The Kill Switch Fallacy
In recent months, India has woken up to the scale of the so-called "digital arrest" epidemic. According to official estimates, scammers have defrauded citizens of nearly ₹3,000 crore by impersonating police officers, regulators, and enforcement agencies often keeping victims on video calls for hours, threatening arrest, and coercing them into transferring money "for verification." In response, the Ministry of Home Affairs (MHA), along with the RBI, is evaluating two headline interventions: an emergency Kill Switch inside banking apps, and a form of fraud insurance or shared risk pool across banks. On paper, both sound sensible. In practice, they rest on a fragile assumption: that victims of digital arrests are still acting with agency. My concern is that these tools may arrive after trust has already collapsed. And once trust fails, buttons and insurance clauses don't help much. The Policy Response on the Table Let's start with what the government is actually proposing. The idea is to embed a Kill Switch an emergency button inside banking and UPI apps. If a user suspects fraud or realizes they've been targeted they can hit the Kill Switch to instantly freeze outgoing transactions and banking access. The goal is to stop the "layering" process, where stolen funds are rapidly split across dozens of mule accounts and disappear within minutes. Technically, this is elegant. Behaviorally, it's far less convincing. In a digital arrest scam, victims are often kept in a state of intense fear. They are told they are being monitored. They are warned not to hang up, not to touch other apps, not to "tamper with evidence." In that psychological state, expecting someone to calmly locate and press a Kill Switch assumes clarity that simply does not exist. In one of my recent training sessions with seniors, several participants said something strikingly similar: "If someone says they are police, my first instinct is to obey, not to experiment." That instinct is exactly what scammers exploit. A Kill Switch assumes the victim realizes they are under attack before compliance. Digital arrests work precisely because that realization comes too late. The second proposal is more structural. The RBI and MHA are reportedly exploring a pooled insurance mechanism similar to terrorism insurance where banks and insurers jointly absorb losses from digital fraud. This is a significant shift. Until now, most cyber insurance excludes first-party fraud, where the victim authorizes the transaction themselves under manipulation. That exclusion is increasingly untenable. But insurance introduces its own risks. There is the obvious moral hazard problem. If customers believe losses will be reimbursed, vigilance may drop. Less visibly, if banks know a shared pool will absorb losses, incentives to invest aggressively in prevention weaken. More importantly, fraud insurance raises messy questions no policy brief answers cleanly: What proof is required? An FIR? A bank investigation? Who decides if someone was genuinely manipulated or merely careless? In India's already slow grievance redressal system, this could easily turn into years of litigation. Scammers will adapt There is another assumption quietly embedded in the Kill Switch proposal that deserves scrutiny: that scammers will treat it as a deterrent rather than a design constraint. In reality, scammers are not opportunists reacting in real time. They are professional friction bypassers. Every new safeguard introduced into the system becomes, for them, just another obstacle to engineer around.
- Policy
- Akshaya RA
