Fintech Deep Dive — Saturday | October 31, 2026

Consumer rights | Developments reported October 24–31, 2026

Last week’s issue closed by asking readers to watch the Supreme Court’s digital-arrest hearing scheduled for October 29. The Court delivered more than a status update: it directed that India’s forthcoming banking-fraud rules must make financial institutions pay victims in full when the institutions’ own diligence failures enable the fraud. In the same week, a Greater Noida branch of Punjab National Bank became a live case study of why insider fraud still matters; a new concessional toll pass for daily commuters opened for business; and one of the world’s largest crypto exchanges froze customer money worldwide after a multi-billion-dollar breach. Four stories, one question: when systems fail, who actually bears the loss?

1. The Supreme Court draws a liability line: “not less than the amount lost”

On October 29, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana, hearing the suo motu case In Re: Victims of Digital Arrest Related to Forged Documents, directed that the RBI’s pending KYC (Amendment) Directions, 2026 “must mandate financial institutions to indemnify digital arrest or cyber fraud victims with suitable compensation not less than equivalent to the amount lost by the customer” where the fraud took place as a result of a failure of due diligence by the institution.12

The direction matters because the existing rulebook does not reach most digital-arrest victims. The RBI’s 2017 customer-liability circular provides zero liability only for unauthorised transactions arising from bank fraud or negligence, with third-party-breach protection conditional on reporting within three working days.3 Digital-arrest victims usually make the transfers themselves — authorised in form, coerced in substance — so the 2017 framework was never designed for them, and the revised directions taking effect on January 1, 2027 offer only a narrow, capped safety net for negligence cases.

The Court’s prescription is institutional, not merely compensatory. Every financial institution should be required to temporarily suspend transactions that are out of line with an account’s history, automatically alert the nearest police station, and physically verify before release. The RBI must notify the amendments by November 30 and bring them into force by December 31; it must also file a list of all covered institutions so the directions bind everyone without joining each bank to the case, report what action banks have taken against employees involved in digital-arrest cases, and account for the government’s blocking of 9,400 WhatsApp accounts used in these scams.23

Chief Justice Kant was blunt: “unless a penal direction was issued to the banks, they would never mend their ways”; liability must sit on the institution itself with a “zero debit” in the victim’s account; and the RBI appeared to be soft-pedalling by consulting banks while the Court sought action against them.2 The scale justifies the tone. I4C data placed before the Court shows 21,928 digital-arrest complaints involving over ₹647 crore in January–August 2026, after 1,23,672 complaints and ₹1,935 crore in 2024 and 58,239 complaints and ₹1,211 crore in 2025; the Court put this year’s net loss near ₹800 crore, against over ₹3,000 crore extorted cumulatively.4 The amicus curiae cited a woman who lost ₹2.5 crore the previous week and a victim shown a forged Supreme Court order bearing a former Chief Justice’s name.2 Fresh FIRs keep arriving inside this window: on October 28, a 55-year-old woman in Surat reported losing about ₹73 lakh to criminals impersonating government and law-enforcement officials.5

Four open questions will decide whether this becomes protection or paperwork. First, who adjudicates “due-diligence failure,” and must the victim prove it? Banks can be expected to contest findings; an evidentiary burden shifted onto an already-harmed consumer would hollow out the remedy. Second, does the mandate cover payment apps and wallets, or only banks — when the mule layer routinely runs through prepaid instruments? Third, automatic police reporting of “unusual” transactions must be reconciled with the DPDP Act’s purpose-limitation rules. Fourth, and closest to home for the innocent: the RBI’s draft mule-account SOP allows temporary holds of up to 60 days on flagged transactions of ₹1,000 or more, and as drafted provides no compensation for genuine payments wrongly held.2 The government has separately proposed a one-hour delay on payments of ₹10,000 or more with a cancellation window, and a “kill switch” to disable digital payments at once, to be adopted before December.2 Speed helps recovery; a wrongly delayed salary payment hurts too. The final rules must specify timelines, notice and an appeal path for holds, or the cure will keep injuring bystanders.

