The Fraud the Rulebook Missed: Why Digital Arrest Losses Belong With Banks and Why the RBI Should Say So

Where the Zero-Liability Promise Ends: Fraud the Victim Authorises

India's aggregate numbers on digital arrest frauds are improving. I4C data show complaints falling from 1,23,672 in 2024 to 58,239 in 2025 and losses from ₹1,935 crore to ₹1,211 crore. The CJI put the figures higher in court, saying about ₹3,000 crore was lost last year and over ₹800 crore so far this year. Whichever number one uses, the loss has fallen almost entirely on one group: the victims themselves.

The Victim the Rulebook Did Not Imagine Consider the

typical victim. A caller claiming to be from the CBI or police says the person is under investigation and must stay on a video call. Under hours of fear, the victim transfers savings to an account the caller names. Amicus curiae N.S.

Nappinai told the Court that psychologists describe victims as being in a hypnotised state; Justice Mohana noted that educated people are falling prey too. The RBI's 2017 circular protects customers from unauthorised electronic transactions, where a bank is negligent or a third party breaches the system.

A digital arrest payment is different: the customer authorises it. In the industry's terms, it is authorised push payment fraud. The bank sees a valid instruction from its own customer, so the zero-liability promise does not apply.

The victim carries the full loss.

How Liability Changes Behaviour

The mechanism that matters is not only who pays, but who can stop the fraud most cheaply. Two banks touch every digital arrest transfer. The sending bank sees a customer suddenly moving unusual sums. The receiving bank holds the mule account, opened under its KYC, through which the money moves on.

Today, neither bears the cost when its controls fail, so neither has a strong reason to invest in prevention. The UK faced this problem and chose a rule. From October 2024, its Payment Systems Regulator required reimbursement of authorised push payment fraud up to £85,000 per claim, with the cost split equally between the sending and receiving banks.

Once banks had money at stake, they had a reason to monitor transactions and close mule accounts. The Court's direction follows the same economic logic. It wants unusual transactions suspended until verified, alerts sent to police and banks to compensate victims when their due diligence fails.

That moves the loss toward the institutions able to prevent it.

Right Destination, Wrong Vehicle

The direction of travel is correct, but the route matters. A liability rule needs calibration: a cap, a split between sending and receiving banks, an exception for gross customer negligence and a clear standard of due diligence.

These are regulatory judgements that the RBI is equipped to make and revise. A liability rule created under Article 142, the Court's power to do complete justice, lacks that calibration and is harder to adjust as fraud methods change.

The better path is already open. The Court has said it will examine the draft KYC Amendment Directions before notification. It should use that review to require the RBI to write bank liability into the rules, rather than imposing it by judicial direction.

Why This Matters for the Exam

The lesson for GS3 is that consumer protection rules are drafted around the frauds of their time. India's 2017 framework was built for hacked accounts, not coerced customers. Fixing that gap through incentives, not only awareness, is what will shift the numbers that matter to victims.