final binding requirement.

The Court’s October order recorded a proposal to notify revised measures by 30 November and operationalise them by 31 December 2026. The earlier published RBI draft specified a different commencement schedule. The final notification must therefore be checked before institutions rely on an implementation date.

Customer Liability in Fraudulent Digital Transactions

On 24 June 2026, RBI issued final amendments concerning customer liability in fraudulent electronic banking transactions.

These are scheduled to take effect on 1 January 2027.

The framework expands the treatment of fraudulent transactions and related customer-protection arrangements.

However, the Supreme Court’s proposed fault-based compensation provisions should not be confused with an already operational, universal reimbursement entitlement.

Banks must assess each case according to the applicable rules, evidence and liability framework.

RMAI Capacity Building in Banking Fraud Prevention and Financial Crime Risk Management

The Risk Management Association of India (RMAI) supports professional capacity building in banking fraud prevention, financial crime detection, customer due diligence and internal controls.

Relevant training programmes available through Smart Online Course include:

Fraud Risk Management in Banking: Fraud typologies, early warning signals, investigations and preventive controls.

KYC, AML & Customer Due Diligence in Financial Services: Risk-based KYC, customer profiling, suspicious transactions and beneficial ownership. Banks, NBFCs and other financial institutions are invited to nominate professionals for these specialised programmes.

Institutional Enquiries: info@rmaindia.org

6. What Early Warning Signals Should Banks Monitor?

Early warning signal	Potential concern
Sudden high-value transfer from an account with historically low transaction amounts	Behaviour inconsistent with customer profile
Multiple transfers to newly added beneficiaries	Possible coerced payments or account misuse
Rapid depletion of savings or fixed deposits	Potential financial distress or fraud
Large transfers involving vulnerable customers and unfamiliar counterparties	Need for enhanced verification
Funds rapidly moving out of newly credited beneficiary accounts	Possible money-mule activity
Beneficiaries linked to prior fraud complaints	Network-level financial crime risk
Repeated urgent transfers despite transaction alerts	Potential coercion or social engineering

These indicators should initiate proportionate investigation, not automatic conclusions of fraud.

False positives must be managed through documented escalation, customer verification and suitable safeguards for legitimate transactions.

7. What Should Internal Auditors Examine?

The Court’s concerns provide a practical basis for strengthening internal audit coverage.

Audit area	Recommended examination
Transaction Monitoring	Can systems identify material deviations from historical customer behaviour?
Beneficiary Controls	Are new beneficiaries and unusual transfers subject to appropriate risk-based checks?
Mule-Account Detection	Are suspicious inflows, rapid outward transfers and connected accounts monitored?
Fraud Alert Management	Are alerts investigated promptly with documented decisions?
Customer Verification	Are high-risk transactions subject to proportionate verification procedures?
Incident Escalation	Can the institution coordinate rapidly with cybercrime authorities and other banks?
Customer Complaints	Are fraud reports acknowledged, investigated and escalated within applicable timelines?
Recovery and Evidence	Are fund-tracing requests, account restrictions and investigation records preserved?

Auditors should examine actual cases, not merely the existence of policies or automated alert rules.

An alert that was generated but not investigated effectively may indicate a different weakness from a monitoring system that failed to detect the transaction.

8. What Should Banks Do Now?

RMAI recommends five priorities.

Strengthen behavioural transaction monitoring. Incorporate customer history, transaction velocity, beneficiary novelty and unusual account depletion into risk assessments.

Improve mule-account detection. Analyse suspicious beneficiary networks, rapid fund movement and inconsistencies between declared account activity and actual transactions.

Establish clear intervention protocols. Define when suspicious transfers require review, customer confirmation or legally authorised restrictions.

Integrate fraud and cybercrime response. Connect Fraud Risk, AML, Banking Operations, Compliance and Cybersecurity teams with clear escalation responsibilities.

Test response effectiveness. Use independent audits and realistic scenarios to assess detection, intervention, reporting and recovery processes.

These recommendations should be implemented proportionately and consistently with applicable law. Blanket restrictions without adequate review can unfairly affect legitimate customers.

9. What Should Boards and CROs Ask?

Senior management should examine whether institutions can demonstrate effective fraud prevention rather than rely solely on authentication controls.

Six questions deserve attention:

What proportion of high-risk transactions receive timely investigation?
Can monitoring detect unusually large transfers from established customer accounts?
How quickly can suspected fraud proceeds be identified and traced?
Are mule-account alerts linked to AML and fraud investigations?
Is there a documented process for determining customer and institutional liability?
Does Internal Audit independently test fraud detection and escalation effectiveness?

Institutions should monitor not only fraud losses but also time to detection, time to intervention, recovery outcomes and overdue high-risk alerts.

Conclusion: Banking Fraud Prevention Is Becoming an Accountability Issue

The Supreme Court’s intervention signals increasing scrutiny of the responsibilities of financial institutions, communication platforms and law enforcement in preventing digital arrest scams.

The central issue is not whether every fraudulent payment can be prevented.

It is whether banks and other institutions are exercising reasonable, demonstrable diligence when warning signals appear.

For banking risk professionals, the lesson is clear: an authenticated transaction is not necessarily a transaction free from fraud risk.

Effective fraud management requires risk-based monitoring, timely intervention, customer protection, coordinated investigations and independent assurance.

These capabilities will be central to strengthening public confidence in India’s digital financial system.

Official Sources and References

Editorial note: This RMAI analysis reflects judicial orders and regulatory material available as of 11 November 2026. Proposals under judicial and regulatory consideration should not be treated as already effective obligations. The recommendations for banks and auditors are professional risk-management analysis, not findings against any individual institution.