On 29 October 2026, a Supreme Court bench led by Chief Justice Surya Kant, with Justices Joymalya Bagchi and V. Mohana, passed an order in its suo motu case on "digital arrest" scams. It was uploaded on 7 November. According to MediaNama's report, the order directs WhatsApp LLC and other intermediaries to set out their measures against the scams and submit them to the Indian Cyber Crime Coordination Centre (I4C). It also says the RBI's regulatory measures must require financial institutions to indemnify victims where due-diligence failures enabled the fraud. The next hearing is 23 November.
The strongest case for the court's approach
The case for judicial pressure is real. In a digital-arrest scam, fraudsters impersonate police or investigators, usually over WhatsApp or Skype video calls, and coerce victims into transferring money. CJI Kant has called these scams, per MediaNama, "the biggest financial fraud on the economy of the country." Victims are often frightened, elderly and isolated, and cannot realistically protect themselves. If losses stay with the victim, nobody else has a reason to invest in prevention. Shifting costs to the parties best placed to stop the fraud is a standard and defensible regulatory principle.
Banks: liability where the failure is theirs
The bank direction is the order's strongest feature. As reported by MediaNama, the court said the RBI's proposed measures "must mandate and incorporate suitable provisions" for indemnification, with compensation "not less than the amount lost by the customer" where due diligence failed. Justice Bagchi said, "We will put up a strict liability on the financial institutions."
This fits an evidence-based approach for three reasons.
- Banks control the choke point. Stolen money has to land in a mule account that a bank opened and verified.
- The liability is conditional on a due-diligence failure, not on every fraud. That keeps the incentive aimed at behaviour banks can change: weak KYC, ignoring out-of-pattern transfers, and slow responses.
- It attacks the real bottleneck, which is recovery. An earlier 4 August 2026 order, reported by LiveLaw, recorded 36,290 money-restoration cases involving only ₹18.05 crore across 57 banks, roughly ₹5,000 per case. That is far smaller than typical losses in headline cases.
The RBI's timetable is also concrete. MediaNama reports that the RBI plans to notify the "Know Your Customer (KYC) Amendment Directions, 2026" by 30 November and bring them into force by 31 December. The court will examine them before issuing its own directions. A September draft reportedly proposed holds of up to 60 days on suspected mule accounts and on flagged transactions of ₹1,000 or more. Sixty-day holds on small transactions carry costs for ordinary customers and small businesses, so the court should insist on a fast, human-reviewed release path for wrongly frozen funds.
Intermediaries: the harder question
The WhatsApp direction is where proportionality matters most. MediaNama describes it as the first time the court has requested plans directly from platforms. Asking a platform to explain what it does is a modest step, and arguably better than imposing a rule first. But the court is operating in a space where design choices carry speech and privacy costs.
The evidence on platform enforcement is mixed. WhatsApp told the court it banned about 9,400 accounts linked to digital-arrest scams over 12 weeks from January 2026, as reported by MediaNama. The same report says the government flagged about 3,800 accounts, of which only 17 involved digital arrests. Either the flagged-account lists are noisy or the scam activity is spread across channels. Both readings argue against blunt mandates.
Three risks follow from poorly designed platform duties.
- Encryption. WhatsApp cannot read message content. Any duty to detect scam conversations pushes towards client-side scanning or traceability, which would weaken security for 500 million-plus Indian users to catch a narrow category of fraud.
- Over-removal. Fraud is defined by behaviour, not by content. Broad account-banning mandates risk locking out legitimate users, including small businesses, with little due process.
- Displacement. Scammers move between WhatsApp, Skype, SMS and ordinary phone calls. A rule aimed at one app leaves the underlying calls and mule accounts untouched.
The better targets are metadata-level signals that do not require reading messages: new accounts making mass first contact, impersonation of government numbers, and calls spoofing official identities. Platforms can also add friction, such as warnings on unknown video callers who claim to be law enforcement. These measures work within the existing intermediary framework, where the safe harbour under section 79 of the Information Technology Act is conditioned on due diligence and on acting after receiving notice.
What to watch on 23 November
Three things will show whether the order stays proportionate.
- What I4C does with the plans. The submissions should be published or summarised, so the public can judge whether the measures are targeted and whether they change outcomes.
- Whether the court sets outcome metrics. The I4C status report cited by Verdictum shows National Cybercrime Reporting Portal digital-arrest complaints falling from 1,23,672 in 2024 to 58,239 in 2025. Whatever drove that decline, measuring complaints, recoveries and mule-account takedowns would let the court see which measures work.
- Whether liability stays tied to fault. Strict liability for banks is tolerable if it is linked to specific due-diligence failures. Extending a similar standard to platforms, without a clear failure to act on notice, would be a different and riskier step.
The court has found the right place to put the cost: on the institutions that hold the accounts and decide whether to verify them. The task now is to keep the platform side to transparent, narrow and reviewable commitments, and not to build new surveillance or takedown powers around a crime that is ultimately settled in the banking system.