The Karnataka high court has ordered BSNL to pay more than Rs 55 lakh in compensation and damages to a co-operative bank after an unauthorised duplicate SIM card enabled fraudsters to siphon over Rs 87 lakh from the bank's account, TOI reports.
The court held BSNL responsible for the negligent issuance of the duplicate SIM, which allowed cybercriminals to gain access to One-Time Passwords (OTPs) linked to the bank's internet banking system and execute a series of unauthorised transactions.
Justice Suraj Govindaraj directed BSNL to pay Rs 50.50 lakh as principal compensation, Rs 5 lakh as consequential damages and interest at 9% per annum from February 7, 2019, the date of the last fraudulent transaction.
How did the bank lose Rs 87 lakh?
The case involved Sri Basaveshwara Pattana Sahakara Bank Niyamitha, which maintained a current account with Canara Bank. The account was linked to a BSNL mobile number used for receiving OTPs required to authorise online banking transactions.
Between February 6 and February 7, 2019, seven unauthorised RTGS and NEFT transactions amounting to Rs 87.7 lakh were carried out from the account.
Investigations later found that an unknown individual had obtained a duplicate SIM card linked to the bank's registered mobile number from a BSNL office in Bengaluru. According to the bank, no request or authorisation had been given for the issuance of the duplicate SIM.
With access to OTPs sent to the duplicate SIM, the fraudsters were able to complete the transactions.
While Rs 30 lakh was reverse-credited and Rs 7.12 lakh was later recovered through police action, the bank was left with an unrecovered loss of Rs 50.50 lakh.
Why did the court hold BSNL responsible?
The high court said the circumstances clearly pointed to negligence in the SIM issuance process.
"The very fact that a duplicate SIM reached a non-subscriber is proof that verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless," the court observed.
The court also stressed that telecom operators are expected to exercise greater caution when handling numbers linked to banking services.
"The duty is particularly heightened when the subscriber is a banking institution that has registered the mobile number for OTP-based authentication of high-value financial transactions," the court noted.
The judgment referred to a BSNL official who had been identified as responsible for issuing the duplicate SIM and against whom departmental proceedings had been initiated.
According to the court, BSNL could not rely on disciplinary action against its employee while simultaneously arguing that it should not be held liable for the consequences of that employee's actions.
Did the court accept BSNL's insurance argument?
BSNL argued that the co-operative bank had already recovered significant amounts through insurance claims and other recoveries, and therefore should not receive further compensation.
The court rejected that contention.
"It would be deeply unjust to allow BSNL to escape liability because the Co-operative Bank had prudently insured itself," the court said while dismissing the argument.
The court added that compensation received from an insurer does not erase liability arising from negligence.
What compensation has BSNL been ordered to pay?
The Karnataka high court enhanced the compensation awarded earlier by the Permanent Lok Adalat and directed BSNL to pay:
- Rs 50,50,762 as principal compensation
- Rs 5 lakh as consequential damages for reputational harm and liquidity disruption
- Interest at 9% per annum from February 7, 2019
The court also dismissed BSNL's petition challenging the compensation order.
