Supreme Court Says Banks Must Compensate Digital Fraud Victims When Due Diligence Fails

The court wants the RBI’s proposed framework to include enforceable compensation requirements and safeguards that identify suspicious transfers before customers lose their savings.

The Supreme Court on Thursday, October 29, said banks and other financial institutions must compensate digital fraud victims when a failure of due diligence is found to have caused their losses.

Compensation in such cases should be at least equal to the amount the customer lost, the court said, while examining measures to address digital arrest scams and other cyber-enabled financial crimes.

A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana said it would examine the Reserve Bank of India’s proposed Know Your Customer Amendment Directions, 2026. The directions are expected to be notified by November 30 and become operational by December 31.

Compensation depends on a bank’s failure

The central condition is whether the financial institution failed to carry out the checks expected of it and whether that failure contributed to the fraud.

The court’s position should therefore not be read as an unconditional refund announcement for every person who loses money to an online scam.

Instead, the proposed framework must establish clear responsibilities for financial institutions and provide compensation where a failure of due diligence is established. The bench also called for consequences when institutions do not meet their obligations.

For customers, the distinction matters: reporting a fraud and establishing a bank’s responsibility are separate steps. The eventual rules and further court directions will need to clarify how such claims are assessed.

Banks urged to act before suspicious transfers go through

The court also focused on preventing losses.

It reiterated the need to temporarily suspend unusual transactions that depart from a customer’s established banking pattern, report suspicious activity automatically and undertake physical verification where necessary.

During the hearing, the Chief Justice questioned why banks could not use account histories and technology, including artificial intelligence, to recognise potentially fraudulent transfers. A large payment from a personal savings account may warrant different scrutiny from a similar payment made through a business account with a history of substantial transactions.

The bench also discussed alerting nearby police stations when suspicious transactions suggest that a customer may be facing a digital arrest scam. Such intervention could help verify whether the person is transferring money under pressure.

RBI framework remains under examination

The proposed notification and implementation dates are milestones for the regulatory process. They should not be presented as the opening dates for a compensation scheme.

The Supreme Court has asked the RBI for a list of authorised financial institutions, allowing it to consider directions across the sector without requiring every institution to be separately added to the proceedings.

The court also sought reports from law enforcement agencies in states and Union territories on digital arrest cases, investigations and suggestions for improving prevention and prosecution.

A further concern raised during the proceedings was the use of mule accounts to receive and move stolen money. Transfers through multiple accounts can complicate attempts to trace funds and recover victims’ savings.

Existing customer protections also matter

The proposed framework should be distinguished from the RBI’s existing rules on unauthorised electronic banking transactions.

Under its July 2017 customer-protection circular, customers have zero liability for unauthorised transactions arising from contributory fraud, negligence or deficiency by the bank. The circular also provides protection in specified third-party breach cases when customers report within three working days of receiving the bank’s transaction communication.

Those provisions concern unauthorised transactions. Readers should not assume that the same outcome automatically applies to every transfer they personally approved after being deceived or threatened.

What affected customers can do now

Anyone who discovers a suspected fraudulent transfer should immediately notify their bank through its official reporting channels and retain the complaint reference.

Financial cyber fraud can also be reported by calling 1930 or visiting the government’s National Cyber Crime Reporting Portal at cybercrime.gov.in. The Home Ministry identifies these as channels for reporting financial cybercrime.

Keep transaction references, bank alerts, screenshots, messages and complaint acknowledgements together. These records can help explain what happened and support the investigation.

The next development to watch is the wording of the RBI’s proposed directions, particularly how they define institutional failures, compensation procedures and preventive obligations.