Karnataka HC Holds BSNL Liable for SIM Swap Fraud, Orders Rs 50.5 Lakh Plus Interest to Co-operative Bank
Justice Suraj Govindaraj affirmed BSNL's civil liability for negligently issuing a duplicate SIM card that enabled Rs 87.7 lakh in fraudulent RTGS/NEFT transfers from a Shivamogga co-operative bank's account, and enhanced the Permanent Lok Adalat's compensation award from Rs 5 lakh to over Rs 55.5 lakh plus interest.
The High Court of Karnataka at Bengaluru, in a judgment delivered on 1 June 2026, has held Bharat Sanchar Nigam Limited (BSNL) fully liable in civil law for the financial loss suffered by Basaveshwara Pattana Sahakara Bank Niyamitha, a co-operative bank established in 1913 and based in Shiralkoppa, Shivamogga district. Justice Suraj Govindaraj, sitting singly, dismissed BSNL's writ petition challenging the Permanent Lok Adalat's award and partly allowed the co-operative bank's writ petition, substantially enhancing the compensation. The court directed BSNL to pay Rs 50,50,762 as net loss compensation, interest at 9% per annum from 7 February 2019 until actual payment, and a further Rs 5 lakh for consequential damages — all within three months. The judgment addresses the jurisdiction of Permanent Lok Adalats over SIM swap fraud claims, the standard of care owed by telecom providers in the digital payment ecosystem, and the scope of vicarious liability where an employee issues a duplicate SIM card without proper verification.
The Fraud and the Proceedings Before the Permanent Lok Adalat
The co-operative bank maintained a current account with Canara Bank, Shiralkoppa branch, and had registered a BSNL mobile number for internet banking. One-Time Passwords (OTPs) required to authenticate NEFT and RTGS transactions were delivered to that registered number.
Between 6 and 7 February 2019, seven unauthorised transactions totalling Rs 87,70,000 were effected from the account. The co-operative bank discovered the fraud on the morning of 7 February 2019 and immediately informed Canara Bank. A complaint was lodged before the Cyber Crime Police Station, Bengaluru, on 8 February 2019.
Investigation revealed that unknown persons had obtained a duplicate SIM card for the co-operative bank's registered mobile number from a BSNL office in Bengaluru. Once the duplicate SIM was activated, the original SIM was deactivated and all OTPs were diverted to the fraudsters, who then completed the transactions. The Cyber Crime Police subsequently recovered Rs 7,12,238, which was released to the co-operative bank pursuant to court orders. A further Rs 30,00,000 was reverse-credited to the account. The remaining loss stood at Rs 50,50,762.
On 28 January 2021, the co-operative bank issued a legal notice to BSNL and Canara Bank and then initiated proceedings before the Permanent Lok Adalat, Dakshina Kannada, in PLD No. 64 of 2021 under Section 22A(b) read with Section 22C of the Legal Services Authorities Act, 1987. The bank sought recovery of Rs 50,50,762 with interest at 15% per annum from 17 February 2019, plus Rs 20 lakh as compensation for financial loss, reputational harm, and consequential damages.
BSNL entered appearance and filed objections, contending that the fraud arose from internal lapses within the co-operative bank and that there was a nexus between the fraudsters and the bank's own officials or those of Canara Bank. BSNL also argued that criminal proceedings were pending and the matter was premature. Canara Bank entered appearance but did not file objections.
Conciliation attempts failed. The Permanent Lok Adalat adjudicated the dispute on merits, partly allowed the claim, and directed BSNL to pay Rs 5,00,000 with interest at 6% per annum from 1 March 2021. The claim against Canara Bank was dismissed. Both BSNL and the co-operative bank challenged this award before the High Court.
The Jurisdictional Challenge: Whether the Permanent Lok Adalat Could Hear the Dispute
BSNL's primary argument before the High Court was that the Permanent Lok Adalat lacked jurisdiction. Sri A.N. Gangadharaiah, counsel for BSNL, advanced three distinct grounds.
First, he argued that while BSNL is a telephone service provider and therefore a “public utility service” under Section 22A(b)(ii) of the Legal Services Authorities Act, the character of the dispute — not the identity of the party — determines jurisdiction. The dispute, he said, involved cheating, fraud, criminal conspiracy and impersonation, not a deficiency in telecom service.
Second, he relied on the first proviso to Section 22C(1), which bars the Permanent Lok Adalat from exercising jurisdiction over “any matter relating to an offence not compoundable under any law.” Criminal proceedings for cheating and fraud, which are non-compoundable, were already pending before the Cyber Crime Police when the PLA proceedings were initiated. He also relied on Section 22C(8), which empowers the Permanent Lok Adalat to decide a dispute only “if the dispute does not relate to any offence.”
