The Digital Arrest Explainer: Legal Fiction, Mule Accounts, and Coercive Fraud

In a hearing on 29 October 2026, the Supreme Court of India addressed one of the most financially devastating fraud phenomena in the country: the so-called digital arrest scam. A three-judge Bench comprising Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana expressed grave concern over the hundreds of crores of rupees siphoned from domestic household savings every year through orchestrated phone and video calls. The apex court called on the Reserve Bank of India to introduce regulatory provisions that would make commercial banks fully indemnify victims whenever institutional lapses or a failure of due diligence allow these crimes to succeed.

Data submitted to the court by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs reveals the sheer scale of the menace. Complaints registered on the National Cyber Crime Reporting Portal rose sharply from 39,925 in 2022 to a peak of 1,23,672 in 2024, causing reported financial losses of approximately Rs. 1,935 crore in that single year. While enforcement measures and awareness campaigns brought recorded complaints down to 58,239 in 2025, the fraud has proven stubbornly resilient. Between January and August 2026, an additional 21,928 complaints were lodged, representing losses exceeding Rs. 647 crore, with cumulative siphoned amounts crossing Rs. 800 crore by late October 2026.

Despite repeated public warnings, affluent professionals, retired civil servants, doctors, and senior citizens continue to liquidate fixed deposits, mutual fund units, and life savings under the instructions of cybercriminals. Understanding why this happens requires unpacking the psychological architecture of coercive fraud, the non-existence of digital arrests in Indian criminal law, the mechanics of mule account networks, and the evolving regulatory obligations of the banking sector.

The Legal Fiction: Why Digital Arrest Does Not Exist

The most fundamental fact for every investor to recognize is that the term digital arrest is an absolute legal fiction. There is no provision in the Bharatiya Nagarik Suraksha Sanhita, the Code of Criminal Procedure, the Information Technology Act, or any Indian statute that permits law enforcement agencies to detain, arrest, or interrogate any citizen over a mobile phone or video call.

Statutory arrest procedures in India require physical custody, the production of an arrest memo, identification of the arresting officer, immediate communication of the grounds of arrest, intimation to a nominated relative, and physical production before an authorized magistrate within 24 hours. When an investigative agency—whether a state police department, the Central Bureau of Investigation, the Enforcement Directorate, the National Investigation Agency, or the Directorate of Revenue Intelligence—seeks information from an individual, it must issue a formal written summon under the appropriate statutory section.

Furthermore, no judicial authority or investigative agency operates an online court via consumer messaging platforms, nor do they conduct video interrogations where a citizen is forbidden from disconnecting or consulting a lawyer. Most crucially, no Indian agency, regulator, or court has any legal framework requiring a citizen to transfer personal savings into a designated government account, clearing account, or verification escrow to prove the legitimacy of their funds or to establish their innocence. Any demand to transfer money to avoid custody is, by statutory definition, an extortion attempt.

The Social Engineering Playbook: Authority Bias and Cognitive Isolation

A frequent question raised in public discussions—and reiterated during the Supreme Court proceedings—is how well-educated, financially comfortable individuals fall for such deception. The explanation lies in sophisticated behavioural manipulation rather than technical illiteracy. Fraud networks rely on four calculated psychological levers:

First, they exploit authority bias and procedural realism. Scammers typically initiate contact via an automated voice prompt or message alleging that an illegal parcel containing narcotics, forged passports, or contraband has been intercepted in the victim's name by customs authorities. When the victim denies sending the parcel, the caller feigns assistance and offers to transfer the matter to an official police desk to log an identity theft complaint. The subsequent video call features operators dressed in accurate police uniforms, seated against backdrops displaying real police emblems, official-looking dispatch logs, and live walkie-talkie audio.

Second, the criminals deploy legal intimidation. They present forged documents stamped with fabricated logos of the Supreme Court, the Enforcement Directorate, or the Reserve Bank of India, alleging that the victim's Permanent Account Number or Aadhaar card is tied to multi-crore money laundering rackets or terror financing syndicates.

Third, they enforce cognitive isolation. The victim is informed that the case falls under national security regulations and that disclosing the call to family members, friends, or advisers constitutes a non-bailable offence. Fraudsters demand that the camera remain turned on continuously, maintaining surveillance over the victim for anywhere from twelve hours to several days. This sleep deprivation and prolonged psychological distress sever the individual's rational evaluation mechanisms.

Fourth, they introduce a fraudulent resolution. Once the victim is completely overwhelmed, the operators propose a mock verification process. They claim that the Supreme Court or the central bank requires an immediate financial audit. The victim is instructed to break cumulative deposits, redeem mutual fund holdings, and transfer all available liquid capital into RBI-monitored accounts for verification, with a solemn promise that the entire amount will be refunded within two hours once cleared.

