NEW DELHI: The Karnataka high court has ruled that BSNL is liable for losses caused by SIM swap fraud after one of its officials issued a duplicate SIM card without authorisation, enabling cybercriminals to drain over Rs 87 lakh from a cooperative bank’s account through fraudulent online transfers.Justice Suraj Govindaraj, while deciding two writ petitions arising from the same fraud, dismissed BSNL’s challenge to the compensation order and enhanced the award in favour of the Sri Basaveshwara Pattana Sahakara Bank Niyamitha. It directed the BSNL to pay Rs 50 lakh as principal compensation, Rs 5 lakh as consequential damages, and interest at 9 per cent per annum from February 7, 2019, the date of the last fraudulent transaction.How did the fraud unfoldedThe Co-operative Bank, maintained a current account with Canara Bank linked to internet banking. Its registered BSNL mobile number was used to receive One-Time Passwords (OTPs) for authenticating transactions.Between February 6 and 7, 2019, seven unauthorised RTGS/NEFT transactions totalling Rs 87.7 lakh were made from the bank’s account. After the inquiry, it emerged that an unknown person had obtained a duplicate SIM linked to the bank’s registered mobile number from a BSNL office in Bengaluru, without any request, consent, or knowledge of the Co-operative Bank.Using OTPs received on this duplicate SIM, the fraudsters completed the transactions.A sum of Rs 30 lakh was subsequently reverse-credited and Rs.7.12 lakh was recovered by the Cyber Crime Police, leaving a net unrecovered loss of Rs 50,50,762.The Co-operative Bank issued a legal notice to BSNL and the Canara Bank in January 2021 and approached the Permanent Lok Adalat, Mangaluru. The tribunal found BSNL negligent but awarded only Rs 5 lakh, a decision that both sides challenged before the high court.Why BSNL was held responsibleThe high court framed several issues for determination, including whether the Permanent Lok Adalat had jurisdiction, whether BSNL was negligent, whether it was vicariously liable, and also whether insurance proceeds received by the bank reduced BSNL’s liability.The court noted that the negligence from the BSNL’s part was clearly established.“The duty is particularly heightened when the subscriber is a banking institution that has registered the mobile number for OTP-based authentication of high-value financial transactions. The potential for catastrophic financial harm from a negligent SIM swap in such a case is disproportionately high. Heightened risk demands a heightened standard of care,” the court observed.The court further noted that a subscriber’s mobile number being reassigned to a stranger without the subscriber’s knowledge does not occur in the ordinary course of events.“The very fact that a duplicate SIM reached a non-subscriber is proof that verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless,” the court held.The bench said that BSNL’s own official, Mr. Karunakaran, had been identified as responsible for issuing the duplicate SIM. BSNL had initiated departmental disciplinary proceedings against him — a move the court said amounted to an institutional acknowledgment that something went seriously wrong.“BSNL cannot maintain two contradictory positions simultaneously: that the act was within official employment so as to justify disciplinary proceedings, and that it was outside official employment so as to escape vicarious liability,” Justice Govindaraj stated.BSNL argued that since the Cyber Crime Police had not chargesheeted its manager, it could not be held responsible. The court rejected this, holding that civil and criminal standards of proof are entirely different.“The same evidence that may be insufficient for a criminal conviction may be entirely sufficient to establish civil negligence on the balance of probabilities,” the court said.BSNL contended that since the Co-operative Bank had received Rs 57.65 lakh from its insurer, together with other recoveries totalling over Rs.94 lakh, more than the gross fraud of Rs 87.7 lakh — it had been over-compensated and BSNL owed nothing further.The court rejected this argument.Rejecting the argument from the BSNL counsel, the court said that “It would be deeply unjust to allow BSNL to escape liability because the Co-operative Bank had prudently insured itself. It is like saying that because a robbery victim received compensation from his insurer, the robber need not pay or cannot be prosecuted.”BSNL’s writ petition was dismissed and the Co-operative Bank’s petition was partly allowed, with the compensation enhanced to Rs 50,50,762 as principal, Rs 5 lakh as consequential damages for reputational harm and liquidity disruption, and interest at 9 per cent per annum from the date of the fraud.