The Supreme Court to Banks: The Victim's Loss Is Your Bill.

At a glance. In the digital arrest case, the Supreme Court has fixed the direction: where a cyber fraud succeeds because a bank’s due diligence failed, the bank compensates the victim, not less than the amount lost. The rules are expected by 31 December. The next hearing is 30 November.

On 29 October, the Supreme Court told the Reserve Bank of India, in open court, where its new cyber fraud rules must land: a bank that failed in its due diligence pays the victim, and pays not less than what the victim lost.

The Chief Justice put the alternative on record. The regulation must include a liability clause, or the Court will enforce one through a judicial order. Either way, it is coming.

It began with a forged Supreme Court order

A complaint dated 21 September 2025 reached the Court from a senior citizen couple. Callers posing as CBI and Enforcement Directorate officers kept them on phone and video calls, and showed them a freeze order, an arrest order and a surveillance order over WhatsApp. Every document was forged. One carried the Supreme Court’s own name. Between 3 and 16 September 2025, the couple transferred Rs 1.05 crore.

The Court registered the matter suo motu and said such grave acts cannot be treated as routine offences of cheating or cybercrime. That file has since grown into a consumer protection matter of national scale, with the Union, the States and the RBI all filing before it.

The gap the old protection never covered

Since 2017, RBI’s circular has given customers zero liability for unauthorised electronic transactions where the fault lies with the bank, and for third party breaches reported within three working days. The burden of proving the customer’s liability sits on the bank. The Supreme Court applied that net in January 2025, holding SBI liable for fraudulent transactions a customer had reported within 24 hours.

A digital arrest slips through that net. The victim authorises every transfer personally, under coercion built to look like the law itself. On paper, each transaction is clean. The 2017 circular was never written for a crime that borrows the court’s own face.

The United Kingdom closed the same gap in October 2024: banks there reimburse victims of authorised push payment fraud up to 85,000 pounds, the cost split between the sending and the receiving bank. India’s version, as the Court has framed it, names no cap at all: not less than the amount lost.

What the Court already has on record

The numbers sit in the August order. Complaints on the national cybercrime portal fell from 1,23,672 in 2024 to 58,239 in 2025, and 16,377 by 30 June this year. The restoration machinery has returned Rs 18.05 crore across 36,290 cases. One CBI probe alone traced about Rs 80 crore moved through 67 first layer accounts, with 238 victims across the country.

Set those figures against each other and the Court’s impatience explains itself. Recovery runs case by case. The theft runs network by network.

Justice Joymalya Bagchi asked the question that now frames the debate: why should a financial institution escape strict liability when weaknesses in its own systems let the fraud run? The mule account opens at a bank. The money exits through a bank. The bank sees the pattern no one else can see.

What the framework is expected to say

From the 29 October hearing: compensation not less than the amount lost where due diligence failed. Suspicious transactions stalled until verified. Accounts classified by risk. Unusual movements flagged early. The Attorney General, appearing for RBI, pointed to notifications by 30 November and rules operational by 31 December, and the Court wants the draft regulations produced before the next hearing on 30 November.

Interim in form. Decisive in direction.

What a chamber takes from this

The first hours decide the money. Helpline 1930, the national portal, the bank in writing, the same day. The earlier the trail is fixed, the stronger both the recovery and the claim.

Build the file on the bank’s conduct. What alerts fired, what holds were placed, when the bank knew what. The burden of proving the customer’s liability already lies on the bank under the 2017 circular, and claims under the December framework will be fought on exactly that record.

And watch the two dates. A new line of practice is arriving: victims’ claims on one side, banks needing their diligence records defensible on the other.

The signature below makes my interest plain, so I will say it: LawVyn keeps a matter’s dates, documents and correspondence against the file by default, and claims like these are won on that record.

And for everyone else

Indian law has no procedure called digital arrest. No investigator arrests anyone over a video call, and no genuine court order arrives on WhatsApp. If money has gone, the first hour matters most: call 1930, report on cybercrime.gov.in, and write to your bank the same day.

Once the rules land, the question in every such case changes, from what the victim should have suspected to what the bank should have seen. The Supreme Court has moved the burden toward the only party that could see everything. That is where it belongs.

Commentary on ongoing proceedings in SMW (Crl) 3/2025, based on the Court’s orders and hearing reports of 29 October 2026. The framework described is proposed, not yet notified. Not legal advice.

Ravi Daparthi
CEO of LawVyn
A Practice management software for Indian advocates and law firms.
https://www.ravidaparthi.com/ ·
https://www.linkedin.com/in/ravidaparthi ·

Follow LawVyn on LinkedIn