--- title: "Supreme Court: RBI rules due by 30 November must make banks at fault repay fraud victims" summary: "The Supreme Court order of 29 October, uploaded on 7 November: what it tells the RBI to write into its rules, what it does not order banks to pay now, and the dates to watch." url: https://www.thetechbag.com/blog/supreme-court-rbi-bank-refunds-cyber-fraud-30-november format: Note desk: "Security" area: "Risk & compliance" region: India published: 2026-11-11 facts_checked: 2026-11-11 author: TechBag (The TechBag Journal) tags: ["digital arrest refund","bank refund cyber fraud India","Supreme Court digital arrest","RBI cyber fraud rules","Supreme Court","RBI","digital arrest","cyber fraud","customer liability","compensation","KYC Amendment Directions","money mule accounts","temporary debit hold","WhatsApp","I4C","BFSI"] cover: https://www.thetechbag.com/blog/covers/supreme-court-rbi-bank-refunds-cyber-fraud-30-november.png --- # Supreme Court: RBI rules due by 30 November must make banks at fault repay fraud victims *The Supreme Court order of 29 October, uploaded on 7 November: what it tells the RBI to write into its rules, what it does not order banks to pay now, and the dates to watch.* Note · Security · Risk & compliance · By TechBag · Published 2026-11-11 · Facts checked 2026-11-11 · Canonical: https://www.thetechbag.com/blog/supreme-court-rbi-bank-refunds-cyber-fraud-30-november The Supreme Court has told the Reserve Bank of India (RBI) that its new rules must require banks and other financial institutions to pay victims of digital-arrest scams and other cyber frauds compensation “not less than the amount lost by the customer”, where it is established that the fraud happened because the institution failed to exercise due diligence in preventing or reporting it.[1] The order, passed on 29 October and uploaded on 7 November, records that the RBI’s Know Your Customer (KYC) Amendment Directions are to be notified by 30 November and in force by 31 December. The next hearing is on 23 November.[1][2] **Figure: Rules the RBI drafted for April 2027 are now to take effect by 31 December** *Dated steps in the Supreme Court's digital-arrest case and the RBI's rules, August to December 2026* | Date | Event | Detail | | --- | --- | --- | | 4 Aug 2026 | Court orders an RBI procedure on mule accounts | | | 11 Sept 2026 | RBI publishes its draft | Start date 1 April 2027 | | 29 Oct 2026 | Hearing and order | | | 7 Nov 2026 | Order uploaded | | | 23 Nov 2026 | Next hearing | | | 30 Nov 2026 | RBI to notify the Directions | | | 31 Dec 2026 | Directions to be in force | | Source: Supreme Court record of proceedings, 29 October 2026; RBI press release, 11 September 2026 · as of 11 November 2026 · The last three dates are scheduled, not yet reached ## A direction to the regulator, not a refund order The compensation paragraph opens “We reiterate and emphasize”: it tells the RBI what its rules must contain. It does not order any bank to pay any victim now, and it sets no amount in any case. The court said it would, “in the first instance”, examine the RBI’s Directions before issuing its own.[1] It also listed safeguards it wants required of every institution: temporarily suspending transactions out of line with an account’s history, automatically informing the nearest police station, and physically verifying them.[1] The RBI must file a list of all authorised financial institutions at the next hearing. Police chiefs in every state and union territory must report the status of digital-arrest cases and investigations, with copies to the Indian Cyber Crime Coordination Centre (I4C). WhatsApp LLC and “other concerned intermediaries” must tell the court what they propose to do to prevent these scams.[1] MediaNama reports that this is the first time the court has asked platforms directly rather than through the government.[2] ## What today's rule covers, and what the draft adds The RBI’s 2017 circular already gives a customer zero liability for an unauthorised electronic transaction caused by the bank’s “contributory fraud/ negligence/ deficiency”, and makes the bank credit the money within 10 working days of being told. Where a customer shared payment credentials, the customer bears the loss until reporting it.[3] In a digital-arrest scam, people posing as officials pressure the victim into making the transfer, and MediaNama notes that the circular does not address payments a customer authorises after being deceived.[4] The draft published on 11 September answers a different order, of 4 August, on mule accounts that receive stolen money.[5] A bank’s systems, “including AI / ML-based tools”, flag a transaction of ₹1,000 or more; the bank puts a hold on it at once; the holder has 20 days to explain; and absent a police instruction the hold lasts at most 60 days. As drafted, it takes effect on 1 April 2027.[6] TechBag countNo compensation clause in the draft We searched the draft’s full text: “compensation”, “indemnify” and “victim” do not appear. The court’s principle would be new text, and the version due by 30 November has not been published.[6] Our viewWhat to check on 30 November Whether the notified Directions carry the compensation wording and the three safeguards, who decides that a bank failed in due diligence, and whether the ₹1,000 floor and 60-day hold survive. Until then, the 2017 rule decides refunds for unauthorised transactions, and how fast a customer reports can decide how much of a loss is theirs. How we did this Figures as of 11 November 2026, 8pm IST The directions and dates are from the 13-page record of proceedings, digitally signed on 7 November, in the copy MediaNama published; the “first time” reading is MediaNama’s. The 4 August order is as the RBI’s press release describes it. The draft and the 2017 circular were read on rbi.org.in. The search for absent words is ours, on the draft as published in September; the final Directions may differ. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Supreme Court of India, record of proceedings, SMW(Crl) No. 3/2025, In Re: Victims of Digital Arrest Related to Forged Documents (copy hosted by MediaNama)](https://www.medianama.com/wp-content/uploads/2026/11/5976920252026-10-29-710711.pdf) — 29 October 2026, signed 7 November 2026 2. [MediaNama, Supreme Court asks WhatsApp to propose measures to stop digital arrest scams](https://www.medianama.com/2026/11/223-supreme-court-whatsapp-digital-arrest/) — 11 November 2026 3. [Reserve Bank of India, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2017-18/15)](https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=11040) — 6 July 2017 4. [MediaNama, SC says RBI rules must make banks fully compensate digital arrest victims if banks fail due diligence](https://www.medianama.com/2026/10/223-sc-rbi-banks-compensate-digital-arrest-victims/) — 30 October 2026 5. [Reserve Bank of India, press release: RBI invites comments on the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026](https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=63587) — 11 September 2026 6. [Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026](https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=5170) — 11 September 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [Your bank password, your liability: 3 US banks put AI-agent losses on you](https://www.thetechbag.com/blog/banks-ai-agents-your-password-your-liability) — Who carries the loss in the US: three banks put losses from AI agents using a customer’s password on the customer. Go deeper on TechBag - [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the rules an Indian bank already runs, in one place - [Spandana Sphoorty: ₹7.80 crore debited to 82 accounts in a day](https://www.thetechbag.com/blog/spandana-sphoorty-7-80-crore-cyber-fraud) — a lender’s own filing on unauthorised debits - [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — the monitoring behind flagging a transaction out of line with an account’s history