None of this changes what a consumer should do today: report immediately to the bank and through 1930 or the National Cyber Crime Reporting Portal, preserve acknowledgements, screenshots and statements, and treat any “court order” or “arrest” delivered over a video call as fraud by definition.

2. PNB Greater Noida: when the fraud is inside the branch

On October 28, account holders at a Punjab National Bank branch in Greater Noida reported that funds had vanished from savings accounts and fixed deposits without any authorisation or transaction alerts. Customer complaints peg the shortfall at about ₹35 crore; early bank-side assessments reported in the press put it at ₹11.24 crore. Police registered an FIR against unidentified bank employees under Section 316(5) of the Bharatiya Nyaya Sanhita (criminal breach of trust), and the bank suspended several employees including the branch manager.678

By October 29, PNB had assured customers that all genuine claims would be honoured, and said it had settled three claims totalling ₹43 lakh, with verification of the remaining complaints under way.7

This is the fact pattern the 2017 liability framework was built for. Where the bank’s own people cause the loss, the customer neither shared credentials nor approved anything, and there is no authentication defence to hide behind. Zero liability applies cleanly, and the consumer-rights questions become operational: how fast the bank credits accounts, whether broken fixed deposits are made whole with interest, and whether affected customers are told directly rather than discovering the theft from a statement.

Two larger lessons follow. First, alerts matter. Several customers reportedly learned of the drain only after the money was gone. Transaction alerts on every account — including dormant deposits — are the cheapest early-warning system a depositor has; check that they are enabled and not silently disabled. Second, branch-level fraud recurs because supervision is thin wherever discretion is personal. If the bank delays beyond 30 days or offers less than the documented loss, the banking ombudsman route is available, and the evidence file is the complaint with its reference number, the FIR copy and the statements. Insider fraud is also the strongest argument for the Court’s institutional liability design in Section 1: a penalty that reaches only the erring officer leaves the branch — and the next branch manager — unchanged.

3. The FASTag local pass opens November 1: real savings, with fine print

On October 26, the Ministry of Road Transport and Highways notified — under G.S.R. 917(E), the National Highways Fee (Determination of Rates and Collection) (Fifth Amendment) Rules, 2026 — a concessional local pass for non-commercial vehicles owned by people living within 20 km of a National Highway toll plaza, effective November 1, 2026. The pass costs ₹1,500 a year for owners living outside municipal or local town limits and ₹3,000 within them, applies only to the specific plaza for which it is issued, requires a valid FASTag registered for non-commercial use, and can be revised annually with effect from April 1. Purchase moves onto the Rajmargyatra app from December 1; until then it is available at eligible toll plazas.910

It is distinct from the nationwide FASTag Annual Pass introduced in August 2025, which costs ₹3,075 for 2026–27 and allows up to 200 crossings across national highways and expressways, whichever limit is reached first.11 For a commuter crossing one plaza on a daily route — 40–60 paid trips a month — either pass is a dramatic saving over per-trip rates. The choice depends on pattern: repetitive local trips around home suit the local pass; long-distance touring suits the annual pass. The fine print that will generate the most complaints is plaza-specificity — a pass bought for the wrong plaza refunds nothing — and the address-based eligibility, which makes proof of residence part of the paperwork.

Why a toll pass belongs in a consumer-rights column: a toll is a mandatory recurring payment, and every new government scheme reliably spawns a fake-UPI collection layer within days. Buy only through official channels — the plaza, NHAI, or the Rajmargyatra app from December — never through forwarded “agent” links. Verify your plaza is covered before paying, keep the receipt, and remember the annual revision clause means next year’s price is not locked.

