A digital arrest scam begins with a phone call that feels like the worst day of your life. A caller says he is from the CBI, the police, customs or the narcotics bureau, tells you a parcel in your name has drugs in it or your Aadhaar is tied to money laundering, and then moves you onto a video call where you must stay “under arrest” until you pay. Nobody is actually arrested, because there is no such thing as digital arrest in Indian law. Yet people lose their life savings, and the Supreme Court has taken it up on its own motion. In this guide I’ll walk through how the scam works, what the law calls it, what to do in the first hour, whether a bank can be held responsible, and what the Court has ordered so far. I advise people on exactly this kind of problem, so I’ve tried to write what I would tell a family member at 11 at night, not a textbook summary.
How a Digital Arrest Scam Works
The playbook is remarkably consistent. It opens with an accusation: a courier with contraband, a SIM misused for crime, a case against you. Then comes impersonation, with a uniform in the background, official-sounding titles, and forged notices or even fake court orders sent over WhatsApp. The victim is told not to disconnect, not to speak to anyone, and to stay on camera. Isolation is the whole point, because a victim who calls a relative usually breaks the spell in minutes. Finally comes the payment demand, dressed up as a “verification deposit” or a transfer to a “safe RBI account” that will be refunded after the investigation.
The Supreme Court’s own case began this way. In October 2025 the Court took notice after a 73-year-old woman from Ambala wrote to the Chief Justice, saying fraudsters had used a forged Supreme Court order to confine her in a so-called digital arrest and extort more than one crore rupees. The Court observed that faking court orders strikes at the foundation of public trust in the judiciary.
What the Law Calls It
Indian law has no offence called “digital arrest.” Prosecutors work with offences that already exist. The core one is cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023, and where the fraudster pretends to be someone else, cheating by personation under Section 319. Depending on the facts, extortion (Section 308), criminal intimidation (Section 351) and forgery-related offences (such as Section 336 for forged documents) can also apply. On the technology side, Sections 66C and 66D of the Information Technology Act cover identity theft and cheating by personation using a computer resource.
The practical point for victims is that an FIR should cite several of these provisions together, because the facts usually fit more than one. A scam that involves a forged court or agency notice is also more serious than a simple phishing case.
What To Do in the First Hour
Speed matters more than anything else, because stolen money moves through a chain of accounts quickly.
- Stop and hang up. No agency arrests people over video call or asks for money to “verify” innocence.
- Call 1930, the national cyber helpline, as soon as you can. Reports made quickly give the best chance that the receiving account can be frozen before the money is withdrawn.
- Tell your bank, by phone first and then in writing the same day.
- File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in, and then approach the local police or cybercrime cell for an FIR.
- Preserve everything: call logs, screenshots of fake notices, the numbers and accounts you paid, and transaction IDs.
If the receiving account is frozen, the money does not automatically come back to you. The funds sit under police or court control, and you generally need to apply to the Magistrate for release under Section 457 of the Bharatiya Nagarik Suraksha Sanhita. People are often surprised by this step, and a lawyer’s help is genuinely useful here.
Can You Get Your Money Back From the Bank?
This is where the honest answer is “it depends,” and I’d be doing you a disservice with anything more confident.
RBI’s 2017 circular on customer liability protects customers from loss in unauthorised electronic transactions, with zero liability if reported within three working days. A digital arrest case is different, because the victim usually authorises the transfer themselves under deception and fear. So the zero-liability rule does not automatically apply, and anyone telling you it guarantees a refund is overselling it.
A bank can still be answerable where there was a genuine deficiency on its side, for example ignoring obvious red flags on a large unusual transfer, or allowing mule accounts to be opened and operated with weak KYC. Those are fact-specific arguments, and you would raise them through the bank’s grievance process, then the RBI Integrated Ombudsman if the bank does not resolve the complaint, and where appropriate through consumer or civil proceedings.
What is changing is the policy direction. The Supreme Court has questioned why the RBI was not using AI to identify and freeze accounts used by cybercriminals, asked for a framework for compensating victims, and directed the RBI and other agencies to examine delayed-hold mechanisms at the issuing bank. As of today there is no settled rule making banks liable for authorised-push fraud, so treat any liability claim as something to build on the facts of your own case.
The Supreme Court’s Response
The case is In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu Writ Petition (Criminal) No. 3 of 2025, before a bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana. A rough timeline:
- October to November 2025: The Court took suo motu cognisance, issued notice to all states and Union Territories seeking details of FIRs, and noted that much of this fraud originates from offshore locations.
