Supreme Court Seeks RBI Draft Cyber-Fraud Safeguards and Calls for Compensation Where Banks Fail Due Diligence

What the Supreme Court required

A three-judge Bench headed by Chief Justice Surya Kant, with Justices Joymalya Bagchi and V. Mohana, examined measures proposed by the Reserve Bank of India to prevent digital arrest scams and related financial fraud. In the ongoing suo motu matter, the Court sought the draft regulatory measures and a list of authorised financial institutions. The next hearing was listed for 30 November 2026.

The Bench emphasised that a bank or other financial institution whose failure of due diligence contributes to a cyber-fraud loss should be required to indemnify the victim by an amount not less than the money lost. This is a direction and regulatory concern in a pending proceeding; it should not be described as a final adjudication of liability against every bank in every fraud case.

How the proceedings began

The proceedings arose after a senior citizen couple complained of losing approximately ₹1.05 crore to criminals who allegedly impersonated authorities and used forged judicial documents. The term digital arrest is commonly used for scams in which criminals falsely claim that a person is under official investigation and pressure them to transfer funds or remain connected on a call.

The Court has been examining the respective responsibilities of banks, regulators, police authorities and digital intermediaries. The immediate question is how to prevent abnormal financial transactions and provide meaningful remedies when preventable failures contribute to a loss.

An allegation that a particular transaction should have been stopped does not by itself establish negligence. The proposed liability standard discussed in Court is tied to a finding that the fraud resulted from a failure of due diligence by the institution.

Suspicious transactions and regulatory accountability

The Bench discussed mandatory safeguards where a transaction is markedly inconsistent with an account holder’s established pattern. Examples included temporary suspension of unusually large transfers, automated reporting and physical verification to determine whether a transaction is genuine.

Chief Justice Surya Kant questioned whether banks should be allowed to treat fraud prevention as a matter of voluntary good practice when their systems have the ability to identify suspicious behaviour. Justice Bagchi raised the question of stricter institutional responsibility where inadequate controls allow fraudulent transactions to proceed.

The RBI, represented by Attorney General R. Venkataramani, referred to fraud prevention efforts already undertaken by bank employees and sought time for technical integration. A timetable involving proposed notification by 30 November and operationalisation by 31 December was placed before the Bench. Those dates describe the proposal reported in court, not proof that the regulations have already come into force.

Police and intermediary safeguards

The Bench also addressed the role of State police in investigating digital arrest complaints. Directors General of Police were directed to ensure that reports concerning FIRs, investigations and preventive suggestions reach the interdepartmental committee examining the issue.

Senior Advocate N. S. Nappinai, assisting as amicus curiae, highlighted the continuing effectiveness of intimidation and forged court documents despite awareness campaigns. Discussion extended to possible warning systems for prolonged suspicious calls and an optional mechanism to terminate such calls.

Senior Advocate Kapil Sibal cautioned that any technology intervention must avoid disrupting legitimate calls, including medical consultations. The discussion illustrates the difference between an idea raised during oral hearing and a final technical rule. Intermediaries were asked to submit safeguards, but not every suggestion was adopted in a binding form.

Practical consequences and next hearing

For financial institutions, the hearing signals close scrutiny of transaction-monitoring systems, customer verification and complaint response mechanisms. For customers, the Court’s emphasis is on preventing losses and providing compensation where institutional negligence is proved, rather than placing the entire burden on victims.

At the next hearing the Court is expected to examine the proposed RBI measures and information supplied by authorities. The eventual regulatory text and any further judicial order will determine the precise duties, exceptions and enforcement mechanism. Until then, broad claims of automatic compensation in every cyber-fraud case would be premature.