Banks must compensate digital fraud victims for losses if due diligence fails: SC

The Supreme Court said banks should be accountable when their failure to detect or prevent digital fraud causes a customer to lose money. If the fraud resulted from inadequate due diligence, the proposed framework should require compensation of at least the amount lost. This matters because the court called protecting victims a responsibility of financial institutions.

The court suggested practical safeguards. Banks should suspend transactions that sharply depart from a customer’s normal pattern. They should automatically report suspicious activity and use physical verification to confirm whether a payment is genuine. For example, a customer who usually withdraws Rs 10,000 or Rs 20,000 suddenly taking Rs 50,000 could trigger an alert.

The bench said banks may have to compensate victims and face prosecution. It also asked about measures for alerting nearby police stations when customers may be digital-arrest victims. The RBI’s proposed KYC Amendment Directions, 2026, will be examined for victim-compensation provisions.

A digital arrest scam is a fraud in which someone tells a person by mobile phone that the person has been arrested. The article highlights the psychological tactic rather than a real arrest process. Criminals use the threat and confusion surrounding the supposed arrest to create intense fear, making victims more likely to obey instructions and make financial transactions.

The Chief Justice asked, “Someone tells you on the mobile that you're arrested you agree you're arrested?” That question captures the scam’s central mechanism. A caller invokes authority and fear, while the victim reacts to the threat instead of independently checking the claim. The resulting transactions may be unusual and should alert banks.

The problem remains serious despite reported improvement. The Centre told the court that cases had fallen by around 50% from the previous year. Yet the country still lost nearly Rs 800 crore to such offences this year, prompting calls for stronger bank monitoring, reporting, and victim protection.

A bank’s due diligence duty involves actively checking transactions instead of treating every payment as routine. The Supreme Court said banks should compare activity with an account holder’s usual transaction pattern. This matters because a sudden, unexplained change can indicate digital fraud, a mule account, or another suspicious use of the banking system.

The court gave a simple example. If a person normally withdraws Rs 10,000 or Rs 20,000 but suddenly withdraws Rs 50,000, the bank should consider flagging it. Proposed safeguards also include suspending unusual transactions, automatically reporting suspicious activity, and physically verifying whether a transaction is genuine. Banks may also alert nearby police stations in suspected digital-arrest cases.

The court is examining whether the RBI’s proposed KYC Amendment Directions, 2026, adequately address these duties. If a bank’s failure to perform them contributes to fraud, the proposed framework could require compensation and prosecution. Due diligence therefore links prevention, rapid intervention, and accountability.

The article describes a problem that remains financially severe. The Attorney General told the Supreme Court that reported digital-arrest cases had declined by around 50% compared with the previous year. He attributed the reduction to the court’s intervention, coordinated government action, and public-awareness campaigns.

That percentage is a relative change, not the total number of cases or the amount recovered. It means reported cases were about half the previous year’s level. However, the Chief Justice said the country still suffered losses of nearly Rs 800 crore from such offences this year. Fewer reported cases therefore did not mean that the remaining fraud caused little harm.

The court identified bank accountability and mule accounts as key areas needing further action. It wants stronger monitoring of unusual transactions and clearer compensation rules. The RBI must provide a list of authorised financial institutions, while the court considers guidelines that could apply across institutions.

If a fraud resulted from a bank’s failure to flag an unusual transaction or verify a suspicious payment, the Supreme Court proposed serious consequences. The bank could be required to compensate the victim, at least for the amount lost. The court said financial institutions have a duty to protect customers from such harm.

The proposed mechanism relies on preventive checks. Banks would monitor whether activity matches a customer’s normal pattern, suspend transactions that sharply depart from it, automatically report suspicious activity, and physically verify questionable transactions. A sudden Rs 50,000 withdrawal by someone who usually withdraws Rs 10,000 or Rs 20,000 illustrates the kind of change the court discussed.

The Chief Justice said, “bank will compensate victim and suffer prosecution.” These are proposed directions, not a completed finding that every bank must already pay. The bench will examine the RBI’s proposed KYC Amendment Directions, 2026, including how compensation should work when due diligence fails.

Mule accounts are bank accounts used to receive and transfer money connected with cybercrime. They create a channel through which stolen funds can move after a victim is defrauded. This makes them a major problem because the account receiving money may not be the account used to contact or deceive the victim.

The article does not describe a specific mule-account transaction. It does state that such accounts are frequently used to receive and transfer proceeds of cybercrime. Monitoring unusual activity can help identify that movement. Suspicious-activity reporting and physical verification may give banks and authorities more opportunities to interrupt or examine transactions.

The Chief Justice identified mule accounts alongside bank accountability as one of two key areas requiring further intervention. The court is seeking a framework covering authorised financial institutions and compensation measures. Stronger due diligence could therefore target both the initial suspicious payment and the later movement of stolen money.

KYC rules help financial institutions establish who their customers are and assess whether transactions appear consistent with that information. Transaction-pattern monitoring adds an ongoing check. It can reveal when activity sharply departs from a person’s usual behaviour, which may indicate fraud, a digital-arrest scam, or use of an account for cybercrime proceeds.

The Supreme Court proposed several connected safeguards. Banks could suspend unusual transactions, automatically report suspicious activity, and physically verify whether a payment is genuine. A customer who usually withdraws Rs 10,000 or Rs 20,000 but suddenly withdraws Rs 50,000 provides the court’s example of a pattern worth flagging. These checks can also help identify mule accounts.

Together, the measures can slow suspicious transfers and create information for authorities investigating cybercrime and money laundering. The court will examine the RBI’s proposed KYC Amendment Directions, 2026. It also wants the framework to address compensation when institutions fail in their due diligence duties.