Karnataka High Court Rejects PhonePe's Plea, Allows Cyber Police to Seek Merchant Data in Fraud Case

The Karnataka High Court has dismissed a petition filed by digital payments app PhonePe, which had challenged a request by Bengaluru’s cybercrime police for merchant-related information in a cyber fraud case.

In a detailed 32-page judgment, Justice M. Nagaprasanna ruled that protecting consumer privacy should not come at the cost of hampering police investigations. “Confidentiality must coexist with accountability,” he said.

The Case

The case began after a Bengaluru resident complained that he was cheated while placing bets on six online betting websites during an India-South Africa cricket match in September 2022. After placing his bets, the websites blocked him from withdrawing the money. He could see his deposited amount, but could not access it or get a refund.

Bengaluru cyber police registered a case and approached PhonePe, seeking details such as the IP addresses, URLs, transaction history, and KYC details of the merchants linked to those betting sites. They issued the request under Section 91 of the Criminal Procedure Code (CrPC).

PhonePe's Arguments

PhonePe argued that it was simply a payment service provider and had no role in the actual transactions. The company said it was governed by the Payment and Settlement Systems Act, 2007, and was not obligated to share user details. It also cited the Bankers’ Books Evidence Act, 1891, which it claimed protected customer confidentiality. PhonePe said that police could not demand such information without a court order.

Government’s Stand

The government, however, defended the police, saying cybercrimes are on the rise and require efficient investigation. The Centre has also issued guidelines under Section 87 of the IT Act which support the police’s authority to seek such data. The government also accused PhonePe of violating rules meant to prevent illegal betting.

The Court’s View

Justice Nagaprasanna said the case involved a “delicate interplay” of several laws – including the IT Act, Payment and Settlement Systems Act, and the Bankers’ Books Evidence Act. He emphasized that cybercrimes are modern, fast-evolving threats, and police must be empowered to investigate effectively.

He ruled that while privacy is important, it cannot be used to block lawful investigations. PhonePe, he said, cannot refuse to share information when it acts as an intermediary in digital transactions.

The High Court’s judgment is seen as a significant step in empowering law enforcement agencies to tackle growing cyber fraud while balancing privacy concerns.