The Supreme Court on Thursday said banks must be held accountable for losses suffered by victims of digital arrest scams and cyber fraud, observing that financial institutions should compensate customers at least to the extent of the amount lost if an investigation establishes that the fraud resulted from their failure to exercise due diligence.

A Bench comprising Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V Mohana said the proposed Reserve Bank of India (RBI) regulatory framework must contain enforceable provisions for victim compensation, preventive intervention and institutional accountability.

The Court observed that despite a 50% decline in cybercrime cases, victims had already lost around ₹800 crore this year.

"We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution," the Bench said in its order.

The Chief Justice said the Court would first examine the proposed RBI Know Your Customer (KYC) Amendment Directions, 2026, before allowing the regulatory process to proceed. The directions are proposed to be notified by November 30 and operationalised by December 31.

Emphasising the need for strict accountability, the CJI said that general advisories would not be sufficient to ensure compliance by banks.

"These are all hypertechnical things. Unless there is a penal direction to these banks, they will never mend their ways," he remarked.

The Bench also suggested that banks should temporarily suspend transactions that deviate significantly from an account holder's established transaction history, automatically flag suspicious activity and undertake physical verification wherever necessary.

"Fraud running into thousands of crores has taken place through digital arrest scams, and we are still unable to take very strong measures. Why can banks not be mandated to classify accounts into different groups? For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI," the CJI observed.

The Court made these observations while hearing suo motu proceedings titled In Re: Victims of Digital Arrest Related to Forged Documents, initiated to strengthen the institutional response to digital arrest scams and other cyber-enabled financial crimes.

During the hearing, the CJI questioned why banks could not intervene when customers suddenly attempted to transfer substantial amounts that were inconsistent with their usual banking patterns.

Describing banks as a "protective umbrella" for vulnerable customers, he said financial institutions had access to account holders' transaction histories and should use that information to prevent fraud before money was transferred.

The CJI pointed out that transactions worth crores might be routine for commercial accounts, but a sudden high-value transfer from an account belonging to a retired person or an ordinary saver should trigger intervention.

"If that person suddenly seeks to transfer a large amount through RTGS, why can there not be intervention," he asked.

The Bench suggested that banks classify accounts according to their nature and transaction patterns and use artificial intelligence to identify unusual transactions that could indicate coercion or fraud.

It also proposed a mechanism for automatically alerting the nearest police station about suspicious high-value transactions involving customers who may be victims of digital arrest scams. Local police could then verify whether the account holder was knowingly initiating the transaction.

The CJI cautioned that investigations conducted after the money had been transferred would not adequately address the problem.

"A report would only be a post-mortem. We are concerned with prevention," he said.

Attorney General R Venkataramani, appearing for the Centre and other authorities, informed the Bench that substantial work had been undertaken to improve the detection of suspicious transactions and strengthen preventive mechanisms in the banking system.

However, the CJI questioned whether the proposed framework contained adequate accountability provisions and specified the consequences for banks that failed to comply.

"What are the accountability clauses in the guidelines? If a bank fails to comply, what is its accountability," he asked.

He also sought clarity on whether the proposed framework would require banks to compensate victims of digital arrest fraud.

The Attorney General submitted that the RBI was examining banking liability as well as the liability of individual bank officials, including personal liability and criminal prosecution where an employee was found to have colluded in a fraud.

"The regulation must include a liability clause. Otherwise, we will enforce it through a judicial order," the CJI said.

The Attorney General clarified that the government was not defending banking negligence or collusion and was examining various aspects of prevention and accountability.

The Bench said the proposed RBI directions must clearly specify the extent of institutional liability, safeguards available to customers and the mechanism for enforcing compliance.

It clarified that it did not intend to implead every individual bank in the proceedings. Instead, the RBI was directed to submit a list of all authorised financial institutions by the next hearing so that any directions issued by the Court could apply across the banking sector.

The CJI also identified two major concerns requiring attention: accountability of banks and the continued use of mule accounts to receive and transfer proceeds of cybercrime.

Mule accounts are used by fraudsters to route stolen money through multiple accounts, making it difficult for authorities to trace and recover the funds.

The Bench further directed the law enforcement agencies of all States and Union Territories to submit reports detailing FIRs registered in digital arrest scam cases and the investigations conducted in connection with them.

The agencies have also been asked to provide suggestions for preventing, detecting and prosecuting such offences. The Directors General of Police (DGPs) of all States and Union Territories have been directed to ensure compliance.

The reports must be submitted to the inter-departmental committee coordinating the government's response. Copies of the reports furnished to the Court must also be forwarded to the committee.

Meanwhile, Senior Advocate Kapil Sibal, appearing for WhatsApp, informed the Bench that the platform had taken preventive measures, including action against 9,400 accounts. He said WhatsApp would file an affidavit detailing the steps taken.

Sibal also submitted that the platform was developing software to identify suspicious accounts and alert users.