Key points
- WhatsApp and other intermediaries must tell the court what measures they propose, and send the same plan to the I4C.
- RBI rules must make banks pay victims at least the amount lost where due diligence failed.
- The case returns on November 23, 2026; the RBI must list all authorised financial institutions by then.
The Supreme Court has asked WhatsApp and other intermediaries to tell it what measures they propose to stop digital arrest scams and related cybercrime, and has told the Reserve Bank of India that banks must compensate victims where they failed to exercise due diligence. The directions, from a bench of Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V Mohana, became public on Tuesday, November 10, 2026. The case returns to court on November 23, 2026.
The bench is hearing the suo motu case titled “In Re: Victims of Digital Arrest Related to Forged Documents”. Reports of the order tie it to the hearing of October 29, 2026.
What the court directed
WhatsApp LLC, a Meta company, and the other intermediaries must set out the steps they propose to prevent digital arrest scams. The bench said they “shall also simultaneously submit their proposals to the I4C”, the Indian Cyber Crime Coordination Centre, the Union home ministry’s body for cybercrime.
Senior advocate Kapil Sibal, appearing for WhatsApp, told the court that the company had acted against 9,400 accounts and was developing software that can spot suspicious accounts and warn users. He said WhatsApp would file an affidavit listing what it has done.
State and Union Territory police must report the FIRs registered in digital arrest cases and the investigations that followed, and suggest ways to prevent, detect and prosecute the offence. The directors general of police of all states and Union Territories must make sure this is done. The reports go to the inter-departmental committee that coordinates the government’s response, and copies of what is filed in court are sent to the committee as well.
Attorney General R Venkataramani, for the Centre and other authorities, told the bench that substantial work had been done to detect suspicious transactions and strengthen preventive mechanisms.
Banks and the RBI
The sharper directions are for banks. The bench said the RBI’s rules must require financial institutions to indemnify victims and pay compensation not less than the amount lost wherever the institution failed in due diligence. The Chief Justice asked why banks did not step in when customers suddenly moved unusually large sums that did not match their transaction history, and called banks a “protective umbrella” for vulnerable customers.
The court suggested safeguards: temporarily suspending unusual transactions, alerting the nearest police station and physically verifying flagged transfers. It said the RBI framework needs enforceable provisions on compensation, preventive intervention and institutional accountability.
The RBI has to give the court a list of all authorised financial institutions by the next hearing. The bench will first examine the proposed RBI Know Your Customer (Amendment) Directions, 2026 before the regulatory process goes ahead. Those directions are proposed to be notified by November 30, 2026 and to be in operation by December 31, 2026.
The bench noted that cybercrime had reportedly fallen by 50%, yet victims had lost about ₹800 crore so far this year.
The order at a glance
- 9,400WhatsApp accounts acted against, as told to the court
- ₹800 crorelost by victims this year, the bench noted
- Nov 30proposed date to notify RBI KYC (Amendment) Directions, 2026
- Nov 23next hearing
How the case got here
The court took up the matter on its own on October 17, 2025, after a 73-year-old woman from Ambala, Haryana, wrote to the then Chief Justice, B R Gavai. She and her husband had been kept under a fake “digital arrest” using forged court and investigating agency orders and made to transfer more than ₹1.05 crore. The court called the forgery “a matter of grave concern” and said such acts “cannot be treated as ordinary or routine offences”.
On October 27, 2025, a bench of Justices Surya Kant and Joymalya Bagchi asked all states and Union Territories for details of the cases they had registered. It said it was inclined to hand the cases to the CBI for all states because of their pan-India and possibly cross-border spread. Attorney General Venkataramani said money-laundering gangs operated from outside India, including Myanmar and Thailand. Solicitor General Tushar Mehta said the CBI was already investigating some cases with help from the home ministry’s cybercrime division.
The Union government has since filed a status report on steps taken after the court’s earlier directions in February, and the court had asked the RBI for a standard operating procedure for temporary debit holds on accounts linked to cyber-enabled fraud, along with a grievance mechanism and a module to restore money to victims.
What it means for customers
If the court’s direction becomes an RBI rule, a customer who loses money to a digital arrest fraud that the bank should have caught would have a claim to be repaid in full by the bank, rather than having to chase the money through police and courts. For platforms, the filings will show for the first time on the record how many accounts they block and what warnings users get.
What happens next
The matter is listed on November 23, 2026. By then WhatsApp and the other intermediaries are due to have filed their proposals, the RBI its list of authorised financial institutions, and state police their FIR reports. The court will look at the draft KYC directions before the RBI notifies them.