When a scammer empties a bank account, someone has to absorb the loss. For most of the history of digital banking in Asia, that someone has been the customer. India's Supreme Court has now said that should change. On Oct. 29, a bench led by Chief Justice Surya Kant said banks should repay victims of "digital arrest" and other cyber frauds at least the full amount lost whenever a failure of the bank's own due diligence made the fraud possible, as Capital Times reported.

The court is right, and its logic should travel. Banks design the systems, see the transaction data and profit from the payment rails. They should be the default payer for digital fraud, with savers liable only where a bank can show real negligence on the customer's part.

Why the Burden Belongs With Banks

The case for bank liability is about incentives, not sympathy. A customer facing a convincing caller posing as a police officer has one chance to spot the trick. A bank sees millions of transactions and can tell when a retiree suddenly wires her savings to a newly opened account. The bench made the same point: Verdictum reported that the Chief Justice asked how banks could use AI and audit trails to flag unusual transactions, and the judges called for transfers that depart from a customer's usual pattern to be temporarily suspended and verified. The court also flagged mule accounts, which banks open and must vet, as a major problem.

The sums are not trivial. The Chief Justice said losses from digital arrest offenses this year come to nearly 800 crore rupees, according to Deccan Chronicle. When losses fall on the party least able to prevent them, there is little pressure on the party best able to do so.

India's central bank has already moved part of the way. Reserve Bank of India rules that take effect on Jan. 1, 2027 shift the burden of proof to banks, which must show evidence before holding a customer liable, Outlook Money reported. They also cover frauds in which customers are tricked into acting, not only unauthorized transactions. But the compensation formula is thin: 85% of the net loss or 25,000 rupees, whichever is lower, for frauds up to 50,000 rupees, available once in a lifetime and run as a pilot, with the RBI itself funding most of each payout, according to Upstox. That is relief, not responsibility.

Singapore's Framework Is a Start, Not a Model

Singapore is often cited as the regional benchmark. Its Shared Responsibility Framework, in force since Dec. 16, 2024, requires banks to impose a 12-hour cooling-off period after a new device or security token is activated, send real-time alerts and offer a "kill switch" that lets customers freeze their accounts, according to a Reed Smith summary. Telecom operators must block unauthorized SMS sender IDs and filter malicious links. Liability runs in a waterfall: a bank that breached a duty pays in full, then a telco that breached its duties, and only then the customer.

The duties are sensible. The scope is not. The framework covers phishing on fake websites and apps, but excludes malware scams and authorized transactions, Reed Smith noted. That leaves out exactly the kind of coercion at the heart of India's digital arrest cases, where victims are pressured into sending money themselves. The Monetary Authority of Singapore (MAS) itself pointed to banks' "discretionary goodwill frameworks" outside the rules, which is another way of saying that many victims depend on a bank's goodwill rather than a right.

What Regulators Should Do

First, the RBI should write the Supreme Court's standard into its Know Your Customer amendments, which are due to be notified by Nov. 30, according to Deccan Chronicle. Where a bank's checks failed, repayment should be full and prompt, not capped at 25,000 rupees.

Second, liability should reach the receiving bank. A fraud needs a mule account to land in. Regulators in India, Singapore and Hong Kong should require the bank that opened the mule account to share the reimbursement with the sending bank. That puts a price on lax onboarding, which is where the court's concern about mule accounts points.

Third, Singapore should extend its framework to authorized-payment scams and malware, with a clear test: if the bank's systems should have flagged the transfer, the bank pays. Its own fraud surveillance duty already targets large, rapid drains from accounts. The same logic applies whether the customer typed the password or was talked into pressing "send."

Fourth, customers should keep a duty of care, but a narrow one. Gross negligence, such as knowingly sharing a one-time password after a bank warning, can justify a reduced payout. Being fooled by a skilled impersonator should not.

The objection is moral hazard: customers who know they will be repaid may grow careless, and banks will pass costs on through fees. Some cost will be passed on. But spreading losses across all customers through prices is fairer than concentrating them on the elderly and less digitally fluent people who are most often targeted, and it gives banks a direct reason to invest in prevention.

The next marker is the Nov. 30 deadline for the RBI's KYC rules, which the court has said it will examine. That review will show whether India's banks are made to pay when their checks fail, or only to offer partial relief.

This editorial is general commentary, not financial advice.