Digital Arrest Scams, Bank Liability and RBI: CLAT GK

📑 On this page

Imagine a phone call from a "CBI officer". Your Aadhaar, he says, is linked to a drugs parcel. A video call follows: a uniform, a police-station backdrop, a warrant with a court seal. Don't hang up, don't tell anyone, and move your savings to a "safe" account while the case is checked. Every part of it is fake. Thousands of Indians, many of them retired, have still paid.

On 29 October 2026, the Supreme Court asked a question the victims have been asking for two years: why did the bank let the money go? A three-judge Bench led by Chief Justice of India Surya Kant proposed that banks compensate victims of "digital arrest" scams, at least to the extent of the money lost, where the bank failed to exercise due diligence. The CJI also accused the Reserve Bank of India (RBI) of "soft pedalling".

For a CLAT aspirant this is a ready-made passage: a tort principle (negligence), a constitutional guarantee (what a real arrest needs), a regulator (the RBI) and a live debate over who carries the loss.

🎯 In a nutshell

A "digital arrest" is a scam: fraudsters pose as police, CBI, ED officers or even judges on video calls and frighten victims into transferring money. There is no such arrest in Indian law.
On 29 October 2026, a Bench of CJI Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana, hearing a suo motu case begun in October 2025, said RBI rules must make banks compensate victims by not less than the amount lost if the fraud happened because of the bank's failure of due diligence.
Victims are believed to have lost over ₹3,000 crore. Complaints rose from 39,925 (2022) to 1,23,672 (2024) (I4C).
The RBI's 2017 framework already gives customers zero or limited liability for unauthorised electronic transactions. Digital-arrest victims usually authorise the transfer themselves, which is why the proposal matters.
This is a proposal recorded in an order, not a final rule; the Attorney General says bank liability is for the RBI to decide.

📌 What CLAT actually expects

A Legal Reasoning passage would state the negligence rule and the proposed bank liability in plain words and ask you to apply them to a new set of facts: was there a red flag, did the bank miss it, did the victim's delay matter? A Current Affairs passage would add linked GK: the RBI, I4C, the 1930 helpline, and Article 22's 24-hour rule.

The backstory

What a "digital arrest" actually is

The Ministry of Home Affairs described the pattern in a public alert in May 2024. The caller says the victim has sent or will receive a parcel with drugs, fake passports or other contraband, or that a relative has been caught in a crime. Money is demanded to "settle" the case. Victims are then kept on Skype or another video platform until they pay. The fraudsters, the Ministry noted, use studios built to look like police stations and government offices, and wear uniforms.

The trick is isolation: victims are told not to speak to anyone, sometimes for days, while forged warrants and court orders make the threat feel real. In October 2024 the Indian Cyber Crime Coordination Centre (I4C) put it in one line: "CBI/Police/Custom/ED/Judges DO NOT arrest you on video call."

Why it cannot be an arrest

Indian law treats arrest as a physical, accountable act, not a state of mind. Under the Bharatiya Nagarik Suraksha Sanhita (BNSS), the officer making an arrest must actually touch or confine the person's body, unless the person submits to custody by word or action. The officer must tell the person the grounds of arrest, and must inform a relative or friend where the person is being held.

The Constitution adds two guarantees in Article 22. An arrested person must be told the grounds of arrest "as soon as may be" and may consult a lawyer of their choice. And they must be produced before the nearest magistrate within 24 hours, not counting travel time, and cannot be held longer without a magistrate's order. A video call that demands money satisfies none of this.

How big the problem is

Figures the I4C submitted to the Supreme Court, as reported by The Indian Express, show a steep rise and a partial fall:

Period	Digital-arrest complaints	Reported losses
2022	39,925	not given
2024	1,23,672	about ₹1,935 crore
2025	58,239	about ₹1,211 crore
Jan to Aug 2026	21,928	over ₹647 crore

→ scroll to see more

Many cases go unreported, industry executives say. In an early hearing in the case, the Bench itself called it "shocking that almost Rs 3,000 crore has been collected from the victims". On 29 October, the court was told of a woman who had recently lost ₹2.5 crore.

How the case reached the Supreme Court

Nobody filed this case as a party. On 21 September 2025, a 73-year-old woman from Ambala, Haryana, wrote to the then Chief Justice, B.R. Gavai. Fraudsters had shown her and her husband forged orders of the Supreme Court and investigating agencies over video calls and taken more than ₹1.05 crore through several bank transfers. The court took suo motu cognizance, meaning it started the case on its own motion, and registered it as In Re: Victims of Digital Arrest Related to Forged Documents.

