Insight · Banking law
A Frightened Victim: Digital Arrest and the Bank's Duty to Look
Digital arrest impersonators never break into a bank's systems. They make the account-holder pass through the bank's own digital gateway, with fear as the key. From January, banks must answer for what they should have seen.
Key points
- From 1 January 2027, the RBI's rules treat a transfer the customer made under coercion, as in a 'digital arrest', as a fraudulent transaction.
- Where the fraud results from the bank's negligence, the customer bears no loss, and it is for the bank to prove the customer's liability.
- The Supreme Court has reportedly said the RBI's measures must make banks compensate victims, in full, where they fail in due diligence.
- Nobody has yet defined that due diligence. This article proposes a three-part test: spot the signals, act at once, keep the record.
Picture this. A retired schoolteacher in Jayanagar answers a video call one afternoon and finds a man in a police uniform on the screen, a warrant in his hand and a story about parcels of drugs sent in her name. By evening she has been told that she is under 'digital arrest', that she must not leave the room or speak to anyone, and that her savings must be moved to a 'verification account' until her name is cleared. Over the next three days she moves them, every rupee. The password is hers, the OTP is hers, and every transfer carries her own "approval".
Nobody broke into anything. The fraudster never touched the vault. He stood behind its owner and made her turn the key herself.
What does the schoolteacher do now? Does she have any remedy for the loss? Until now, the answer has been a complaint to the cyber crime police and an FIR, followed by a long wait in the hope that the fraudsters are identified, caught, and the money recovered. On 29th of October 2026 the Supreme Court made it plain that this will no longer do. The new approach asks more of the keeper of the vault, the bank: a higher level of protection for the people whose money it holds, by exercising due diligence.
In plain words
- Digital arrest
- A fraud in which callers pose as police or other officials, usually on a video call, tell the victim they are under investigation, and pressure them into transferring money.
- Suo motu
- A case the court takes up on its own, without anyone filing it.
- Amicus curiae
- A lawyer appointed to assist the court.
- Due diligence
- Here, the care a bank must take to notice and stop a fraudulent transfer.
She turned the key to the vault
The Reserve Bank of India regulates our banks. Until now, its protection for bank customers rested on a simple distinction: was the transaction authorised by the customer or not? So customers who were duped or coerced into authorising transactions had no protection. They were left to their own devices, on the plea that they had turned the key to the vault themselves, just as our schoolteacher did, every time.
The Supreme Court took suo motu cognizance of these frauds in In Re: Victims of Digital Arrest Related to Forged Documents. Before a bench headed by the Chief Justice, with Justices J. Bagchi and V. Mohana, the amicus curiae reported that victims had lost about Rs. 800 crore this year. The Attorney General of India argued that such measures are for the RBI to frame, and that the banks needed time to comply with the RBI's new framework.
After considering the submissions, the Hon'ble Court reportedly opined that when the RBI frames its measures, they "must mandate financial institutions to indemnify" victims, with compensation "not less than equivalent to the amount lost by the customer", wherever the fraud happened "as a result of the failure of due diligence" (emphasis supplied).
When the vault is opened under duress
Recognising that the older protections did not reach victims of frauds like 'digital arrest', the RBI on 24 June 2026 issued new directions for commercial banks, which apply to transactions from 1 January 2027. They treat as fraudulent a transfer made by the customer "under coercion or duress from the third-party". A key turned at a fraudster's command is no longer simply the owner's act, and a digital arrest is coercion in its purest form. Where such a transfer happens because of the bank's negligence, the bank must make good the money and the customer bears no loss, whether the fraud was reported or not. And it is for the bank to prove that the customer is liable, not for the customer to prove that the bank is.
| Until 31 December 2026 | From 1 January 2027 | |
|---|---|---|
| A transfer the customer approved under coercion | Treated as the customer's own act | A fraudulent transaction |
| Fraud caused by the bank's negligence | No loss to the customer, for transfers the customer did not authorise | No loss to the customer, now including coerced transfers |
| Who must prove the customer's liability | The bank, for transfers the customer did not authorise | The bank, for all fraudulent transactions |
So, come January, the question will no longer be whether a coerced transfer is protected. It will be what the bank ought to have noticed, and failed to notice, before it can be held liable to compensate the victim.
At the vault's door
The bank keeps the vault, and it sees every opening. In our schoolteacher's case, it is no longer enough for the bank to say that it checked her password and OTP were correct. The bank sees far more. It sees a seventy-year-old customer who has never sent more than a few thousand rupees suddenly sending lakhs. It sees a payee added that morning, and a receiving account opened a few weeks ago that passes every rupee onward within minutes. That receiving account, it should be remembered, was opened at a bank too.
The RBI requires each bank to keep a "robust and dynamic fraud detection and prevention mechanism". It does not say what the mechanism must catch, or what the bank must do when it catches something.
For the victim, then, the whole question (will the bank compensate me?) rests on one thing: a clear and precise definition of "due diligence". Until there is one, it remains a phrase waiting to become a test, and every loss will be fought out case by case.
In my view, a workable test would need three things.
ADiligence in spotting objective signals while the transaction is under way, such as the age of the receiving account, the speed of onward transfers, a first transfer of an unusual size, and a sharp break from the customer's own history.
BAn immediate duty to act when a signal appears: to hold the transfer, to call the customer, and to record what was done.
CA duty to keep a complete record of the transaction and the steps taken, during and after it. If a bank cannot show whether there were warning signals, when they appeared and what followed, it should not be allowed to claim that it was diligent.
One provision in the new directions is a cause for concern. A customer is treated as negligent for "not paying attention to specific, directed and clear warnings" that a transaction is likely a scam. In principle that is fair. But a victim who believes he or she is under arrest is not reading pop-up messages. If a single standard warning is enough to shift the loss back to the victim, a bank will be able to pin a notice on the proverbial vault door, go home, and call that diligence. The warning has to be specific to the transaction in front of the victim, and the bank should have to show that it was seen.
The keepers' case
The Attorney General's objection is a serious one. Courts decide disputes and regulators write rules, and a direction from the Court that fixes the measure of compensation invites a challenge to the limits of the Court's role.
The banks have a second argument, and it is about cost. A rule that repays every loss, whatever the bank did, would push banks to block genuine payments, and the customer whose hospital bill or daughter's fees are held up for verification is harmed too. The United Kingdom faced the same choice and settled on a limit: since 7 October 2024 its payment providers must reimburse victims of authorised push payment fraud up to £85,000 a claim. Whether India should set a limit is a fair question of policy. It ought to be answered openly, by the regulator, before the lawsuits begin.
Checking the locks before January
The new directions take effect on 1 January 2027, less than two months away. A bank that waits for the Court's next hearing to decide what it should watch for at the vault door will have left it late. It can test now whether its systems notice the patterns that matter, whether its staff hold and verify what is flagged, and whether its register would prove it before an ombudsman.
The schoolteacher turned her own key. The law is at last ready to ask whether anyone at the vault door noticed that her hand was shaking. The answer should decide who pays.
Sources
- Reserve Bank of India, Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026, RBI/2026-27/167, 24 June 2026: paras 3(2), 4(15A), 4(20C)(iii), 76B(2), 76K, 76L.
- Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017.
- Verdictum, 29 October 2026, report of the hearing and order in SMW (Crl.) No. 3 of 2025.
- LawChakra, 30 October 2026.
- The Week, 29 October 2026.
- UK Payment Systems Regulator, PS24/7: maximum reimbursement £85,000 per claim from 7 October 2024.