4. Binance and the multi-billion-dollar freeze: what Indian users can and cannot expect

On October 29, Binance’s founder confirmed the exchange “may have been hacked”; at about 0030 GMT on October 30 the platform suspended all deposits and withdrawals, and stablecoin issuers Circle and Tether moved to freeze linked funds. By October 30, Binance said around $3 billion in crypto had been frozen, that it would cover all losses, and that suspensions would continue while it worked with law enforcement; Chainalysis estimated roughly $5.91 billion was stolen at the time of the breach. Even after a technical freeze, the analytics firm cautioned, returning funds can take months or years because tracing runs across exchanges, bridges and other services.121314

Indian users reach such platforms through FIU-registered offshore venues or domestic exchanges. The consumer-rights lesson is about the safety net that does not exist. FIU registration is an anti-money-laundering obligation, not deposit insurance; there is no DICGC-equivalent for crypto, no statutory compensation cap, no ombudsman with jurisdiction. If a venue fails, users are unsecured claimants in a foreign process, and “we will cover losses” is a balance-sheet promise, not a right. The same episode showcases the power that protects users — issuer-level freezes recovered billions within hours — and its price: custodial crypto is, in the end, an entry in someone else’s ledger with policy controls attached. Users who prefer self-custody should weigh its own irreversibility; users who stay on platforms should assume withdrawal freezes can happen to them, and plan liquidity accordingly.

The immediate hazard is phishing, not the breach itself. Incident news reliably triggers fake “compensation claim” forms and impersonated support agents. Binance’s own warning applies everywhere: do not trust unofficial links, messages, or requests for account information.12

The consumer-rights readout

This week’s stories share a spine: the cost of institutional failure is finally being reassigned. The Supreme Court would move mule-chain losses to the bank that failed to spot them; PNB’s branch theft will be tested against the promise that genuine claims get honoured; the FASTag pass rewards consumers who read the fine print; and Binance’s users are learning, again, what platform risk means in practice. Deadlines to watch: the RBI’s November 30 notification and December 31 operationalisation of the KYC amendments, the mule-account SOP’s integration into the grievance and money-restoration portals, and the one-hour delay and kill-switch proposals due before December. The consumer’s half of the bargain is unchanged and urgent: report to the bank and 1930 immediately, preserve every acknowledgement, and let no one — official, officer or agent — collect a fee, OTP or PIN to “release” money that is already yours.

Sources

  1. Verdictum, “RBI Rules Must: Banks Compensate Victims Not Less Than Amount Lost If Due Diligence Fails” (Oct. 29, 2026). ↩︎

  2. MediaNama, “SC says RBI rules must make banks fully compensate digital arrest victims if banks fail due diligence” (Oct. 30, 2026). ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

  3. PTI via Rediff, “Supreme Court Directs Banks To Compensate Digital Fraud Victims” (Oct. 29, 2026); RBI, Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (July 6, 2017). ↩︎ ↩︎

  4. I4C data before the Supreme Court, reported in Sanskriti IAS current-affairs brief (Oct. 30, 2026); The Indian Express, “May make banks pay digital arrest victims if due diligence fails: Supreme Court” (Oct. 29, 2026). ↩︎

  5. The 420.in, “Today’s Biggest Cyber Crime Stories Shaking India — 28th October” (Oct. 28, 2026). ↩︎

  6. PTI via Rediff, “Greater Noida PNB Customers Report Rs 35 Crore Fraud” (Oct. 28, 2026). ↩︎

  7. The Hindu, “PNB fund misappropriation case: Bank says genuine claims to be honoured, FIR registered in Gr Noida” (Oct. 30, 2026). ↩︎ ↩︎

  8. The New Indian Express, “PNB assures customers as Rs 11.24 crore alleged fraud surfaces in Greater Noida” (Oct. 29, 2026). ↩︎

  9. Jagran Josh, “New Highway Toll Rules From November 1, 2026: Annual Pass Cost, Eligibility and Validity” (Oct. 2026). ↩︎

  10. Mint, “New FASTag local pass from 1 Nov: Costs, coverage, validity rules compared with Annual Pass” (Oct. 29, 2026). ↩︎

  11. Open, “New FASTag Local Toll Pass from November 1: Eligibility, Savings, and Key Details” (Oct. 2026). ↩︎

  12. Bloomberg, “Binance Founder CZ Says Crypto Exchange ‘May Have Been Hacked’” (Oct. 29, 2026). ↩︎ ↩︎

  13. CNBC, “Billions in crypto frozen in Binance hack. Here’s what happens next” (Oct. 30, 2026). ↩︎

  14. Yahoo Finance/AFP, “Crypto platform Binance confirms major hack, more than $2.5bn frozen” (Oct. 30, 2026). ↩︎