1
17 October 2025
The court calls the forgery of its orders "a direct assault on the dignity and majesty of this institution".
2
1 December 2025
It orders a CBI probe into digital-arrest cases across India, including the alleged role of bank officials colluding with fraudsters.
3
9 February 2026
It calls the siphoning of over ₹54,000 crore through digital frauds "robbery or dacoity" and asks for a standard operating procedure (SOP).
4
4 August 2026
It gives the RBI four weeks to adopt an SOP for temporary debit holds on fraud-linked accounts, and asks a committee to examine a shared liability and victim compensation framework.

What the court said on 29 October

Attorney General R. Venkataramani told the Bench that banks were now better at flagging suspicious transactions and that the RBI's new measures would be in place by December. The amicus curiae (a senior lawyer who assists the court), N.S. Nappinai, replied that digital arrests were still happening, the last one reported only a week earlier.

The Bench was not satisfied. As reported by LiveLaw, The Indian Express and The Week:

Banks can see it coming. They know how each account is normally used. The CJI asked why an unusual transaction cannot be stalled while the police check with the customer. "Report will only be post-mortem. What about prevention?"
The RBI is too gentle. "There is soft pedalling by the RBI. Unfortunate. Because RBI is consulting the banks when we are asking for action against the banks," the CJI said (The Indian Express). He added that "bank officials are involved".
Only penalties will work. "Unless there's a penal direction to banks, they will not mend their ways," the CJI said, calling digital arrests the biggest financial fraud on the country's economy.
The victim should lose nothing. The Bench said the debit from a victim's account should be zero, with the bank bearing the loss. Justice Bagchi said the court was proposing strict liability on financial institutions, and that the RBI's draft rules must be checked for "teeth".

The order itself was more measured. LiveLaw reproduced the key line:

Regulatory measures proposed by RBI must mandate financial institutions to indemnify the digital arrest or cyber fraud victims through compensation not less than amount lost, if it is found that the fraud has taken place due to the failure of due diligence on behalf of the financial institution.

— Supreme Court order, 29 October 2026, as reported by LiveLaw

Notice the condition: "if it is found" that the bank failed in due diligence. That is liability for fault, not for every fraud. The AG pushed back even on this: bank liability, he argued, is for the RBI. The RBI's amended KYC (Know Your Customer) directions are expected by 30 November and to take effect in December.

The Bench was blunt with victims too. "What's the fear of arrest on mobile?" the CJI asked. The amicus had earlier explained that victims often "freeze" when threatened by people posing as officials.

Settled: there is no such thing as a digital arrest, and the court wants RBI rules that make negligent banks pay. Proposed, not final: the exact liability rule, its trigger and whether it covers all cyber fraud. Unknown: what the RBI's final directions will say and whether the court will accept them.

The law behind the idea

Negligence: duty, breach, damage

In tort law, negligence means failing to take the care that a reasonable person would take in the circumstances. A claim needs three things: a duty of care owed to the claimant, a breach of that duty, and damage caused by the breach. Miss any one, and the claim fails.

Apply it to a bank. Duty: it holds your money and runs your payments. Breach: did it ignore a warning sign a careful bank would act on, such as a 70-year-old's savings leaving in one go for an account opened last week? Damage: would a pause have saved the money? If nothing looked odd, there is no breach and no liability, however sad the loss.

What the RBI already says

The duty is partly written down already. The RBI's circular of 6 July 2017, on limiting customers' liability in unauthorised electronic banking transactions, requires banks to have a "robust and dynamic fraud detection and prevention mechanism". It then shares the loss like this:

Situation (unauthorised transaction)	Customer's liability
Fraud, negligence or deficiency on the bank's part	Zero, whether or not the customer reports it
Breach elsewhere in the system, reported within 3 working days	Zero
Same, reported in 4 to 7 working days	Transaction value or a cap, whichever is lower: ₹5,000, ₹10,000 or ₹25,000 depending on the account
Same, reported after 7 working days	As per the bank's Board-approved policy
Customer's own negligence, such as sharing payment credentials	Customer bears the whole loss until reporting; the bank bears any loss after that

→ scroll to see more

The bank must prove any customer liability, and must credit the disputed amount within 10 working days of being told.

Now the catch. Every row above is about unauthorised transactions: someone else uses your card or your account. A digital-arrest victim usually sends the money personally. On paper that is authorised, and the 2017 safety net does not neatly catch it. The court's proposal shifts the question from "who pressed the button?" to "did the bank take reasonable care?"

