AI Scams and Digital Fraud: Where Does Liability Lie?

Fraudsters will be one step ahead. The organisations that hold our data, and the people who sign, have to be two steps ahead.

Saakar S. Yadav Founder, Lexlegis.ai

The scam email with bad spelling is history. Today it is a phone call in your daughter’s voice, or a man in uniform on your screen placing you under digital arrest. Artificial intelligence has made fraud cheap to produce and hard to spot.

When the money is gone, everyone asks the same question. Who is liable?

I build legal AI for a living, so people expect a complicated answer from me. My answer is short. Liability lies with the one who owns the data and the one who signs. I have no doubt about it.

The one who owns the data

The fraudster is the offender, and the criminal law must pursue him. But he is often beyond reach, and so is the money. So, who else must answer?

Start with the owner, by which I mean the organisation that decides why and how data is collected and used. The law calls it the data fiduciary. Most scams run on data: a phone number, an account detail, a list of who reports to whom. It sits with banks, telecom operators, platforms and ordinary companies. If you chose to collect it, you answer for it. A contract can make a vendor share the cost, but the accountability stays with you.

Indian law is moving the same way. Under the Digital Personal Data Protection Act, the fiduciary stays answerable for compliance even when a processor does the work on its behalf, and penalties run up to Rs 250 crore. The main obligations take effect in May 2027.

The Reserve Bank’s revised directions on customer liability apply from 1 January 2027. They now reach fraud where a customer’s credentials are taken by deception, or where a payment is approved under coercion or duress. The burden of proving the customer’s liability, which has sat with the bank since 2017, extends to these cases. There are limits, and a customer who shares credentials can still bear the loss. But the starting point is right. The institution with the data and the systems has to prove its case.

The one who signs

Then there is the signature, whether on a payment approval, a contract or a court filing. When you sign, you are saying that you have checked it and you stand behind it.

In Hong Kong in 2024, a finance employee joined a video call with the company’s CFO and colleagues, then transferred about HK$200 million. Police said everyone else on that call was a deepfake. The technology was new, but the gap was old. The check with head office came after the money had left. I’m not blaming one employee. The signature was the company’s, and so was the duty to build in a second check.

My own field has learnt this the hard way. In July, the Supreme Court set aside tribunal orders that relied on fake, AI generated precedents. It said a lawyer who cites such judgments without verification commits misconduct, and a judge who relies on them commits a serious lapse.

That sets the bar for those of us who build these tools. At Lexlegis we assume a professional will put a name to the output, so the system is built to show its sources and make the check easy. AI can prepare the work, but the person who signs still answers for it.

Two steps ahead

To me it’s simply clear. Fraudsters, scamsters and thieves will be one step ahead. We need to be two steps ahead, and that comes from checks and balances, none of them new.

Confirm any instruction to move money or data on a second channel, never the one it arrived on. Keep a maker and a checker on whatever a machine prepares for signature. Know what data you hold and who can reach it and hold less of it. Record who approved what, and why. Teach your people that a familiar face and voice prove nothing now, and that urgency and secrecy are warning signs.

Rules will keep coming, and this year’s labelling requirement for synthetic content is a good start. But nobody needs a regulator to tell them the obvious. If you own the data, protect it. If you sign, read first. “The AI did it” is no defence for either of you today, and I don’t expect it to become one.

The author is the Founder of Lexlegis.ai, an Indian legal AI platform for legal and tax professionals. Views are personal.