Supreme Court Seeks WhatsApp Fraud Safeguards and Bank Compensation for Digital Arrest Victims

WhatsApp and banks face demands to stop fraud before money moves

WhatsApp has told India's Supreme Court that it acted against 9,400 accounts and is developing software to identify suspicious accounts and warn users, as judges press technology platforms and banks to prevent digital arrest scams. At the October 29, 2026 hearing, the court also demanded stronger financial protection for victims, saying proposed banking rules must require compensation when an institution's failure to exercise due diligence allowed a fraud to happen.

The bench, headed by Chief Justice of India Surya Kant and including Justices Joymalya Bagchi and V Mohana, directed WhatsApp and other online intermediaries to submit their proposed safeguards both to the court and to the Indian Cybercrime Coordination Centre, known as I4C. The next hearing is scheduled for November 23.

The proceedings bring together several parts of the same crime: the messaging account used to threaten a victim, the bank transfer that removes their savings, the accounts receiving the money, and the investigation needed to recover it. Judges want institutions at each stage to take responsibility.

Digital arrest scams involve criminals posing as police or other authorities, sometimes using forged documents and prolonged video calls to frighten people into transferring money. Victims, including senior citizens, can be kept under pressure for hours and told they face arrest. The supposed detention is part of the deception.

The court observed that victims had lost around Rs 800 crore to cybercrimes so far in 2026, despite a fall of about 50 per cent in cybercrimes. Earlier figures recorded in an August order provide a more detailed picture of complaints specifically concerning digital arrest scams.

What WhatsApp must explain

Senior advocate Kapil Sibal, representing WhatsApp, told the bench that the Meta company had taken preventive action against 9,400 accounts. He said it would file an affidavit detailing its steps and was developing software to detect suspicious accounts and alert users.

The court's direction asks for the measures platforms propose to undertake, extending the exercise beyond a count of accounts already removed. Submitting the same proposals to I4C gives the national coordination body a role in examining how platform safeguards fit with banking controls and police investigations.

Details of how WhatsApp's proposed warning software would identify suspicious accounts, when users would receive alerts and when the system would become available have not been announced. Those practical features will matter to someone receiving a threatening call while being urged to move money immediately.

Compensation would depend on an institution's failure

The Supreme Court directed that the Reserve Bank of India's proposed regulatory measures must include compensation where an investigation establishes that a financial institution failed to exercise due diligence in preventing or reporting fraud. Due diligence means taking the checks and precautions reasonably required of the institution.

The bench headed by Chief Justice Surya Kant set out the required minimum payment in its October 29 order:

pay suitable compensation not less than the amount lost by the customer

The condition attached to that payment is central: investigators must establish that the fraud occurred because of the institution's failure. For a victim who lost savings after a bank neglected required checks, the proposed protection would link that failure directly to a duty to compensate.

The RBI's proposed Know Your Customer Amendment Directions, 2026, are scheduled for notification by November 30 and implementation by December 31. The bench said it would first examine the proposals. Know Your Customer, usually shortened to KYC, refers to checks banks use to verify customers' identities and maintain information about their accounts.

The court's instructions therefore concern both the content of the coming rules and how responsibility will be enforced. The compensation framework is still being developed, with institutional failure the stated basis for payment.

Why unusual transfers are a focus

Chief Justice Surya Kant questioned why banks could not intervene when a customer suddenly attempted to transfer an unusually large amount inconsistent with their previous transactions. Banks already hold information about customers and their account histories, giving them a chance to identify such changes before money leaves.

The court identified possible safeguards including temporarily suspending suspicious transactions, automatically notifying the nearest police station and physically verifying reported transactions to check whether they are genuine. Attorney General R Venkataramani told the bench that substantial work had been undertaken to improve detection of suspicious transactions and strengthen banking safeguards.

An earlier direction went further into the payment process. In its August 4 order, the Supreme Court gave the RBI four weeks to formally adopt and circulate a standard operating procedure for temporary debit holds on amounts or accounts linked to cyber fraud and money mule activity.

A debit hold temporarily restricts money from being taken out. A money mule account is an account used to receive or move criminal proceeds. The August order also directed the RBI to implement delayed transaction safeguards and a lagged credit mechanism, measures intended to create time for checks before suspicious payments progress.

At the October hearing, the court required the RBI to submit a list of all authorised financial institutions by November 23, helping define the institutions covered by its directions.

Complaints fell sharply, while losses remain substantial

I4C's fourth status report, dated August 3, recorded 123,672 digital arrest complaints on the National Cybercrime Reporting Portal in 2024, falling to 58,239 in 2025. That is a decrease of about 53 per cent, calculated from the two annual totals.

The report recorded another 16,377 complaints through June 30, 2026. That figure covers six months, while the earlier totals each cover a full year. The August order said corresponding reported losses had also fallen substantially and called for continued monitoring.

The October hearing's reference to around Rs 800 crore in losses concerned cybercrimes so far in 2026. The figures put two responsibilities before authorities at once: reducing new complaints and limiting the money taken from people who are still targeted.