"Voluntary" payment made in fear

A bank might argue contributory negligence: the victim's own carelessness helped cause the loss. Under this principle, compensation can be reduced in proportion to the victim's share of the fault; it is not wiped out.

But calling the payment "voluntary" is weak. In tort, consent obtained by fraud or under compulsion is not free consent; a person cannot be said to be truly willing without the freedom to choose. Criminal law agrees: extortion means putting someone in fear of injury to make them hand over property. Money sent under a fake arrest threat is extorted, not gifted.

Where the court gets the power

Article 32 lets the Supreme Court issue "directions or orders or writs" to enforce Fundamental Rights, and Article 142 lets it pass any order "necessary for doing complete justice" in a matter before it. But banking is a Union List subject, and Parliament has made the RBI the banks' regulator. That is why the order speaks to the RBI's proposed measures rather than decreeing compensation itself.

The debate

Question	Make banks liable	Be careful
Who can stop the money?	Only the bank sees the transfer in real time, and a life's savings leaving for a new account is a pattern software can flag. "Moment a transaction comes, why can't it be withheld?" the CJI asked.	A coached victim will insist the payment is genuine. Holding every unusual payment slows honest transfers, from hospital bills to house deposits.
Mule accounts	The money lands in accounts some bank opened. Weak KYC, or colluding officials, is a banking failure.	Many mule accounts use real documents of real people paid to lend their accounts. KYC cannot catch every one.
Incentives	Put the loss on the party best placed to prevent it and it will invest in prevention.	If banks always pay, some customers may take less care (economists call this "moral hazard"), and the cost may come back to every customer as fees.
Who decides?	The RBI has dragged its feet; when citizens lose life savings, Articles 32 and 142 let the court push.	The AG says liability is the RBI's call; judges designing banking rules blur the separation of powers.

→ scroll to see more

Both sides agree on more than it seems: nobody argues banks should pay when they did everything right, or defends one that waved through an obvious red flag. The real fight is over where to draw the line and who draws it: judges or the regulator.

Facts you must know

Item	What to remember
Reserve Bank of India	Established 1 April 1935 under the RBI Act, 1934. Central office first in Kolkata, permanently in Mumbai from 1937. Fully government-owned since nationalisation in 1949. Governor: Sanjay Malhotra (26th, since 11 December 2024)
Banking Regulation Act, 1949	A main law under which the RBI regulates banks
Banking in the Constitution	"Banking" is entry 45 of the Union List. "Public order" and "Police" are entries 1 and 2 of the State List, so states mainly investigate cybercrime
I4C	Indian Cyber Crime Coordination Centre, an attached office of the Ministry of Home Affairs. Runs the National Cyber Crime Reporting Portal (cybercrime.gov.in) and the 1930 helpline
CERT-In	Indian Computer Emergency Response Team: national cyber security incident agency under section 70B, IT Act; Ministry of Electronics and IT
IT Act, 2000	In force from 17 October 2000. Section 66D: cheating by personation using a computer resource or communication device, up to 3 years and fine up to ₹1 lakh
Cheating by personation	IPC s.416/419 → BNS s.319 (up to 5 years). Cheating: IPC s.415/417 → BNS s.318. Extortion: IPC s.383/384 → BNS s.308
Article 22	Grounds of arrest "as soon as may be"; right to a lawyer; production before the nearest magistrate within 24 hours (excluding travel)
Articles 32 and 142	32: Supreme Court's power to enforce Fundamental Rights through directions, orders and writs. 142: orders for "complete justice"
The case	In Re: Victims of Digital Arrest Related to Forged Documents, suo motu, cognizance October 2025; Bench on 29 Oct 2026: CJI Surya Kant, Justices Joymalya Bagchi and V. Mohana

→ scroll to see more

⚠️ Common confusions

There is no "digital arrest": it is the name of a scam, not a legal procedure. Authorised vs unauthorised: the RBI's 2017 zero-liability rules cover unauthorised transactions; digital-arrest victims usually authorise the transfer themselves under fear. Suo motu ≠ PIL: in a suo motu case the court acts on its own, here on a victim's letter; a PIL is filed by a petitioner on behalf of others. Proposal ≠ final rule: the court recorded that RBI measures "must" make negligent banks compensate; the RBI's directions are still to come. Fault-based, not automatic: the order turns on a failure of due diligence, even though Justice Bagchi used the words "strict liability". I4C vs CERT-In: I4C (MHA) runs cybercrime reporting and 1930; CERT-In (MeitY) handles cyber security incidents. Article 22 vs Article 21: the 24-hour production rule is in Article 22(2).

How CLAT could test this

An original CLAT-style passage, then five questions: two that apply its principles, three on linked GK.

