India's Supreme Court Orders WhatsApp to Submit Anti-Scam Plan to I4C

By Rebecca Stone

India's Supreme Court has, for the first time, directed WhatsApp LLC and other intermediaries to submit their own proposals for stopping digital arrest scams directly to the court and the Indian Cyber Crime Coordination Centre (I4C). The order, passed on October 29 and uploaded on November 7, breaks with precedent. Earlier directions on platform safeguards went through the government.

"WhatsApp LLC (A Meta Company) and other concerned intermediaries are also directed to apprise this Court of the measures they propose to undertake to prevent the digital arrest scams and related cybercrimes," the court said in its order.

A bench of Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V Mohana issued the direction in a suo motu case. The next hearing is set for November 23.

What are digital arrest scams?

Fraudsters pose as police or government officials, often over video calls, and pressure victims into transferring money. Chief Justice Kant called these scams "the biggest financial fraud on the economy of the country" at the hearing.

What has WhatsApp done so far?

A status report filed by the Ministry of Home Affairs (MHA) in April put numbers on enforcement. WhatsApp banned roughly 9,400 accounts linked to these scams over 12 weeks from January.

The government flagged about 3,800 accounts for WhatsApp's review under Section 79(3)(b) of the IT Act. Only 17 of them involved digital arrests. The report did not explain how either figure was derived.

WhatsApp told an Inter-Departmental Committee it used each government flag as a starting point to find related accounts. Its detection tools include:

• Logo detection
• A tool based on a large language model (LLM)
• Display-name logging

What is the government doing?

In August, the court asked the Ministry of Electronics and Information Technology (MeitY), the Department of Telecommunications (DoT) and the I4C to study time limits on audio and video calls. The Centre has told the court it is developing software to flag accounts impersonating government agencies. In 2024, it blocked more than 59,000 WhatsApp accounts and 1,700 Skype IDs linked to digital arrests.

What is the SIM binding deadline?

WhatsApp must link each account to the SIM card used to register it by December 2026, under a deadline the DoT extended. The rules are reportedly set to take effect on January 1, 2027. WhatsApp has said it is developing the feature.

The DoT first directed WhatsApp, Telegram, Signal and other messaging apps to comply in November 2025. The apps must also log out web users at least every six hours.

What did the court say about banks?

At the same hearing, the bench ruled that banks must fully compensate victims when their lapses enable the fraud. The RBI's regulatory measures must "require financial institutions to indemnify victims of digital arrest scams and other cyber frauds and pay suitable compensation not less than the amount lost by the customer," where the fraud occurred due to the institution's failure of due diligence.

"We will put up a strict liability on the financial institutions," Justice Bagchi said during the hearing.

The court listed safeguards banks must follow:

• Hold suspicious transactions: Temporarily suspend transactions that do not match an account's history.
• Alert the police: Automatically report such transactions to the nearest police station.
• Verify: Physically check the reported transactions to confirm they are genuine.

The RBI must also submit a list of all authorised financial institutions at the next hearing.

When do the mule account rules arrive?

The RBI plans to notify its Know Your Customer (KYC) Amendment Directions, 2026 by November 30 and bring them into force by December 31. The court will examine these rules before issuing its own directions.

The RBI's September draft proposed April 1, 2027 as the implementation date. It requires banks to place temporary holds of up to 60 days on suspected mule accounts and on flagged transactions of Rs 1,000 or more.

What else did the court order?

• Police: Law enforcement agencies in all states and Union Territories must report the status of digital arrest FIRs and investigations, and suggest ways to prevent, detect and prosecute these crimes. Directors General of Police must ensure compliance and share the information with the I4C.
• Expert inputs: The court will consider suggestions from amicus curiae N S Nappinai, who filed a note on October 14, and from Attorney General R Venkataramani, who filed one on October 28.

Why it matters

These scams usually start on messaging and calling apps, but the burden of compensation has so far fallen on banks. WhatsApp's response will signal what additional safeguards platforms may propose voluntarily.

Three questions remain open:

• Will WhatsApp's plan go beyond account bans and the SIM binding the DoT already requires?
• WhatsApp has not disclosed how it identifies scam accounts. Will the court or the I4C demand disclosure?
• In August, the court asked an inter-departmental committee to examine a shared liability framework for victim compensation. Will that framework cover platforms, or only banks?