India’s Supreme Court has directed WhatsApp and other digital intermediaries to set out the measures they propose to take to prevent digital arrest scams and related cybercrimes, and to submit their proposals to the Indian Cybercrime Coordination Centre. The court has also told the Reserve Bank of India to ensure that banks compensate victims when fraud occurs because of a bank’s failure to exercise due diligence.
The directions were issued by a bench headed by Chief Justice of India Surya Kant, with Justices Joymalya Bagchi and V Mohana, in the court’s suo motu case titled In Re: Victims of Digital Arrest Related to Forged Documents. The bench heard the matter on 29 October, and the order was uploaded on the court’s website on 7 November.
In its order, the court said: “WhatsApp LLC (a Meta company) and other concerned intermediaries are also directed to apprise this Court of the measures they propose to undertake to prevent the digital arrest scams and related cybercrimes.” The platforms must simultaneously submit their proposals to the Indian Cybercrime Coordination Centre, known as I4C. The court said this was the first time it had asked platforms directly for their plans, having previously issued such directions through the government.
Appearing for WhatsApp, senior advocate Kapil Sibal told the bench that the platform had already taken preventive steps, including action against 9,400 accounts linked to digital arrest scams and impersonation of law enforcement agencies. According to a status report filed by the Ministry of Home Affairs in April, those accounts were banned over 12 weeks from January. Sibal said WhatsApp would file an affidavit setting out the steps it had taken.
The court also addressed the responsibility of banks. It said the regulatory measures proposed by the Reserve Bank of India must require financial institutions to indemnify victims of digital arrest scams and other cyber frauds, and to pay compensation of not less than the amount lost by the customer, where it is established that the fraud occurred because the bank failed to exercise due diligence in preventing or reporting it.
The Reserve Bank’s proposed Know Your Customer Amendment Directions, 2026, are to be notified by 30 November and brought into force by 31 December, according to the order. The court said it would first examine the proposed directions before allowing the regulatory process to proceed, and it directed the RBI to submit a list of all authorised financial institutions before the court on the next date of hearing.
The court also directed law enforcement agencies across the states and union territories to submit reports on first information reports related to digital arrest scams, and to suggest strategies for prevention, detection and prosecution. The matter will next be heard on 23 November.
Digital arrest scams, in which fraudsters impersonate police officers, judges or other officials and threaten victims with arrest unless they pay money, have become one of the most damaging forms of cybercrime in India. The Chief Justice noted during the hearing that cybercrimes had declined by 50 per cent, but that victims had still lost Rs 800 crore so far this year.
The court’s directions also touch on a separate requirement for messaging apps. WhatsApp must link each account to the SIM card used to register it by December 2026, under a deadline set by the Department of Telecommunications, with the rules reportedly set to take effect on 1 January 2027. The department first directed WhatsApp, Telegram, Signal and other messaging apps to do this in November 2025.
The order marks a significant escalation in the court’s oversight of both the platforms and the banks. For WhatsApp and the other intermediaries, the task now is to produce a concrete plan that satisfies the court and the I4C. For the banks, the message is that they will be held financially responsible when their lapses allow fraud to succeed — a shift that could reshape how the industry approaches cyber fraud.