🧩 Worked example

Rekha Iyer was seventy-two and had never had a quarrel with the law. So when a man in a police uniform appeared on a video call and told her that a parcel booked in her name contained drugs, she believed him. For two days she stayed in front of her phone, as instructed, and spoke to no one. On the third day she transferred most of her savings to an account she was told belonged to a "verification desk". That account had been opened a week earlier. Within an hour, the money had moved on through a chain of other accounts. Cases like hers raise an old question in a new form: when a fraudster takes the money, who else should bear the loss? The law of negligence offers a starting point. A person is liable in negligence when three things are present: he owed the other a duty of care; he breached that duty by failing to take the care a reasonable person in his position would take; and the breach caused the other's loss. A bank owes its customers a duty to run reasonable fraud checks. It is expected to notice transactions that are sharply out of line with how an account is normally used, and receiving accounts that behave like "mule" accounts, which take in large sums from many sources and pass them on at once. Two further principles matter. First, if the customer's own carelessness also contributed to the loss, the compensation may be reduced in proportion to the customer's share of the fault; it is not wiped out altogether. Second, consent obtained by threats or deception is not free consent. A person who hands over money because she has been frightened into it has not chosen to accept the loss. Existing banking rules mostly deal with unauthorised transactions, where someone else uses the customer's account without her knowledge. If the customer reports such a transaction within three working days, she bears no loss. Ms Iyer's case does not fit easily, because she pressed the buttons herself. A new proposal tries to fill this gap. Under it, where a fraud succeeds because a bank failed to exercise due diligence, the bank must compensate the customer by an amount not less than the amount lost. The proposal does not make banks insurers against every fraud. A bank that ran reasonable checks and found nothing unusual would not be liable under it. Critics say even this much will make banks slow down honest payments for everyone; supporters reply that an institution which earns from holding people's money must also guard it.

1. Ms Iyer's transfer was forty times larger than any payment she had made before. Her bank processed it instantly; the receiving bank, whose week-old account had taken in money from thirty sources that week and paid it out within minutes each time, raised no query. Applying the principles in the passage, which is the most accurate conclusion?

AMs Iyer cannot recover anything, because she authorised the transfer herself

BThe banks appear to have breached their duty of care by ignoring clear warning signs, so under the proposal Ms Iyer should be compensated by not less than the amount she lost

COnly the fraudsters can be liable, because the banks did not take the money

DMs Iyer's liability is capped at a small fixed sum, because she reported the loss within three working days

▸ Show solution

Answer: B. The passage says a bank must notice transactions sharply out of line with an account's normal use and accounts that behave like mule accounts. A transfer forty times her usual size, sent to a week-old account showing exactly the mule pattern, is a red flag on both counts, and a pause could have stopped the loss. That is a failure of due diligence, so the proposal applies: compensation not less than the amount lost. A is wrong because consent obtained by threats is not free consent. C ignores the negligence principle. D applies the unauthorised-transaction rule, which the passage says does not fit a case where she pressed the buttons herself.

🧩 Worked example

2. Kabir, a trader, regularly sends ₹3 lakh at a time to suppliers. After a fake "ED" call, he sends ₹3 lakh to an account he has paid before, which belongs to an old supplier whose account was later found to have been taken over by fraudsters. Nothing about the transfer differed from his routine. He tells his bank five weeks later. Which statement best fits the passage?

AThe bank must compensate Kabir in full, because he was put in fear

BKabir's compensation is halved because he waited five weeks

CThe bank is not liable, because a payment made by the customer himself can never be involuntary

DUnder the proposal as stated, the bank is not liable, because nothing shows it failed in due diligence; the answer could change only if banks were made liable for every fraud regardless of fault

▸ Show solution

Answer: D. The proposal applies only where the fraud succeeded because the bank failed in due diligence, and the passage says a bank that ran reasonable checks and found nothing unusual would not be liable. A routine-sized payment to a known payee gave the bank nothing to notice, so there is no breach. Being put in fear (A) explains why the payment is not truly voluntary, but it does not create a breach by the bank. C contradicts the passage's principle on consent. B invents a rule: contributory negligence reduces compensation only where there is liability in the first place.

🧩 Worked example

3. The passage describes a fake "arrest" over a video call. Under the Constitution of India, a person who is genuinely arrested and detained must be produced before the nearest magistrate within 24 hours. Which Article guarantees this?

