Karnataka High Court Urges Banks To Take Steps Against 'SIM-Swap Fraud', Holds BSNL Liable For Illegal Withdrawals From Bank's Account

Underscoring the accountability of telecom service provider for its negligence in a case of SIM swap fraud, the Karnataka High Court held telecom company BSNL vicariously liable for wrongful issuance of a duplicate SIM card to fraudsters by one of its employees, resulting in a loss of Rs 87.70 lakhs to a co‑operative bank.

In doing so the court while recognizing the role of telecom providers as vault keepers who if dishonestly gives access to unauthorised persons bears responsibility for the resulting theft, the court also urged banks to take protective steps against SIM-Swap fraud.

The single judge bench of Justice Suraj Govindaraj dismissed BSNL's plea against the Permanent Lokayukta Award and enhanced the compensation payable to the Bank from Rs 5 lakhs to 50.5 Lakhs, along with interest at the rate of 9 per cent interest per annum.

BSNL would also be liable to pay consequential damages amounting to Rs 5 lakhs for reputational harm, liquidity crisis, and operational disruption caused to the co-operative Bank.

“…Telecom service providers are the custodians of the mobile numbers that serve as the authentication anchors for the entire OTP‑based digital payment system. Their role in the digital financial ecosystem is structurally equivalent to the role of a vault keeper in a traditional banking system. Just as a vault keeper who carelessly or dishonestly gives access to unauthorised persons bears responsibility for the resulting theft, a telecom service provider that carelessly or dishonestly issues a duplicate SIM bears responsibility for the financial fraud that the duplicate SIM enables…”, the court laid down in unequivocal terms about the role played by telecom companies in the hierarchy of digital payments.

It further said

"The present case is a paradigmatic instance of SIM swap fraud. A banking institution had its registered mobile number compromised through a duplicate SIM issued by a telecom service provider's official. Within hours, substantial funds were drained from its account. The harm was swift, severe and largely irreversible at the moment of fraud. The pattern is precisely that which has been documented in thousands of similar cases across India. The legal response must be clear and consistent: where a telecom service provider's negligence or its official's misconduct directly enables a SIM swap fraud, the telecom service provider bears full civil liability for the consequential loss".

Treatment of Recoveries in the Digital Fraud Context

"This Court also addresses, for future guidance, the appropriate treatment of insurance proceeds and other recoveries in digital fraud compensation cases. The principle that this Court has applied, that direct recoveries of the stolen funds reduce the net compensable loss, while collateral insurance proceeds do not reduce the tortfeasor's liability, is of general application. It protects the incentive for institutions to obtain insurance coverage against digital fraud risks. It also preserves the insurer's subrogation rights, which are essential to the functioning of the commercial insurance market".

It further observed that the verification of subscriber identity before issuing a duplicate or replacement SIM card is not a bureaucratic formality and that every telecom service provider must treat every request for a duplicate SIM card with the gravity it deserves.

"The verification must be thorough, the documentation must be examined carefully, and where there is any doubt about the identity or authority of the applicant, the request must be declined and the subscriber must be contacted through alternate channels. The financial consequences of issuing a duplicate SIM to a fraudster can be catastrophic for the victim and, as this judgment demonstrates, equally consequential for the telecom service provider in civil law".

The court said that banking institutions must also take proactive steps to protect their customers and themselves from SIM swap fraud:

• registering multiple OTP delivery channels so that the loss of one channel can be detected and compensated;
• implementing time-delays between SIM swap notifications and large transactions to provide a window for detection;
• sending transaction alerts to alternate communication channels;
• and educating customers about the risks of SIM swap fraud and the precautions they can take.

The court said that while these measures are not a substitute for telecom service providers' duty of care but are an additional layer of protection. It further said that while it is not the court's function to issue directions to regulators in these proceedings, however the present matter highlighted the importance of effective regulatory oversight of SIM swap procedures by the Department of Telecommunications and the Telecom Regulatory Authority of India.

The regulatory framework must ensure that prescribed verification procedures are actually followed in practice, that penalties for non-compliance are meaningful and enforced, and that customers are notified promptly and effectively when any SIM swap is requested in respect of their numbers, the court said.

Three‑Pronged Test of Negligence & Heightened Duty of Care

The court initially observed that BSNL will be liable if the three-pronged test of negligence involving duty of care, breach and consequential loss were to be applied. According to the court, BSNL also breached the 'heightened duty of care' it owed to a subscriber such as a financial institution.

“…BSNL's duty of care is particularly heightened when the subscriber is a banking institution that has registered the mobile number for OTP‑based authentication of high‑value financial transactions. The potential for catastrophic financial harm from a negligent SIM swap in such a case is disproportionately high…”

Proximate Cause & Res Ipsa Loquitur

The Court also held that the issuance of the duplicate SIM was the 'proximate cause' of the financial loss, because if not for the issuance of the duplicate SIM to third parties, the OTPs would not have been diverted, and the fraudulent transactions would not have been completed, the court added.

“…The ordinary course of events does not result in a subscriber's mobile number being reassigned to a stranger without the subscriber's knowledge. … The very fact that a duplicate SIM reached a non‑subscriber is proof that verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless…”, the court further noted by invoking the principle of res ipsa loquitor.

Vicarious Liability & 'Wrongful Manner' of Act

Specifically on the aspect of how vicarious liability is attracted by BSNL due to the act of the employee which issued a duplicate SIM without verification, the court held as below:

“…The 'nature' of the act, issuance of a SIM card, including a duplicate SIM card, is squarely within the scope of the functions entrusted to officials at BSNL's subscriber management offices. … The 'manner' of performance, without verification, in alleged collusion with fraudsters, was wrongful. But the wrongful manner does not change the nature of the act, and does not take it outside the course of employment…”

Before concluding, BSNL was directed to pay the enhanced amount within three months along with the interest of 9 per cent per annum, failing which default interest at 12 per cent would apply.

Background

Basaveshwara Pattana Sahakara Bank Niyamitha is a co-operative bank functioning since 1913, maintaining a current account with the Canara Bank, Shiralkoppa Branch. The Bank had registered a BSNL mobile number for receiving One‑Time Passwords (OTPs) for internet banking transactions. In February 2019, seven unauthorised RTGS/NEFT transactions to the tune of Rs 87.7 lakhs were made from its account. Out of this, Rs 30 lakhs was reverse‑credited; however, the bank suffered a net loss of Rs 50.5 lakhs though the police recovered around Rs 7.12 lakhs.

The bank came to know that third parties managed to obtain a duplicate SIM card for its registered mobile number from BSNL's office without the bank's authorisation, resulting in interception of OTPs and completion of fraudulent transactions. One of BSNL's employee, Mr. Karunakaran, was allegedly responsible for issuing the duplicate SIM without proper verification.

The bank filed a claim before the Permanent Lok Adalat, which awarded it in 2024, a sum of Rs 5,00,000 with interest at 6% which is to be paid by BSNL while not imposing liability on Canara Bank. Aggrieved by the order, BSNL filed a writ challenging the award, and the cooperative bank, subsequently, filed another writ seeking enhancement of compensation.

Case Title: Basaveshwara Pattana Sahakara Bank Niyamitha v. Canara Bank & Ors. and BSNL v. Basaveshwara Pattana Sahakara Bank Niyamitha & Ors.

Case No: W.P.Nos.16104/2025 & 4674/2025)

Click Here To Read/Download Order