The Financial Plumbing: Mule Accounts and the Layering Process

When a victim authorises these transactions, the money does not go directly to an offshore criminal syndicate. It enters the domestic banking system through a vast network of mule accounts.

A mule account is a legitimate commercial bank account used by criminal syndicates to receive, pool, and instantly disperse illicit funds. These accounts typically fall into two categories: co-opted accounts belonging to low-income individuals who have handed over their net banking credentials and debit cards in exchange for small cash payments, or accounts created through forged and manipulated Know Your Customer documentation. In some cases highlighted by investigative agencies, rogue employees inside commercial bank branches have aided in opening accounts without carrying out mandatory face-to-face checks.

The operational success of digital arrest syndicates depends on the speed of Indian digital payment rails, including the Real Time Gross Settlement, National Electronic Funds Transfer, and Immediate Payment Service channels. The moment the coerced victim transfers Rs. 50 lakh or Rs. 1 crore from their primary bank account, automated algorithms operated by the scam syndicate split the incoming funds into dozens of smaller tranches across second-tier mule accounts.

Within minutes, these secondary tranches are fragmented further across third-tier accounts and withdrawn as cash through automated teller machines in multiple cities, or converted into digital assets via peer-to-peer cryptocurrency platforms, or funneled into overseas hawala channels. By the time the victim breaks out of their psychological isolation and approaches the authorities, the initial deposit has been dispersed across dozens of institutions, making physical fund recovery exceptionally difficult.

The Regulatory Blind Spot: Coerced Transfers vs Unauthorized Hacking

The reason the Supreme Court has intervened so forcefully stems from a legal gap in existing retail banking regulations. Under the Reserve Bank of India circular issued in July 2017 regarding the limiting of customer liability in unauthorized electronic banking transactions, bank account holders enjoy zero liability if fraud occurs due to contributory negligence by the bank, or third-party breaches where the customer reports the unauthorized transaction within three working days.

However, that 2017 framework was designed around unauthorized transactions—cases where fraudsters steal login credentials, clone cards, or intercept one-time passwords without the customer's knowledge. In a digital arrest fraud, the transfer is classified under banking law as an authorized push payment. The victim personally logs into their net banking portal, selects the beneficiary, enters the required authentication codes, and confirms the debit.

Historically, banks have used this distinction to deny compensation, arguing that because the customer authorized the payment, the institution bore no financial liability. The Supreme Court has challenged this stance, pointing out that banks possess extensive transaction monitoring data. When an elderly account holder who has maintained modest, steady balances for decades suddenly liquidates multi-year deposits and initiates multiple high-value transfers to newly opened accounts in remote locations, banks cannot remain passive conduits. The court maintained that failure to detect and temporarily halt uncharacteristic transactions constitutes a fundamental breakdown in institutional due diligence.

During the 29 October hearing, the Attorney General of India informed the Bench that the Reserve Bank of India is in the process of finalizing the proposed RBI Know Your Customer Amendment Directions, 2026. These regulations, scheduled to be notified by 30 November and operationalized by 31 December 2026, will establish stricter monitoring protocols, requiring financial institutions to detect anomalous transactional patterns and implement temporary debit holds on suspected mule accounts.

A Practical Defense Framework for Capital Preservation

For investors managing wealth, preserving capital requires treating cybersecurity and operational awareness as essential components of portfolio risk management. The following principles serve as durable safeguards against coercive cyber extortion:

• Unconditional termination of calls: If any caller claims to be a law enforcement officer, customs official, or judicial authority demanding money, the only appropriate response is to immediately disconnect. Legitimate agencies never communicate arrest warrants or initiate criminal interrogations over video platforms.
• Independent verification: If concerns persist regarding whether an identity has been misused, the account holder must contact the nearest local police station or check the official, independently sourced helpline of the relevant agency. Contact numbers provided by the caller or displayed in messaging profiles must never be relied upon.
• The Golden Hour protocol: If funds have been transferred under coercion, the single most critical factor in recovery is speed. The incident must be reported immediately to the National Cybercrime Reporting Portal by dialing 1930 or filing a complaint on the official portal (cybercrime.gov.in). Providing the Unique Transaction Reference numbers within the first two hours allows cyber cells to issue immediate debit freeze alerts across the receiving banks, halting the dispersion of money before mule account holders withdraw it.
• Portfolio friction as security: Investors maintaining substantial liquid assets in savings accounts or short-term deposits should consider introducing operational barriers, such as maintaining lower default online transfer limits, avoiding single-point digital access to all household savings, and involving a trusted distributor or family co-signatory for large liquidations.

The judicial push toward mandatory bank indemnification marks a crucial turning point in Indian financial consumer protection. Nevertheless, regulatory compensation frameworks take months to adjudicate. For ordinary savers, the primary line of defence remains an unwavering rule of personal finance: no legitimate institution on earth will ever arrest an individual over a screen, and no statutory authority will ever ask an innocent citizen to pay money to prove their innocence.