WhatsApp may block devices linked to digital arrests: Center tells SC

WhatsApp has agreed to study the feasibility of blocking device identifiers – not just accounts – linked to digital arrests, the Union government told the Supreme Court, even as the Center sought judicial support for a coordinated national framework involving banks, telecom regulators and investigation agencies to combat the rapidly expanding fraud.

A bench led by Chief Justice of India Surya Kant is scheduled to consider the status report submitted by the Home Ministry on May 12. The report outlines enforcement measures across four fronts – platform accountability, bank guarantees, SIM tracing, and the legal framework for victim compensation – marking a significant escalation since the court set up an inter-departmental committee (IDC) in December to tackle the fraud epidemic.

The International Data Commission, which was formed on December 26, decided at its first meeting that victims should not bear losses attributable to negligence by banks, telecommunications service providers or other regulated entities. The court took suo motu cognizance on October 17 after a 73-year-old Ambala woman wrote that fraudsters posing as CBI officials used fake orders from the Supreme Court to force her to transfer ownership of the property. $1 Crore.

Read also | WhatsApp has banned 9,400 accounts involved in digital arrest scams since January this year: Center to SC

The platform also agreed to consider retaining data on deleted accounts for a minimum of 180 days, as required under IT rules, to help law enforcement trace digital footprints in cases where accounts are quickly deleted following fraud.

Over a 12-week period starting in January, WhatsApp blocked more than 9,400 accounts linked to digital arrest scams in India, based on inputs from I4C, MeitY and the Telecom Department, the Center submitted in court.

Its internal investigation traced a large proportion of fraudulent accounts to organized fraud hubs in Southeast Asia, especially Cambodia, where perpetrators used display names such as “Delhi Police,” “CBI,” or “ATS Department” along with official insignia.

WhatsApp said it has deployed logo matching systems to identify impersonation, account display names, and large language models trained to detect sophisticated fraud patterns. Product-level interventions include warnings about suspicious first-time messages, account age visibility for unknown contacts, and suppression of profile photos in high-risk interactions. The center’s report stated that these measures are expected to lead to a “material and noticeable decrease” in these fraudulent operations.

The Center stressed that such measures may eventually need to be standardized across platforms, suggesting a broader regulatory framework for mediation obligations in cyber fraud cases.

These are “reasonable measures aimed at solving a real problem, but the way forward is to reshape how platform obligations are defined in India,” said Somesh Srivastava, partner at public policy firm The Quantum Hub. He said compliance obligations of this kind were usually the product of consultation, rule-making and parliamentary oversight. “Anchoring it instead in undertakings made before the Supreme Court collapses that process and transforms platform management from a regulatory to a litigation-based exercise.” He added that it also creates an asymmetry, as the commitments made by the largest platforms become the de facto standard for an ecosystem that is never consulted. “The capability that is being created, especially around device-level blocking, will outlast this particular issue.”

The SOP stipulates time-bound coordination between banks to track the transfer of funds through fictitious accounts, priority recovery protocols for fraudulent refunds, and automated red alert systems – which may use artificial intelligence – to detect abnormal transaction behaviour. The Center wants uniform enforcement across the country, arguing that disparate practices undermine the effectiveness of fighting fraud.

Regarding the unresolved PMLA question, the status report asks the court to direct the Department of Revenue to expedite examination of the use of Section 12AA for cyber fraud and digital arrest-related transactions, and to establish the required rules.

Meghna Pal, director of the Isia Center, a technology policy think tank, said platforms should be allowed to innovate in solving scams because they are “much closer to the problem and have a much better understanding of it than any authority or government agency.” She cautioned that the focus on biometric linkage risks excluding people whose biometrics cannot be captured reliably — such as those who work in heavy manual labor with worn-out fingerprints — and that biometrics are also easy to forge, drawbacks that have already emerged in the context of Aadhaar. The temporary discount suspension proposed by the Reserve Bank of India “is likely to create major headaches for consumers and online and offline merchants alike,” it added. The fundamental problem is one of public trust, Pal said: “The reason digital arrests are so effective is because fraudsters are able to use fear of the state as a weapon.”

The Center has also sought directions to MeitY to operationalize the long-awaited judicial framework under the Information Technology Act, including a dedicated portal for complaints under Section 43, and to complete the examination of whether civil liability can be imposed on intermediaries whose failures contribute to cyber fraud.

“The concern here is constitutional, not technical,” said Apar Gupta, a lawyer and founding director of the Internet Freedom Foundation.

The consolidation of device-level bans and 180-day retention through a status report into an automated procedure creates a de facto compliance regime that bypasses parliamentary sanctions, he said, adding that this is happening alongside IT rules that already bypass legislative powers under the IT Act.

“Automatic monitoring turns judges into administrators,” Gupta said. “While tackling fraud is a legitimate goal, imposing sanctions on surveillance and blocking infrastructure from the bench, without legislative deliberation, is not.”