Banks must pay for cyber fraud loss: SC

The Supreme Court of India on Thursday said banks must be made accountable to indemnify losses suffered by digital fraud victims, who should receive compensation of at least the amount lost if an investigation establishes that the offence resulted from a failure of due diligence by the financial institutions. Observing that despite the fact that cybercrimes fell by 50 per cent, yet victims lost Rs 800 crore so far this year, a bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana said the proposed Reserve Bank of India (RBI) regulatory framework must incorporate enforceable provisions for compensation, preventive intervention and institutional accountability.

The CJI said the bench would first examine the proposed RBI Know Your Customer (KYC) Amendment Directions, 2026, before permitting the regulatory process to proceed. The directions are proposed to be notified by November 30 and operationalised by December 31. The bench emphasised that the framework must go beyond general advisories and establish clear obligations on financial institutions, along with consequences for non-compliance.

“We emphasise that the regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost by the customer, where the fraud or crime is found to have resulted from a failure of due diligence by the financial institution,” it said in its order.

“These are all hypertechnical things. Unless there is a penal direction to these banks, they will never mend their ways,” the CJI said.

The Bench also reiterated that banks must temporarily suspend transactions that are inconsistent with an account holder’s established transaction history, automatically report suspicious activity and undertake physical verification wherever necessary to establish the genuineness of a transaction. “Fraud running into thousands of crores has taken place through digital arrest scams, and we are still unable to take very strong measures. Why can banks not be mandated to classify accounts into different groups? For individual account holders who have saved money over time, banks have the complete audit trail. They can use AI,” the CJI said.

The apex court’s observations came during the hearing of the suo motu proceedings titled In Re: Victims of Digital Arrest Related to Forged Documents, initiated to strengthen the institutional response to digital arrest scams and related cyber-enabled financial crimes. During the hearing, the CJI questioned why banks could not intervene when an account holder suddenly sought to transfer a substantial sum that bore little resemblance to the person’s usual banking activity.

Attorney General R Venkataramani, appearing for the Centre and other authorities, told the bench that substantial work had been undertaken to improve the detection of suspicious transactions and strengthen preventive mechanisms within the banking system. The CJI, however, questioned whether the proposed measures contained sufficiently strong accountability provisions and whether they would result in meaningful action against institutions that failed to comply.

“What are the accountability clauses in the guidelines? If a bank fails to comply, what is its accountability,” the CJI asked. He further questioned whether the proposed framework would require a bank to compensate a victim in cases of digital arrest fraud.

Senior advocate Kapil Sibal, appearing for WhatsApp, told the bench the platform had taken preventive measures, including action against 9,400 accounts, and would file an affidavit detailing the steps undertaken. He said the platform was working on software to identify suspicious accounts and warn users.