Bank Liability for Digital Arrest Fraud: Mule Accounts, KYC and Victim Compensation

Summary: The growth of digital payments in India has exposed banking customers to sophisticated cyber frauds, including so-called “digital arrest” scams in which criminals impersonate public officials and coerce victims into transferring funds. This research paper examines when a bank may incur regulatory or civil responsibility if accounts under its control are used to receive and circulate fraud proceeds. It focuses on mule accounts, Know Your Customer (KYC) compliance, ongoing transaction monitoring, reporting to the Financial Intelligence Unit–India and the response to suspicious transactions or fraud alerts. The legal analysis covers the Banking Regulation Act, 1949, the Prevention of Money-laundering Act, 2002, the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023, along with RBI customer-protection directions. It distinguishes transactions genuinely unauthorised by the customer from payments initiated under deception or coercion, a distinction that can materially affect refund claims and liability assessments. The Supreme Court’s suo motu proceedings concerning victims of digital-arrest fraud are discussed without treating procedural directions or regulatory drafts as final rules of automatic compensation. The paper argues that a bank should not be liable solely because a criminal has used an account that it maintains. Responsibility should turn on the existence of an applicable duty, evidence of breach, causation and proven loss. It recommends stronger due diligence, coordinated cyber-fraud alerts, proportionate account restrictions, effective reporting, protection of innocent account holders, improved grievance mechanisms and timely victim restitution.

Bank Liability for Digital Arrest Fraud: A Critical Analysis of Due Diligence, Mule Accounts, and Victim Restitution in India

Abstract

The rapid expansion of digital banking and electronic payment systems in India has increased convenience while creating opportunities for sophisticated cyber-enabled financial fraud. One emerging form is “digital arrest” fraud, in which offenders impersonate police officers or other public officials, use fabricated documents and threats, and induce victims to transfer money to accounts controlled by fraudsters. Such accounts may include mule accounts used to receive and move proceeds of fraud.

This paper examines the extent to which banks may be held accountable when failures in customer due diligence, Know Your Customer (KYC) compliance, transaction monitoring, or response to fraud alerts facilitate the movement of stolen funds. It analyses the Prevention of Moneylaundering Act, 2002, the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, and relevant Reserve Bank of India (RBI) directions. It also considers the Supreme Court’s suo motu proceedings in In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu W.P. (Crl.) No. 3/2025, as a significant judicial development.

The paper argues that banks should not be automatically liable merely because a fraudulent payment passes through an account maintained by them. Liability should instead depend on the applicable legal duty, the bank’s conduct, the foreseeability of the risk, and whether the failure materially contributed to the loss. A fair restitution framework should also distinguish unauthorised transactions from payments personally initiated by customers who were deceived or coerced.

Keywords:
Digital arrest fraud; bank liability; mule accounts; KYC; customer due diligence; cybercrime; transaction monitoring; victim restitution; RBI; electronic banking.

1. Introduction

Digital banking, mobile applications, instant payment systems and internet banking have transformed financial services in India. At the same time, these systems can be exploited by organised fraud networks. Digital arrest fraud is a form of social-engineering fraud in which a criminal impersonates an official, alleges that the victim is involved in a criminal investigation, and uses fear, isolation or fabricated legal documents to induce payment.

The term “digital arrest” does not describe a lawful form of arrest. A telephone or video call cannot, by itself, place a person under lawful arrest. Fraudsters may nevertheless create the appearance of official authority and direct victims to transfer money for supposed verification, bail, security or investigation purposes.

The banking system is central to the movement of the money. Fraud proceeds may first enter one account and then pass through several other accounts before withdrawal or conversion. Such accounts are commonly described as mule accounts. The central legal issue is whether, and in what circumstances, a bank’s failure to comply with its regulatory duties can give rise to regulatory, civil or other legal consequences.

This paper focuses on the responsibilities of banks, rather than treating the mere use of a bank account as proof of bank wrongdoing. It also considers the need to preserve funds quickly and provide a practical route to restitution for victims.

2. Statement of the Problem

Digital arrest fraud exposes a gap between the speed of electronic payments and the time often required to identify, report and investigate fraud. By the time a victim contacts a bank or the police, funds may have moved through multiple accounts. The existence of KYC and suspicioustransaction reporting obligations does not necessarily mean that every mule account will be detected in advance.

A further difficulty is the legal distinction between an unauthorised transaction and a payment that the customer personally initiated after being deceived or threatened. Existing customer-protection rules have historically focused significantly on unauthorised electronic banking transactions. A victim who enters an OTP or personally approves a transfer may therefore face disputes about the nature of consent, the bank’s role and the availability of compensation.

The research problem is how Indian law should allocate responsibility among the fraudster, the account holder, the remitting bank, the beneficiary bank, regulators and law-enforcement agencies, while ensuring that innocent account holders are not unfairly penalised.

