In a significant ruling on telecom accountability and cyber fraud, the Karnataka High Court has held Bharat Sanchar Nigam Limited (BSNL) responsible for losses arising from a SIM swap fraud that enabled cybercriminals to siphon off more than Rs 87 lakh from a cooperative bank’s account.
The court directed BSNL to pay over Rs 55 lakh in compensation and damages, along with interest, after finding that a duplicate SIM card had been issued without proper authorisation, allowing fraudsters to intercept one-time passwords (OTPs) and execute unauthorised fund transfers.
Fraud Enabled Through Unauthorised Duplicate SIM
The case involved Sri Basaveshwara Pattana Sahakara Bank Niyamitha, which maintained a current account with Canara Bank and used a BSNL mobile number to receive OTPs required for internet banking transactions.
Between February 6 and February 7, 2019, fraudsters carried out seven unauthorised RTGS and NEFT transactions amounting to Rs 87.7 lakh.
Subsequent investigations revealed that an unknown individual had obtained a duplicate SIM card linked to the bank’s registered mobile number from a BSNL office in Bengaluru without the bank’s knowledge, consent or request.
Using the OTPs received on the duplicate SIM, the fraudsters successfully authorised and completed the transactions.
Bank Suffers Loss Despite Partial Recoveries
Although Rs 30 lakh was later reversed and another Rs 7.12 lakh was recovered through cybercrime investigations, the bank was left with an unrecovered loss of approximately Rs 50.5 lakh.
The bank subsequently issued legal notices to both BSNL and Canara Bank before approaching the Permanent Lok Adalat in Mangaluru.
While the tribunal found BSNL negligent, it awarded only Rs 5 lakh in compensation. Both parties challenged the decision before the Karnataka High Court.
Court Finds BSNL Negligent
Justice Suraj Govindaraj observed that telecom operators have a heightened duty of care when handling mobile numbers linked to financial institutions.
“The potential for catastrophic financial harm from a negligent SIM swap is disproportionately high when the subscriber is a banking institution,” the court noted.
The judgment emphasised that a duplicate SIM reaching a person who is not the legitimate subscriber could not occur in the normal course of business if proper verification procedures were followed.
“The very fact that a duplicate SIM reached a non-subscriber is proof that verification was either not conducted or conducted in such a perfunctory manner as to be meaningless,” the court observed.
BSNL Held Vicariously Liable
The court noted that BSNL had itself initiated disciplinary proceedings against an official identified as responsible for issuing the duplicate SIM card.
According to the judgment, BSNL could not simultaneously acknowledge wrongdoing through disciplinary action while denying responsibility in court.
“BSNL cannot maintain two contradictory positions simultaneously: that the act was within official employment so as to justify disciplinary proceedings, and that it was outside official employment so as to escape vicarious liability,” the court said.
The court also rejected BSNL’s argument that the absence of criminal charges against its employee absolved the organisation of responsibility, pointing out that civil liability is assessed on a different standard than criminal guilt.
Insurance Recovery Does Not Reduce Liability
BSNL further argued that the cooperative bank had already recovered substantial amounts through insurance claims and other recoveries, and therefore should not receive additional compensation.
The High Court firmly rejected this contention.
The court observed that allowing a wrongdoer to escape liability because the victim had obtained insurance protection would be fundamentally unfair.
“It would be deeply unjust to allow BSNL to escape liability because the bank had prudently insured itself,” the judgment stated.
Compensation Enhanced
Dismissing BSNL’s petition and partly allowing the bank’s plea, the High Court substantially enhanced the compensation.
The court directed BSNL to pay:
- Rs 50,50,762 as compensation for the unrecovered financial loss;
- Rs 5 lakh as consequential damages for reputational harm and disruption to operations; and
- Interest at 9 per cent per annum from February 7, 2019, the date of the final fraudulent transaction.
The ruling is expected to have broader implications for telecom operators and financial institutions, reinforcing the importance of strict verification procedures in SIM replacement requests and highlighting the legal consequences of negligence in handling sensitive customer information.
