India's Supreme Court said on Oct. 29 that banks should compensate victims of "digital arrest" and other cyber frauds for at least the full amount lost whenever a failure of the bank's own due diligence made the fraud possible, a standard the court wants written into rules the Reserve Bank of India plans to issue by Nov. 30.

The case matters well beyond India's courtrooms. Regulators across Asia are deciding how much of the cost of scams should fall on banks rather than on savers, and India now has two tracks moving at once: a court pushing for full repayment where banks slip, and RBI compensation rules for smaller frauds that take effect on Jan. 1, 2027.

What the Supreme Court said about bank liability

A bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana heard the suo motu case on digital arrest scams, in which fraudsters pose as police or other officials and pressure victims into moving money. The Chief Justice said losses from these offenses this year come to nearly 800 crore rupees, according to Deccan Chronicle and Outlook Money.

The bench said the RBI's measures must require banks to pay compensation "not less than equivalent to the amount lost by the customer" where due diligence failed, according to the legal news site Verdictum. Justice Bagchi said the court would impose strict liability on financial institutions whose products are misused for such frauds. The Chief Justice said responsibility cannot stop at an individual bank officer and that the victim's account should face no debit, Verdictum reported.

The judges also want prevention before money leaves an account. They called for unusual transfers that break from a customer's normal pattern to be suspended until verified, with automated alerts to the nearest police station. Outlook Money reported that the Chief Justice questioned why banks cannot use transaction histories to catch suspicious activity, and that the bench said voluntary guidelines are not enough without enforceable penalties. Verdictum reported that the court called mule accounts, used to move scam proceeds, a major problem and asked the RBI to examine them closely.

Before issuing its own directions, the court will examine the RBI's draft Know Your Customer (KYC) Amendment Directions, 2026. Those are due to be notified by Nov. 30 and put into operation by Dec. 31, according to Deccan Chronicle. Attorney General R. Venkataramani told the bench the directions would bind banks and leave them no discretion. He said reported digital arrest cases had fallen about 50% from a year earlier.

The RBI must give the court a list of every authorized financial institution by the next hearing, so the directions can apply to all of them without each bank being named as a party. WhatsApp told the court it had banned 9,400 suspicious accounts, Outlook Money reported.

What changes for savers on Jan. 1

Separate from the court case, the RBI issued amended directions on customer protection in digital fraud on June 24 that take effect on Jan. 1, 2027, according to Outlook Money. They apply to commercial banks, small finance banks, payments banks, regional rural banks, local area banks and cooperative banks.

The rules widen coverage beyond unauthorized online transactions to frauds in which customers are tricked into acting. They also shift the burden of proof: a bank that wants to hold a customer liable must prove it, and if it rejects a claim it must give reasons and evidence such as transaction records and authentication logs. Banks get 30 calendar days to investigate a complaint.

Customers bear no loss where the bank was negligent, or in third-party breaches if they report within five calendar days of the bank's alert. Any fraudulent transactions after the customer reports the incident are the bank's cost.

For smaller frauds, the RBI set a compensation formula: 85% of the net loss or 25,000 rupees, whichever is lower, for frauds of up to 50,000 rupees. The scheme runs as a pilot for frauds in its first year and can be claimed only once per person, according to Upstox. To qualify, the victim must report to both the bank and the National Cyber Crime Reporting Portal or the 1930 helpline within five calendar days.

Practical steps for savers

The rules reward speed. Anyone with an Indian bank account should save the bank's fraud reporting line and know the 1930 helpline before they need it, since the five-day window applies to both the zero-liability protection and the small-fraud payout.

Report to both channels, not just one. The RBI compensation formula requires a report to the bank and to the national cybercrime system. Keep screenshots, call logs and the bank's acknowledgment of your complaint.

If a bank rejects a claim after Jan. 1, ask for the evidence it relied on. Under the new rules the bank must provide its reasons and supporting records, which gives customers a basis to escalate.

Treat any demand to move money to "clear" an investigation as a fraud signal. The Supreme Court case centers on victims who were coerced by people posing as officials; the government is developing software to flag accounts that impersonate law enforcement or government agencies, Verdictum reported.

The next markers are the RBI's notification of the KYC amendments, due by Nov. 30, and the court's review of whether those rules meet its full-repayment standard.

This article is general information, not financial advice.