3. Objectives of the Study

1. To explain the nature and operation of digital arrest fraud in India.

2. To examine banks’ obligations concerning KYC, customer due diligence and transaction monitoring.

3. To analyse the use of mule accounts in receiving and transferring fraud proceeds.

4. To study the relevant statutory and regulatory framework.

5. To examine the Supreme Court’s suo motu proceedings in Suo Motu W.P. (Crl.) No. 3/2025.

6. To evaluate the legal position on customer liability, bank negligence and victim compensation.

7. To identify regulatory and practical gaps and recommend reforms.

4. Research Questions

1. In what circumstances can a bank be held responsible when a mule account is used in digital arrest fraud?

2. What standard of KYC and ongoing due diligence is expected of banks?

3. How should the law distinguish an unauthorised transaction from a payment induced by deception or coercion?

4. What remedies are available to victims seeking to freeze or recover transferred funds?

5. What safeguards can balance rapid fraud prevention with the rights of innocent customers?

5. Research Hypothesis

The study proceeds on the hypothesis that India’s existing legal and regulatory framework provides important tools for preventing and responding to digital financial fraud, but that implementation and restitution remain challenging. Banks should be held accountable where a proven breach of an applicable legal or regulatory duty materially contributes to the loss. However, liability should not be automatic merely because a fraudster used an account maintained by the bank.

6. Research Methodology

This paper adopts a doctrinal and analytical method. It examines legislation, RBI directions, judicial orders, official publications and secondary legal commentary. The analysis is limited to Indian law and focuses on the legal duties of banks and the remedies available to victims. Any draft regulatory instrument is identified as a proposal and not treated as binding law unless it has been finalised and brought into force.

7. Meaning and Nature of Digital Arrest Fraud

Digital arrest fraud is a form of impersonation and social engineering. Offenders may claim to represent the police, CBI, customs, courts or another public authority. They may display forged identity cards, fabricated notices or false case documents through messaging applications and video calls. The victim is told that money must be transferred for verification or to avoid arrest.

The common features include impersonation, false allegations, forged or misleading electronic material, intimidation, urgent demands for payment and the use of bank accounts controlled by the fraud network. Depending on the facts, conduct may attract offences relating to cheating, cheating by personation, forgery, identity theft and cheating by personation using computer resources.

The expression “digital arrest” should be understood as a label used by fraudsters, not as a recognised procedure by which a person is lawfully arrested through a video call.

8. Legal Framework Governing Bank Duties

8.1 Banking Regulation Act, 1949

Section 35A empowers the RBI to issue directions to banking companies in the public interest, in the interest of banking policy, and to prevent banking affairs from being conducted in a manner detrimental to depositors or prejudicial to banking interests. This is an important source of regulatory authority for directions concerning safe banking practices and customer protection.

8.2 Prevention of Money-laundering Act, 2002

Section 12 of the PMLA imposes obligations on reporting entities, including banks, relating to the maintenance of records, furnishing prescribed information and verification of clients’ identities. The Act and its rules support customer identification, record keeping and reporting of prescribed transactions. Banks must comply with applicable requirements for reporting suspicious transactions to the Financial Intelligence Unit–India (FIU-IND).

The presence of a suspicious transaction does not, by itself, prove that the bank committed an offence. The relevant questions include what the bank knew, what it was required to do, whether it complied with the applicable directions and whether any failure contributed to the loss.

8.3 Information Technology Act, 2000

Section 66C addresses identity theft. Section 66D addresses cheating by personation using a computer resource or communication device. Section 43 concerns specified unauthorised acts involving computer systems, while section 75 provides for extra-territorial application in specified circumstances. These provisions may be relevant to the conduct of offenders; they do not independently create automatic compensation liability for a bank.

8.4 Bharatiya Nyaya Sanhita, 2023

Depending on the facts, section 318 (cheating), section 319 (cheating by personation), section 336 (forgery) and section 340 (forged document or electronic record and using it as genuine) may be relevant. The precise charge depends on the evidence and the role of each accused person.

Criminal liability of a fraudster, regulatory liability of a bank and civil liability to compensate a victim are distinct legal questions and must be analysed separately.

9. Bank’s Duty of Due Diligence

Due diligence means the care and verification required by law and applicable regulatory directions when a bank opens and maintains an account and processes transactions.

9.1 Know Your Customer (KYC)

The RBI’s Master Direction – Know Your Customer (KYC) Direction, 2016, as amended from time to time, sets out customer identification and due-diligence requirements for regulated entities. Banks are expected to identify customers, verify prescribed information, understand the nature of the customer relationship and conduct ongoing due diligence in accordance with the risk-based framework.