AArticle 20

BArticle 21

CArticle 22

DArticle 32

▸ Show solution

Answer: C. Article 22(2) requires production before the nearest magistrate within 24 hours of arrest, excluding travel time, and bars longer detention without a magistrate's authority. Article 22(1) adds the right to be told the grounds of arrest and to consult a lawyer. Article 21 is the broader right to life and personal liberty; Article 20 covers protection in respect of conviction for offences; Article 32 is the right to move the Supreme Court.

🧩 Worked example

4. A victim of a fraud like Ms Iyer's wants to report it at once. The national cybercrime helpline 1930 and the portal cybercrime.gov.in are run under which body?

AThe Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs

BCERT-In, under the Ministry of Electronics and Information Technology

CThe Reserve Bank of India

DThe Central Bureau of Investigation

▸ Show solution

Answer: A. The I4C is an attached office of the Ministry of Home Affairs. The National Cyber Crime Reporting Portal was launched as part of it, and the 1930 helpline helps people lodge online cyber complaints. CERT-In is the national agency for cyber security incidents under section 70B of the IT Act, a different job. The RBI regulates banks; the CBI investigates cases.

🧩 Worked example

5. The passage refers to "existing banking rules" on unauthorised transactions. These come from the Reserve Bank of India. Which statement about the RBI is correct?

AIt was set up in 1949 under the Banking Regulation Act, 1949

BIt was established in 1935 with its central office in New Delhi

CIt was established on 1 April 1935 under the RBI Act, 1934, and its central office moved permanently to Mumbai in 1937

DIt was created in 1969, when major banks were nationalised

▸ Show solution

Answer: C. The RBI was established on 1 April 1935 under the Reserve Bank of India Act, 1934. Its central office began in Kolkata and moved permanently to Mumbai in 1937. 1949 is the year it was nationalised and the year of the Banking Regulation Act, which is why A is a tempting trap. It has never been headquartered in New Delhi, and 1969 is the year of bank nationalisation, not the RBI's birth.

Connect the dots

Law of torts

Negligence, duty of care, contributory negligence and consent, explained for CLAT.

Legal Reasoning

Law of torts drill

Apply negligence principles to fresh facts under time pressure.

Practice

Economy and business

The RBI, banking and the money stories behind CLAT GK.

Current Affairs & GK

Science, tech and environment

Cybercrime, digital payments and technology in the news.

Current Affairs & GK

Legal GK and public policy

Suo motu cases, courts and regulators: who decides what.

Legal Reasoning

Practise negligence questions

Take the law of torts drill: principle-based CLAT questions on duty, breach and damage.

Start the torts drill

Sources

Frequently asked questions

What is a digital arrest scam?

It is a cyber fraud in which criminals pose as police, CBI, ED or customs officers, or even judges, usually on video calls. They claim the victim is linked to a crime such as drug trafficking or money laundering, keep the victim on the call and isolated, and demand money to 'verify' accounts or avoid arrest. Fake warrants, forged court orders and studio sets made to look like police stations are common.

Can the police arrest someone over a video call in India?

No. There is no legal provision for a 'digital arrest'. Under the BNSS an officer making an arrest must actually touch or confine the person unless they submit to custody, must tell them the grounds and must inform a relative or friend. Article 22 requires production before the nearest magistrate within 24 hours. The I4C's advisory says CBI, police, customs, ED and judges do not arrest anyone on a video call.

Will banks have to refund digital arrest victims?

Not automatically, and not yet. On 29 October 2026 the Supreme Court recorded that the RBI's proposed measures must make financial institutions compensate digital-arrest and cyber-fraud victims by not less than the amount lost, if the fraud happened because of the institution's failure of due diligence. The RBI's directions are still to come, and the Attorney General argued that bank liability is for the RBI to decide.

Does the RBI's zero-liability rule cover digital arrest fraud?

Only partly. The RBI's 6 July 2017 circular gives customers zero or limited liability for unauthorised electronic transactions, depending on who was at fault and how fast the customer reported. Digital-arrest victims usually make the transfer themselves, so the transaction looks authorised. That gap is why the court's due-diligence proposal matters. Where the bank itself was at fault, the circular already gives zero liability.

Where should I report a digital arrest call or cyber fraud?

Call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in, both run under the Indian Cyber Crime Coordination Centre (I4C) of the Ministry of Home Affairs. Report quickly: the faster a fraud is reported, the better the chance of freezing the money before it moves on.

Why does this matter for CLAT 2027?

It fits both Legal Reasoning and Current Affairs. CLAT can give you the negligence rule and the proposed bank liability in a passage and ask you to apply them to new facts, such as a missed red flag or a late report. Current Affairs questions can add linked GK on the RBI, I4C, the 1930 helpline, Article 22 and suo motu jurisdiction.