MediumII Cyber Warfare & Critical Infrastructure7 November 2026, Saturday
India's Supreme Court shifts digital arrest losses onto negligent banks
A 29 October ruling by India's Supreme Court, published on 7 November, requires RBI rules under which banks found lacking in due diligence compensate digital arrest victims for no less than the amount lost. For the first time, the court also asked WhatsApp directly for a prevention plan.
A digital arrest is a cyber fraud in which the scammer poses as a police officer or prosecutor and keeps the victim on a video call until they transfer money. A bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana delivered the ruling on 29 October, and the court published the text on 7 November. It says the regulation drafted by the RBI should oblige financial institutions found at fault to compensate victims for no less than the amount lost. Justice Bagchi used the phrase strict liability at the hearing, but the written ruling makes a finding of fault a condition.
According to a MediaNama summary on 11 November, the RBI plans to notify the KYC Amendment Directions 2026 by 30 November and bring them into force on 31 December. The September draft had pointed to 1 April 2027. The directions allow temporary holds of up to 60 days on suspected money mule accounts and on flagged transactions of 1,000 rupees or more. The court asked WhatsApp LLC and other intermediaries to submit proposals to the Indian Cyber Crime Coordination Centre. A government report in April said WhatsApp closed about 9,400 accounts over 12 weeks from January.
The insurance angle sits on the banks' balance sheets. With compensation tied to the amount lost, banks now carry customer fraud risk as an uncapped liability per transaction. Whether this burden will be covered by banks' crime or cyber policies could not be verified in the sources for this entry. The Chief Justice described the losses as thousands of crore rupees, but the official total used by the court could not be verified. The next hearing is on 23 November.
Talay assessment
Bottom line
The ruling writes digital arrest losses onto the balance sheet of any bank found at fault, up to the full amount lost, and forces the RBI to issue rules by 30 November. The real constraint is how fault will be defined. If the definition is broad, banks will prefer to freeze suspicious transactions for up to 60 days. The most likely path is that the directions arrive on schedule and banks rapidly increase the number of holds.
Likely effects
- Indian banksNegative1–6 months
Because compensation cannot fall below the amount lost wherever fault is found, fraud losses grow as an operating expense.
- Payment experienceNegativeWeeks
Permission to hold flagged transactions of 1,000 rupees or more for up to 60 days could increase the number of accounts frozen on false alarms.
- Platform liabilityPositive1–6 months
Asking WhatsApp directly for a prevention plan starts defining, through the courts, the platforms' share of the fraud chain.
Possibilities, ranked
- 1Directions arrive on schedule60%
The RBI notifies by 30 November and banks apply the hold and compensation rules from 31 December.
Watch: RBI notification of the KYC Amendment Directions by 30 November
- 2Banks win more time25%
The compliance period is extended, as the Solicitor General requested, and entry into force slips to 2027.
Watch: RBI and Solicitor General requests at the 23 November hearing
- 3Extended to strict liability15%
The court widens the written ruling to cover all cases without a fault condition.
Watch: Any new order issued after the 23 November hearing
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Compensation floor▼ 100% of loss
- Transaction hold period▲ ≤60 days
- WhatsApp accounts closed▲ ~9,400