Published on: 23 November, 2025 14:10 IST
In a major judgment with far-reaching implications for cybercrime investigations, the Bombay High Court has ruled that investigating agencies cannot impose a blanket “debit freeze” on an individual’s entire bank account under the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023. The court held that while agencies may place a lien on the specific disputed amount believed to be involved in cyber fraud, they cannot block the account holder from operating their remaining funds.
Delivering the ruling on Thursday, a division bench of Justices Anil Pansare and Rajesh S. Wakode at the Nagpur bench observed that freezing an entire account especially in cybercrime cases where the account holder may be unaware that their account was used as a conduit amounts to an excessive and legally unsustainable measure. A lien, the judges explained, merely prevents the withdrawal of a particular amount, while keeping the account fully operational for other legitimate transactions.
The judgment came while hearing seven petitions filed by individuals whose bank accounts had been debit-frozen under Section 106 of the BNSS, after proceeds of alleged cyber fraud were routed through their accounts. In each case, the police issued directions to banks to block the entire account balance, claiming investigative necessity.
The High Court, however, noted that Section 106 of the BNSS only empowers the police to seize property suspected of being stolen or linked to a criminal offence. It does not authorize police officers to attach or debit-freeze a bank account. The bench emphasised that Section 107 of the BNSS clearly mandates that investigators must approach a magistrate for orders of attachment. “The law stands well-settled that under Section 106, an investigating agency has no power to attach or debit freeze an account,” the court held, quashing all freezing orders issued in the petitions before it.
Significantly, the court referred to the “Citizen Financial Cyber Frauds Reporting and Management System”, a protocol published by the Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs. This national framework guides banks on immediate measures to take upon receiving information from police about suspected fraudulent transactions. Under this protocol, banks are expected to place a lien on the disputed amount only, not freeze the entire account. The court noted that this system was specifically designed to protect both investigators’ interests in preserving evidence and citizens’ rights to access their lawful funds.
Despite this, the bench observed that several banks continue to freeze full accounts even when the communication from the police does not direct them to do so. “It is a mystery as to how the bank chose to debit freeze the accounts on their own,” the court remarked, adding that such actions can cause severe hardship to innocent account holders who may have no link to the fraud beyond their accounts being misused by third parties.
The court allowed the petitioners to pursue compensation by initiating appropriate proceedings against the banks or the authorities responsible, stating that wrongful freezing of accounts could amount to actionable injury.
The ruling is expected to bring uniformity to how banks respond to cybercrime alerts and may compel both financial institutions and police authorities to strictly adhere to statutory safeguards under the BNSS. Legal experts say the decision reinforces the principle that investigative convenience cannot override due process, particularly in an era where thousands of citizens find their accounts inadvertently linked to cyber fraud due to scams, identity theft or social engineering attacks.