9.2 Ongoing transaction monitoring

KYC is not limited to collecting documents at the time of account opening. Banks must apply the monitoring and review measures required by applicable directions. Transactions inconsistent with a customer’s known profile, unusual patterns and other risk indicators may call for scrutiny. No single indicator automatically proves fraud; a risk-based assessment is required.

9.3 Suspicious transaction reporting

Where the legal reporting threshold and criteria are met, banks must submit suspicious transaction reports to FIU-IND in accordance with the applicable framework. Reporting obligations must be followed without improperly alerting the customer where the law prohibits such disclosure.

9.4 Response to fraud complaints

When a bank receives a credible report of fraud, it should act promptly within the powers and procedures available to it, preserve relevant records, coordinate with the relevant payment-system participants and law-enforcement authorities, and communicate clearly with the customer. The precise steps depend on the payment system, the applicable RBI directions and lawful instructions from competent authorities.

10. Mule Accounts and Their Role

A mule account is an account used to receive, hold or transfer funds connected with unlawful activity. The account may be controlled by a willing participant, a person recruited through a false job or commission offer, or an innocent person whose identity or account has been misused.

For illustration, a victim deceived into transferring ₹10 lakh may send the amount to Account A. The money may then be divided or transferred to Accounts B and C before being withdrawn. Multiple transfers can complicate tracing and recovery.

Banks have an important role in preventing misuse through customer due diligence, ongoing monitoring, appropriate risk controls and reporting. However, the mere fact that a mule account exists does not establish bank negligence. Liability requires examination of the bank’s actual duties, the information available to it, its response and the connection between any breach and the loss.

A fair framework must also distinguish a knowing mule-account operator from a person whose account was used without knowledge or consent. Both criminal investigation and account restrictions should be evidence-based and subject to appropriate review.

11. Supreme Court’s Suo Motu Proceedings

In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu W.P. (Crl.) No. 3/2025, is an important judicial development concerning digital arrest fraud and the institutional response to it.

The proceedings raise issues involving impersonation, forged documents, the use of bank accounts to move fraud proceeds, coordination between banks and investigating agencies, and protection of victims. The orders in the proceedings should be read in their exact procedural context. Directions to regulators to prepare or consider a framework are not necessarily equivalent to a final judgment imposing automatic liability on every bank in every fraud case.

For the final version of this paper, the researcher should obtain and cite the official Supreme Court orders, including the order dates, paragraphs and operative directions. In particular, any discussion of proposed compensation, debit holds or standard operating procedures should quote the exact direction and distinguish it from a proposal made by a party or regulator.

The significance of the proceedings lies in the recognition that digital arrest fraud cannot be addressed solely by prosecuting individual offenders. The banking system, regulators, lawenforcement agencies and digital intermediaries may each have responsibilities within their respective legal powers.

12. RBI Regulatory Framework

The RBI’s KYC directions and customer-protection directions are central to this topic. The Master Direction – KYC Direction, 2016, as amended, provides the framework for customer identification and due diligence. The RBI’s 6 July 2017 circular on customer protection – limiting liability of customers in unauthorised electronic banking transactions – sets out principles for allocating liability in specified unauthorised-transaction situations.

A key analytical difficulty is that digital arrest victims may personally authorise a transfer after being deceived or coerced. The applicable customer-protection rules must therefore be read carefully; it is unsafe to assume that every scam-induced payment automatically falls within the same category as an unauthorised transaction.

Any 2026 RBI draft amendments or proposed standard operating procedures concerning mule accounts or coerced payments should be described as drafts unless officially finalised and brought into force. The final paper should verify the latest RBI notification and effective date immediately before submission.

13. Legal Liability of Banks

Bank liability may arise through different routes, depending on the facts and applicable law.

13.1 Regulatory responsibility

A bank may face supervisory or regulatory consequences if it fails

to comply with binding RBI directions or statutory obligations.

13.2 Civil liability

A victim may seek civil remedies where the elements of a recognised cause of

action are established, including duty, breach, causation and loss. The victim must establish the relevant legal basis; the existence of fraud alone does not prove the bank’s negligence.

13.3 Employee misconduct

If an employee knowingly assists a fraud or deliberately violates

mandatory procedures, individual disciplinary or criminal consequences may arise. The institution’s responsibility must be assessed under applicable law and on the evidence.

13.4 Causation

A central question is whether the bank’s failure materially contributed to the loss.

For example, it may be relevant whether a bank ignored a legally significant warning or failed to perform a required verification. Conversely, a bank is not necessarily liable simply because a fraudster successfully deceived a customer and used an account at that bank.

13.5 Authorised and unauthorised transactions

An unauthorised transaction is one not approved

by the customer. A scam-induced transfer may be personally initiated by the customer but prompted by deception or coercion. This distinction matters when applying RBI customer-liability rules and assessing other legal remedies.

