The Karnataka High Court has held Bharat Sanchar Nigam Limited (BSNL) responsible for a significant SIM-swap fraud that resulted in the theft of ₹87.7 lakh from a cooperative bank. The court has directed BSNL to pay a total of ₹50,50,762 as compensation, an additional ₹5 lakh for consequential damages, and 9% interest per annum from February 7, 2019, bringing the total payout to over ₹55 lakh.
How the ₹87.7 Lakh Fraud Occurred
The incident, which took place between February 6 and 7, 2019, saw seven unauthorized RTGS and NEFT transactions drain ₹87.7 lakh from Sri Basaveshwara Pattana Sahakara Bank Niyamitha's current account at Canara Bank. The cooperative bank used a BSNL mobile number for receiving One-Time Passwords (OTPs) crucial for internet banking transactions.
An investigation revealed that an unknown individual had obtained a duplicate SIM card linked to the bank's registered mobile number from a BSNL office in Bengaluru. Crucially, this duplicate SIM was issued without the bank's request, consent, or knowledge. Fraudsters then used OTPs received on this unauthorized SIM to complete the illicit transactions.
Out of the total amount stolen, ₹30 lakh was later reversed, and ₹7.12 lakh was recovered by the Cyber Crime Police. However, the bank still faced a net loss of ₹50,50,762.
Legal Battle and High Court's Ruling
The bank initiated legal action by sending notices to BSNL and Canara Bank in January 2021, subsequently approaching the Permanent Lok Adalat in Mangaluru. While the tribunal found BSNL negligent, it awarded only ₹5 lakh in compensation, prompting both parties to appeal to the High Court.
Justice Suraj Govindaraj, presiding over the Karnataka High Court, dismissed BSNL's challenge and significantly increased the compensation amount. The court scrutinized BSNL's negligence and its vicarious liability for the actions of its employee.
Why BSNL Was Held Responsible
The High Court emphasized BSNL's heightened duty of care, especially since the mobile number belonged to a banking institution and was used for OTP-based authentication of high-value financial transactions. The court observed, "The potential for catastrophic financial harm from a negligent SIM swap in such a case is disproportionately high. Heightened risk demands a heightened standard of care."
The court further stated that a duplicate SIM reaching a non-subscriber without the actual subscriber's knowledge was not a normal occurrence. It concluded that "verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless." The bench noted that a BSNL official, Mr. Karunakaran, was identified as the person who issued the duplicate SIM, and BSNL had initiated disciplinary proceedings against him. Justice Govindaraj highlighted the contradiction in BSNL's stance, arguing it could not claim the act was within official employment for disciplinary action while simultaneously trying to escape vicarious liability.
Rejection of BSNL's Arguments
BSNL attempted to argue that since the Cyber Crime Police had not filed a chargesheet against its manager, it should not be held responsible. The court rejected this, stating that "the same evidence that may be insufficient for a criminal conviction may be entirely sufficient to establish civil negligence on the balance of probabilities."
BSNL also contended that the bank had already received ₹57.65 lakh from its insurer and recovered other amounts, exceeding the total fraud amount. This argument was also dismissed, with the court asserting it would be "deeply unjust to allow BSNL to escape liability because the Co-operative Bank had prudently insured itself."