- December 2025: It directed the CBI to carry out a unified pan-India probe, asked states to give consent for CBI investigation, allowed police agencies to freeze accounts used in the fraud, directed IT intermediaries to cooperate, and asked the CBI to seek Interpol assistance.
- February and March 2026: Further interim directions followed, including a standard operating procedure for dealing with these cases in consultation with the RBI, banks and the Department of Telecommunications, and a framework for compensating victims.
- August 2026: The Court issued fresh interim directions covering CBI investigation, opening of new bank accounts, misuse of SIM cards and SIM boxes, intermediary cooperation, grievance redressal and restoration of defrauded money. It recorded that the CBI had registered ten digital arrest cases plus related cases, asked it to examine reducing the existing ₹10-crore threshold and aggregating cases involving the same network, and noted an encouraging decline in reported complaints while stressing that monitoring remains essential.
The unusual feature is that the Court is acting as a coordinator across the CBI, the states, regulators and banks, which says something about how fragmented the response was before.
What Needs to Change in the Law (My Analysis)
These are my views, not holdings of any court. First, the gap in reimbursement for authorised fraud is the biggest one: the law protects customers well against hacking and poorly against being tricked into paying. A clear, graduated liability framework for banks and payment platforms that fail to act on red flags would shift incentives. Second, mule accounts are the choke point, so KYC for new accounts and monitoring of rapid pass-through transfers deserve stricter, auditable standards. Third, SIM boxes and bulk SIM misuse need tougher telecom-side controls. Fourth, cross-border cooperation is slow, and Interpol requests do not move at the speed of a scam. Finally, small losses are the majority of cases and are the least investigated, which is why aggregation of related complaints matters.
If you run a fintech, payments or messaging product, these questions are not abstract. Compliance expectations are tightening across the board, as in our guide to the IT Amendment Rules 2026, and your fraud controls may well be read against the direction the Court is signalling. If you want an assessment of where your platform stands, you can reach out here.
Related Frauds and Where to Read More
Digital arrest sits in a family of impersonation frauds. If the fraudster sent you a cheque that later bounced, that is a different process, covered in our cheque bounce notice guide. If your business was defrauded and personal data was exposed, the obligations in our DPDP Act compliance guide may also apply.
Frequently Asked Questions
1. Is “digital arrest” legal in India?
No. No law allows arrest or detention over a video call. Any caller who claims otherwise is committing fraud.
2. What offences does a digital arrest scam involve?
Typically cheating (BNS Section 318), cheating by personation (Section 319), extortion (Section 308), criminal intimidation (Section 351), forgery-related offences, and IT Act Sections 66C and 66D.
3. What is the first thing I should do if I’ve paid money?
Call 1930 immediately, inform your bank, and file a complaint on cybercrime.gov.in. Speed gives the best chance of freezing the receiving account.
4. Will I automatically get my money back if the account is frozen?
No. Frozen funds stay in custody, and you generally need to apply to the Magistrate for release, usually under Section 457 of the BNSS.
5. Does RBI’s zero-liability rule cover digital arrest losses?
Not automatically. It protects against unauthorised transactions, while in these cases the victim often authorises the payment under deception. Each case depends on its facts.
6. Can a bank be held liable?
Possibly, where there was a deficiency such as ignoring clear red flags or weak KYC on the receiving account. There is no blanket rule yet, though the Supreme Court has asked for a victim compensation framework.
7. What has the Supreme Court ordered?
A unified CBI probe across states, SOPs with the RBI, banks and the Department of Telecommunications, cooperation from intermediaries, measures on new bank accounts and SIM misuse, and steps for restoring defrauded money.
8. Where do I complain if my bank does not help?
Use the bank’s grievance process first, then the RBI Integrated Ombudsman, and consider consulting a lawyer about further proceedings.
9. How can I tell it’s a scam?
Real agencies do not demand money, OTPs or remote access, do not hold people on video calls, and do not send arrest notices over WhatsApp. Hang up and call a relative.
10. Does reporting a scam late kill my case?
You can still file and an FIR can be registered, but the chance of recovering money drops sharply as time passes, which is why the first hour matters.
Conclusion
A digital arrest scam works because it makes a reasonable person stop thinking. The best defence is knowing, in advance, that this is not how any agency operates, and that a call to a family member breaks it. If it happens anyway, act within the first hour, document everything, and expect the recovery process to be slow but not hopeless. The legal framework is still catching up, and the Supreme Court’s monitoring is the main reason the response has become more coordinated.
This article is general information and not legal advice for your specific situation. If you’ve lost money, contact 1930 and the police first.