Supreme Court asks WhatsApp and other platforms to list steps against digital arrest scams

A bench led by CJI Surya Kant wants WhatsApp and other intermediaries to say what they will do, with a copy to the I4C. Next hearing 23 November 2026. Safe harbour under section 79, the BNSS rules on arrest and the 1930 helpline explained.

The Supreme Court has asked WhatsApp and the other platforms on which digital arrest scams are run to tell it what they propose to do about them.

In an order passed after the hearing of 29 October 2026, a bench of Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V. Mohana directed WhatsApp LLC and other concerned intermediaries to apprise the Court of their measures against digital arrest scams and related cybercrimes.

The matter is a suo motu case titled In Re: Victims of Digital Arrest Related to Forged Documents. It is next listed on 23 November 2026.

What the order requires of platforms

The platforms must also send their proposals to the Indian Cyber Crime Coordination Centre (I4C), the Union home ministry body that coordinates action on cybercrime. In the words of the order: "They shall also simultaneously submit their proposals to the I4C."

Senior advocate Kapil Sibal, appearing for WhatsApp, told the bench that the company had already acted against about 9,400 accounts. He said WhatsApp would file an affidavit setting out the steps it has taken, and is developing software to identify suspicious accounts and warn users.

Banks, the RBI and the states

The same order turns to financial institutions. The Court said they must be held accountable where a failure of due diligence led to the fraud, and that the Reserve Bank of India (RBI) regulations now proposed must require compensation "not less than the amount lost by the customer" in such cases.

The Chief Justice asked why banks could not step in when a customer suddenly tries to move an unusually large sum that does not fit the account history. He described banks as a "protective umbrella" for vulnerable customers, and suggested pausing suspicious transactions, alerting the nearest police station automatically, and verifying them physically.

The RBI has to submit a list of all authorised financial institutions by the next hearing. The Court will first examine the proposed RBI KYC (Amendment) Directions, 2026, which are meant to be notified by 30 November and made operational by 31 December.

Police in every state and Union Territory must report on the FIRs registered in digital arrest cases and the investigations that followed, with suggestions on prevention, detection and prosecution. The Directors General of Police are to ensure compliance.

The bench noted that cybercrime complaints have fallen by about 50 per cent, yet victims have lost about Rs 800 crore this year.

How the case reached this point

The Court took notice of the problem in October 2025, after a senior citizen couple who had lost their savings to fraudsters using forged court orders brought it to the bench. Other victims came forward later, and the case grew to cover platforms, banks, telecom operators and investigating agencies.

On 4 August 2026 the same bench issued interim directions. The RBI was told to adopt a standard procedure for temporary debit holds on mule accounts within four weeks.

The Ministry of Electronics and Information Technology (MeitY), the Department of Telecommunications and the I4C were asked to examine a time-based kill switch for audio and video calls, after consulting intermediaries.

The August order recorded that complaints on the National Cybercrime Reporting Portal fell from 1,23,672 in 2024 to 58,239 in 2025, and stood at 16,377 up to 30 June 2026. It called the progress appreciable but said continued monitoring remained indispensable.

What the law says on digital arrest

In a digital arrest scam, the caller claims to be from the police, a central agency or a court, accuses the victim of a crime, and keeps the victim on a video call while demanding money to clear the case. No arrest is involved in law.

The Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, has no provision for arrest, custody or bail by video call. Section 43(1) of the BNSS, which replaces section 46 of the Code of Criminal Procedure, says the person making an arrest shall actually touch or confine the body of the person, unless the person submits to custody.

Section 47 requires the person arrested to be told the grounds of arrest and the right to bail, and section 58 bars detention beyond 24 hours without a magistrate.

Where arrest is not required, section 35(3) provides for a written notice to appear before the police. Article 22(1) of the Constitution gives the arrested person the right to know the grounds, to consult a lawyer and to be produced before a magistrate within 24 hours, as M. Laxmikanth sets out in Indian Polity.

Article 21 allows deprivation of liberty only by a procedure established by law, and since Maneka Gandhi v. Union of India (1978) 1 SCC 248 that procedure must be fair, just and reasonable.

The Supreme Court laid down further safeguards in D.K. Basu v. State of West Bengal (1997) 1 SCC 416, including an arrest memo and information to a relative, and in Arnesh Kumar v. State of Bihar (2014) 8 SCC 273, which warned against routine arrests.

Offences the scammers commit

The conduct falls under several laws at once. Section 66C of the Information Technology Act, 2000, punishes fraudulent use of another person's identification feature, and section 66D punishes cheating by personation using a computer resource. Each carries up to three years in prison and a fine of up to Rs 1 lakh.

Under the Bharatiya Nyaya Sanhita (BNS), 2023, the provisions that apply include cheating under section 318, cheating by personation under section 319, and personating a public servant under section 204.

A forged court order or warrant also attracts the forgery provisions in sections 336 and 340, and a demand backed by a threat of arrest can amount to criminal intimidation or extortion.

Safe harbour and the duties of intermediaries

Section 79 of the Information Technology Act gives an intermediary protection from liability for third-party information it hosts or transmits. The protection holds only if the platform merely provides access, does not start the transmission, choose its receiver or alter it, and observes due diligence and the government guidelines.

Under section 79(3)(b), the protection is lost if the intermediary, on receiving actual knowledge or being notified by the government that its resource is being used for an unlawful act, does not expeditiously remove or disable access.

In Shreya Singhal v. Union of India (2015) 5 SCC 1, the Supreme Court read this down so that actual knowledge means a court order or a government notification about acts relatable to Article 19(2).

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 supply the due diligence. Rule 3(1)(b) lists content that users must be told not to post, including content that impersonates another person, and the rules require a grievance redressal mechanism.

Rule 4 adds duties for significant social media intermediaries, including a compliance officer and a contact person for law enforcement. For messaging services it also requires identification of the first originator of a message on a judicial order, a requirement WhatsApp challenged in the Delhi High Court in 2021. The present order does not decide how far these duties extend.

What a person called by scammers should do

The advice from the authorities is to end the call, share nothing and pay nothing, since no agency collects money to close a case. A victim should call the national cybercrime helpline 1930 as soon as possible and report on the National Cyber Crime Reporting Portal at cybercrime.gov.in.

The August order directed states to run the grievance redressal and money restoration modules under the Ministry of Home Affairs procedure of 2 January 2026, so that frozen money can reach victims. The next hearing is on 23 November 2026.