Recovering money is a separate task

The August status report recorded 36,290 completed restorations of money, totalling Rs 18.05 crore, through the Money Restoration Mechanism. Its portal covered 57 banks and all 36 States and Union Territories.

A separate Grievance Redressal Mechanism Portal covered 123,590 branches of 69 banks. A data sharing agreement between the Reserve Bank Innovation Hub and I4C had been executed on May 11, 2026, adding a formal channel for cooperation.

The two mechanisms address connected problems. Victims need recovered money returned promptly, while people affected by the freezing of bank accounts need a way to raise grievances. The court directed States, Union Territories and law enforcement agencies to put both modules into use under the Home Ministry's January 2, 2026 standard operating procedure.

High Court registrars were told to bring the grievance mechanism to the attention of courts and other authorities handling account freezes. The Supreme Court said an affected person should ordinarily be encouraged to use that mechanism first, while retaining access to constitutional, statutory and other legal remedies.

The court also required future figures to show grievances received and resolved, restoration orders issued, completed returns and amounts restored, broken down by State and bank. Those details would show where money is being returned and where cases are waiting.

Investigations reveal networks across many States

The Central Bureau of Investigation had registered ten digital arrest cases and several related cases by the August review. One investigation identified 238 victims, 67 bank accounts receiving money at the first stage and transactions of approximately Rs 80 crore. Searches took place at 93 locations across 16 States.

The scale helps explain the court's focus on coordination. A victim, the first receiving account and subsequent transfers may be spread across different jurisdictions. Investigators need to connect those parts to identify the network and locate money.

The interdepartmental committee coordinating the response asked the CBI to examine lowering its existing Rs 10 crore threshold for taking up investigations. It also asked the agency to consider cases involving the same organised network where the combined fraud exceeded that threshold. The court directed the CBI to examine those suggestions and report back.

By the August hearing, electronic Zero FIR registration was operational in 19 States, while 14 States had notified State Cybercrime Coordination Centres. A Zero FIR allows a complaint to be registered before the case is transferred to the police jurisdiction responsible for investigating it. Remaining States and Union Territories were given four weeks to notify and operationalise their coordination centres.

In October, the court directed police across all States and Union Territories to report registered digital arrest cases, the resulting investigations and suggestions for prevention, detection and prosecution. Police chiefs were made responsible for compliance, and reports must also reach the coordinating interdepartmental committee.

Call controls and SIM misuse are also under review

The August order asked the Ministry of Electronics and Information Technology, the Department of Telecommunications and I4C to examine a proposed time based kill switch for audio and video calls, in consultation with affected platforms.

The proposal concerns scams in which criminals hold victims on calls while applying pressure. The court sought an assessment of technical feasibility, effectiveness, safeguards and alternatives before further consideration.

The Department of Telecommunications was separately directed to report action against telecom service providers and points of sale agents whose conduct contributed to scams. It also had to respond to a proposal for a unified dashboard addressing SIM abuse, including duplicate SIM cards and misuse of KYC processes to obtain additional connections.

The August status report said the Telecommunications (Radio Equipment Possession Authorisation) Rules, 2025, had been notified, while the Telecommunications (User Identification) Rules, 2025, were at the final notification stage. These steps place telephone access alongside messaging accounts and bank accounts in the court's prevention effort.

The dates shaping the next stage

The case, In Re: Victims of Digital Arrest Related to Forged Documents, began on the Supreme Court's own initiative, a process known as suo motu proceedings. Its orders have developed from coordination and recovery measures into demands for specific platform safeguards and enforceable banking protections.

The sequence includes completed administrative steps, earlier court deadlines and the forthcoming review:

• January 2, 2026: The Home Ministry's procedure addressed custody and restoration of money and grievance redressal.
• May 11, 2026: The Reserve Bank Innovation Hub and I4C executed their data sharing agreement.
• August 4, 2026: The court ordered banking and State coordination measures, with several deadlines of four weeks, and scheduled a review for September 16.
• October 29, 2026: The bench sought platform prevention plans and required compensation provisions tied to financial institutions' failures.
• November 23, 2026: The court is scheduled to consider the case again, with the RBI required to provide its list of authorised financial institutions.
• November 30 and December 31, 2026: Proposed dates for notification and implementation, respectively, of the RBI's KYC amendment directions, subject to the court's examination.

The immediate work falls to platforms preparing their proposals, the RBI preparing its rules and institutional list, and police compiling investigation reports. For victims, the concrete issues are whether suspicious transfers can be interrupted, recovered funds returned faster and compensation secured when an institution's failure allowed the loss.

Key Points

• WhatsApp and other intermediaries must submit prevention proposals to the Supreme Court and I4C.
• WhatsApp's lawyer said it acted against 9,400 accounts and was developing software to warn users about suspicious accounts.
• The court wants banking rules to require compensation of at least the customer's loss where institutional failure caused the fraud.
• I4C recorded 123,672 digital arrest complaints in 2024, 58,239 in 2025 and 16,377 through June 2026.
• The August status report recorded Rs 18.05 crore returned through 36,290 completed money restorations.
• The next hearing is scheduled for November 23, 2026.