Banks Must Take Proactive Steps Against SIM Swap Fraud: Karnataka HC Upholds BSNL's Liability In Fraud Case

The Karnataka High Court has recently observed that banks must proactively strengthen safeguards against SIM swap fraud. It noted that measures such as multiple OTP delivery channels, delayed processing of high-value transactions following SIM swaps, alternate transaction alerts and customer awareness initiatives can help prevent such frauds.

Justice Suraj Govindaraj made the observations while holding BSNL liable for a fraud that enabled unauthorised withdrawals of ₹87.70 lakh from the account of Basaveshwara Pattana Sahakara Bank Niyamitha. The Court dismissed BSNL's challenge to a Permanent Lok Adalat award and partly allowed the cooperative bank's petition.

The Court directed BSNL to pay ₹50,50,762 towards the bank's net financial loss. The amount will carry interest at 9% per annum from February 7, 2019. The Court also awarded ₹5 lakh towards consequential damages.

The Court found that the Permanent Lok Adalat's award of ₹5 lakh was manifestly inadequate when compared to the bank's established net loss of ₹50.50 lakh.

The court, however, observed that the primary fault in the case lay with BSNL. It held that the unauthorised issuance of a duplicate SIM card linked to the co-operative bank's registered mobile number enabled fraudsters to intercept OTPs and execute seven unauthorised RTGS/NEFT transactions between February 6 and 7, 2019.

The Court observed, “While the primary fault in the present case lies with BSNL, banking institutions must also take proactive steps to protect their customers and themselves from SIM swap fraud. These steps may include: registering multiple OTP delivery channels so that the loss of one channel can be detected and compensated; implementing time-delays between SIM swap notifications and large transactions to provide a window for detection; sending transaction alerts to alternate communication channels; and educating customers about the risks of SIM swap fraud and the precautions they can take.”

The Permanent Lok Adalat, Dakshina Kannada, had by its award dated August 9, 2024, held BSNL liable and directed it to pay ₹5 lakh as compensation with interest at 6% per annum from March 1, 2021. It had rejected the claim against Canara Bank.

According to the bank, fraudsters procured a duplicate SIM linked to its registered BSNL mobile number and used intercepted OTPs to execute seven unauthorised RTGS/NEFT transactions worth ₹87.70 lakh between February 6 and 7, 2019. Claiming unrecovered losses despite partial recoveries, the co-operative bank approached the Permanent Lok Adalat, which held BSNL liable and awarded compensation. Aggrieved by the award, BSNL challenged the finding of liability, while the co-operative bank sought enhancement of compensation.

Holding BSNL liable, the Court held that the duplicate SIM card was issued without proper verification or the co-operative bank's authorisation. It found that this negligence directly enabled OTP diversion and made the fraudulent transactions possible.

The Court also held that the dispute was a civil claim arising from an alleged deficiency in telephone services and could therefore be adjudicated by the Permanent Lok Adalat. The pendency of criminal proceedings did not bar the compensation claim.

Noting that issuance of duplicate SIM cards forms part of BSNL's core telecom functions, the Court upheld the company's vicarious liability for the acts of its employee. It also affirmed the finding exonerating Canara Bank.

On compensation, the Court ruled that while recovered funds must be accounted for in calculating the net loss, insurance proceeds received under an independent policy cannot reduce the liability of the wrongdoer.

However, insurance proceeds received under an independent policy do not diminish the liability of the wrongdoer.

Describing the matter as a “paradigmatic instance of SIM swap fraud”, the Court observed:

“The Present Case as a Paradigm: The present case is a paradigmatic instance of SIM swap fraud. A banking institution had its registered mobile number compromised through a duplicate SIM issued by a telecom service provider's official. Within hours, substantial funds were drained from its account. The harm was swift, severe and largely irreversible at the moment of fraud. The pattern is precisely that which has been documented in thousands of similar cases across India. The legal response must be clear and consistent: where a telecom service provider's negligence or its official's misconduct directly enables a SIM swap fraud, the telecom service provider bears full civil liability for the consequential loss..”

The Court further observed that verification of a subscriber's identity before issuing a duplicate SIM card is a critical safeguard against financial fraud and not a mere procedural formality.

“The verification of subscriber identity before issuing a duplicate or replacement SIM card is not a bureaucratic formality. It is a critical security measure upon which the financial safety of millions of bank account holders depends.”

Accordingly, the Court dismissed BSNL's petition and partly allowed the co-operative bank's petition. It directed BSNL to pay ₹50,50,762 towards the bank's net financial loss with 9% interest from February 7, 2019, along with ₹5 lakh towards consequential damages