14. Victim Restitution and Compensation

Restitution aims to restore money or provide compensation to a person who has suffered loss. The immediate priority in a cyber-fraud case is often to report the transaction quickly so that relevant institutions and authorities can attempt to preserve funds that have not yet moved onward.

Victims should promptly inform their bank and report the incident through the National Cyber Crime Reporting Portal or the relevant cybercrime helpline and police channel. They should preserve transaction references, bank statements, messages, call details and any documents used by the fraudster. These steps do not guarantee recovery, but they can assist tracing and investigation.

Freezing or placing a hold on funds must be done under the applicable legal and procedural framework. It should be proportionate, reviewable and respectful of the rights of innocent account holders. Where funds are recovered, the process for returning them should be transparent and timely.

Compensation should be based on clear legal standards. Relevant factors may include whether the transaction was unauthorised, whether the customer reported it promptly, whether the bank

complied with its duties, whether a third-party breach occurred, and whether the bank’s failure caused or increased the loss. A dedicated and time-bound grievance process would improve access to remedies.

15. Critical Analysis

First, formal KYC compliance does not necessarily prevent all mule-account activity. Banks must implement ongoing, risk-based monitoring, but the standard should remain practical and proportionate.

Second, the distinction between unauthorised payments and payments induced by deception creates uncertainty for victims. The law and regulatory directions should explain how coercion and social engineering are to be assessed, without treating every customer-approved payment as automatically voluntary in the meaningful legal sense.

Third, rapid transfers make recovery difficult. A coordinated response among the remitting bank, beneficiary bank, payment-system participants and law-enforcement agencies is essential.

Fourth, overbroad account freezes may harm innocent customers. A person whose account has been misused should have access to prompt notice, a review process and a route to challenge restrictions, subject to lawful investigative requirements.

Finally, compensation must be linked to a clear basis of responsibility. Automatic bank liability for every scam would be difficult to justify, but a system that leaves victims without a practical remedy when a bank’s proven regulatory failure contributed to the loss would also be inadequate.

16. Suggestions and Recommendations

1. Strengthen implementation and audit of KYC and ongoing due-diligence requirements.

2. Improve risk-based monitoring for unusual account activity while avoiding assumptions based on a single transaction.

3. Establish rapid, secure channels for banks to respond to verified cyber-fraud alerts.

4. Provide clear procedures for temporary debit restrictions, review, release and victim claims.

5. Clarify the treatment of payments induced by impersonation, coercion or deception under customer-protection rules.

6. Create a transparent, time-bound bank grievance and compensation process.

7. Protect innocent account holders through prompt review and an opportunity to challenge restrictions.

8. Improve coordination among RBI, banks, FIU-IND, police and cybercrime authorities.

9. Require preservation of relevant transaction and communication records in accordance with law.

10. Conduct public-awareness programmes explaining that legitimate law-enforcement authorities do not demand transfers to private accounts for “verification” or to avoid arrest.

17. Conclusion

Digital arrest fraud is a serious challenge to financial consumer protection and confidence in digital banking. Mule accounts provide channels through which fraud proceeds can be received and moved, making effective due diligence and prompt response important. Banks have statutory and regulatory responsibilities concerning customer identification, record keeping, transaction monitoring and suspicious-transaction reporting.

Nevertheless, bank liability should not be automatic. It should be assessed by identifying the applicable duty, determining whether the bank breached that duty, examining causation and considering the evidence. The legal position must also distinguish unauthorised transactions from payments made by customers who were deceived or coerced.

The Supreme Court’s suo motu proceedings provide an important judicial setting for examining institutional accountability and victim protection. Their precise directions, together with the current status of RBI regulations and any draft amendments, must be verified from official documents before final submission.

A secure digital banking system must do more than enable fast payments. It must also provide effective safeguards, prompt cooperation when fraud is reported, fair treatment of innocent account holders and meaningful remedies for victims where legal responsibility is established.

18. Bibliography and Primary Sources

Legislation

1. Constitution of India, 1950.

2. Banking Regulation Act, 1949.

3. Prevention of Money-laundering Act, 2002.

4. Information Technology Act, 2000.

5. Bharatiya Nyaya Sanhita, 2023.

6. Payment and Settlement Systems Act, 2007.

Regulatory materials

1. Reserve Bank of India, Master Direction – Know Your Customer (KYC) Direction, 2016, as amended.

2. Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017.

3. Any final RBI directions or notifications on mule accounts and customer protection in force as at the date of submission. Drafts should be identified expressly as drafts.

Judicial material

1. In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu W.P. (Crl.) No. 3/2025, Supreme Court of India. Cite each order by its official date and paragraph number after consulting the official copy.

Author: Kaviyarasi S. | Co-Author: Deepak Chandar S. | Institution: Vinayak Mission Law School, Vinayak Mission Research Foundation