The Supreme Court has directed WhatsApp and other concerned online intermediaries to explain the steps they propose to take against digital-arrest scams and related cybercrime.

The direction is part of the court’s ongoing suo motu case on victims of digital-arrest fraud involving forged documents. It does not introduce a new WhatsApp feature or an immediate ban on any service. Instead, the court wants platforms to place their anti-scam plans before it and the Indian Cyber Crime Coordination Centre, also known as I4C.

The next hearing is scheduled for November 23, 2026.

What is a digital-arrest scam

A digital-arrest scam is a form of online fraud where criminals pretend to be police officers, CBI personnel, bank officials, courier-company staff or other authorities.

They may contact someone through a phone call, WhatsApp message or video call. The scammer often uses fear to control the victim, claiming that a parcel contains illegal items, a bank account is linked to crime or an arrest warrant has been issued.

The caller may demand that the victim stay on a video call, avoid speaking to family members and transfer money for “verification” or “clearance”. There is no legal process called a digital arrest. Genuine police or government agencies do not demand money through a WhatsApp call to stop an arrest.

What the Supreme Court has asked platforms to do

According to the court direction reported by LiveLaw, WhatsApp and other concerned intermediaries must inform the Supreme Court about measures they propose to prevent digital-arrest scams and connected cyber offences. They must also send their proposals to I4C.

The order does not publicly list a fixed set of actions that WhatsApp must introduce. That means users should not expect every reported measure to appear immediately.

The process is likely to involve platforms explaining how they detect suspicious accounts, respond to complaints, remove scam material and share relevant information with lawful investigations. Any final safeguards will depend on the proposals submitted, court directions and the role of government agencies.

The court has also sought information from financial institutions and law-enforcement agencies. It has stressed that banks should face accountability where fraud occurs because of a proven failure to exercise due diligence.

How this could protect people

Better coordination between messaging platforms, banks, police and I4C could make it easier to identify scam networks and act before money is moved through several accounts.

For example, if a suspicious WhatsApp account is reported by many people, a platform may be able to investigate it quickly. If a victim reports an unauthorised transfer soon after it happens, banks and cybercrime teams may have a better chance of tracing or freezing the money.

Still, technology alone cannot stop every scam. Fraudsters often change phone numbers, fake identities and use psychological pressure. Awareness remains the first layer of protection.

What users should do during a scam call

If someone says you are under digital arrest, stay calm and end the call. Do not share an OTP, bank PIN, card number, Aadhaar details, passwords or screen-sharing access.

Do not transfer money to a “safe account”, even if the person appears to be in uniform on a video call. Save screenshots, phone numbers and payment details if possible.

Report financial fraud immediately through the cybercrime helpline at 1930 or through Cybercrime. The Ministry of Home Affairs says quick reporting can help the system coordinate action to stop funds from being moved further.

Conclusion and key takeaways

The Supreme Court’s order puts fresh focus on the role of messaging platforms, banks and investigators in stopping digital-arrest scams. It is an important accountability step, but the final anti-scam measures are yet to be submitted and assessed.

• WhatsApp and other concerned intermediaries must submit proposed anti-scam measures.
• The proposals must also go to I4C.
• The next Supreme Court hearing is set for November 23, 2026.
• No one can legally “digitally arrest” a person through a WhatsApp call.
• Report online financial fraud quickly at 1930 or cybercrime.gov.in.

Disclaimer

This article provides general information and is not legal, financial or cybersecurity advice. If you believe you are being targeted or have lost money to fraud, contact your bank and report the incident immediately through official channels.

Banks, NBFCs and fintech companies in India have been warned about a rise in AI-powered cyberattacks aimed at stealing money through payment and fund-disbursement systems.

The advisory comes from the Indian Cyber Crime Coordination Centre, or I4C, which works under the Ministry of Home Affairs, along with CERT-In. The warning is mainly for financial institutions, but it also matters to customers because a successful attack on a bank or payment platform can put accounts, transactions and personal data at risk.

The concern is not just fake AI images or chatbot scams. Authorities have flagged attacks where criminals use AI tools to scan systems, identify weaknesses, generate attack scripts and attempt unauthorized fund transfers at very high speed.

What the AI-powered bank attack involves

CERT-In has identified an active financial threat campaign called CRAFTY FALCON. According to the advisory, attackers are using AI-assisted tools to target banks, NBFCs, digital lending companies, payment aggregators, payment-service providers and cryptocurrency exchanges.

The attackers look for familiar security gaps, such as unpatched software, poorly configured cloud systems, exposed credentials and weak payment APIs. An API is the digital connection that allows different software systems to exchange information or process actions, such as checking an account or making a payment.

Once inside, attackers may try to access automated payment or loan-disbursal systems. They can test small transactions first and then attempt larger transfers if they find a weakness. Stolen money may be sent to mule accounts and quickly moved through banking channels to make recovery harder.

AI makes these attacks more dangerous because it can speed up repetitive tasks. Instead of manually checking one system at a time, criminals can use AI tools to scan, adapt and launch multiple attempts quickly.

Why banks and fintech firms are at risk

As per HT report, financial institutions increasingly rely on connected systems for payments, customer verification, lending, cards and digital banking. This improves convenience, but every connected service can create another point that needs protection.

For example, a lending platform may use an API to automatically release an approved loan amount. If an attacker gains access to that API or tricks the system into accepting a false request, money could be sent out without proper approval.

CERT-In has also warned that attacks may be timed for weekends, holidays or other periods when security teams have fewer people monitoring alerts. Some affected organizations were reportedly targeted again after incomplete corrective action.

What banks and fintechs should do

The advisory calls for continuous security monitoring, stronger cloud controls and regular security checks. Financial institutions should separate testing systems from live production systems so that a weakness in a test environment cannot easily lead to a live financial breach.

They should also review payment APIs, remove unused access, protect credentials, apply software updates promptly and use multi-factor authentication for sensitive accounts.

Transaction controls are equally important. Banks can set daily and per-transaction limits, verify beneficiary details, monitor unusual payment patterns and ensure that high-value transfers require the right approvals.

When a serious incident is detected, financial institutions have been asked to report it to CERT-In within six hours. Banks and NBFCs must also report incidents to the Reserve Bank of India through the DAKSH portal within the same time frame.

What customers can do to protect themselves

Customers cannot control a bank’s internal security, but they can reduce the risk of account-level fraud.

Never share OTPs, UPI PINs, card CVV details, passwords or remote-access codes with anyone. A bank employee will not ask for a UPI PIN to reverse a payment or receive money.

Be cautious if you receive a call, video or voice note that appears to come from a bank official, friend or relative. AI can create convincing fake voices and videos. Instead of trusting the incoming call, use the official number on the bank’s website or app to verify the request.

Turn on transaction alerts, review your account activity regularly and act immediately if you notice an unknown debit. Contact your bank through an official channel, call the national cybercrime helpline at 1930 and file a complaint at Cybercrime-portal.