Third, he contended that the value of the property in dispute far exceeded the Rs 10 lakh ceiling in the second proviso to Section 22C(1), and that no valid Central Government notification increasing this limit had been placed on record.
Sri Mahesh R. Uppin, counsel for the co-operative bank, countered that the proceedings were a civil claim for monetary compensation for deficiency in telephone service. A civil compensation claim does not “relate to an offence” merely because the underlying facts also disclose criminal offences committed by third parties. He further submitted that the monetary ceiling objection had never been raised before the Permanent Lok Adalat, and BSNL could not raise it for the first time in writ proceedings after fully contesting the matter on merits.
Justice Govindaraj rejected all of BSNL's jurisdictional arguments. The court held that the expression “matter relating to an offence not compoundable under any law” in the first proviso to Section 22C(1) refers to matters that are intrinsically criminal in nature — where the very substance and resolution of the proceedings requires an inquiry into whether an offence was committed, by whom, and what punishment should follow. A civil compensation claim, even one arising from facts that also constitute criminal offences, does not fall within this category.
The court applied four principles of statutory construction: the beneficial purpose of Chapter VI-A (providing a pre-litigation forum for public utility service disputes); purposive construction of the first proviso (preventing compounding of non-compoundable offences through the PLA settlement mechanism, not barring civil claims); strict construction of exclusions from a beneficent provision; and avoidance of absurd results. Accepting BSNL's interpretation, the court observed, would exclude from PLA jurisdiction complaints against insurance companies involving fraudulent repudiation of claims, complaints against power utilities involving meter tampering, complaints against postal services involving theft of parcels, and complaints against hospitals involving criminal medical negligence — a result the legislature plainly did not intend.
On Section 22C(8), the court held that the condition “if the dispute does not relate to any offence” was satisfied: the dispute was a civil compensation claim and did not relate to any offence. The Permanent Lok Adalat was therefore not merely empowered but obligated to decide the dispute. The monetary ceiling objection was rejected on the ground that the Central Government had increased the limit by notification, and in any event BSNL had waived the objection by not raising it before the PLA.
Negligence and Proximate Cause: The Duplicate SIM as the Originating Event
The court then examined whether the unauthorised issuance of the duplicate SIM card amounted to negligence attributable to BSNL and whether it was the proximate cause of the loss.
Justice Govindaraj explained the technological architecture at the centre of the case. Internet banking uses two-factor authentication: “something you know” (login credentials held exclusively by the account holder) and “something you have” (the registered mobile phone, which receives the OTP). Both factors must be presented together to authenticate a transaction. In a SIM swap fraud, once the duplicate SIM is activated, the original SIM is deactivated within seconds. All calls and SMS messages, including OTPs, are diverted to the duplicate SIM. Armed with login credentials and the OTPs received on the duplicate SIM, the fraudster can complete transactions at will.
In the present case, seven RTGS/NEFT transactions amounting to Rs 87,70,000 were completed overnight on 6–7 February 2019, each authenticated by an OTP received on the duplicate SIM. Without the duplicate SIM, no OTP could have been intercepted; without the OTP, no transaction could have been completed.
The court held that the issuance of a SIM card, including a duplicate SIM card, is a core function of BSNL's telephone service. The allegation against BSNL was that its official issued a duplicate SIM without proper verification and without the subscriber's authorisation. This act, whether negligent or fraudulent, was fundamentally an act performed in the course of providing a telephone service. The duty of care owed by BSNL in relation to SIM issuance was calibrated to the severity of the potential harm: a mobile number registered for OTP purposes by a banking institution conducting high-value transactions demanded the highest degree of care and due diligence in verifying the identity and authority of any applicant for a duplicate SIM.
BSNL argued that the compromise of the co-operative bank's login credentials — also necessary for the fraud — broke the chain of causation. The court rejected this. The doctrine of novus actus interveniens requires the intervening act to be independent, voluntary, and wholly unconnected from the original breach. The use of stolen credentials by the fraudsters was their own criminal act, not an act of the co-operative bank, and not one the co-operative bank could have anticipated or prevented in the circumstances. Moreover, the credentials alone were legally insufficient to enable the fraud: without the OTPs, no transaction could be completed. BSNL's act provided the missing link that made the fraud possible.
The court drew an adverse inference from BSNL's failure to produce its subscriber records, SIM issuance logs, identity verification documents, and system records of the SIM swap activation. These records were exclusively within BSNL's possession and control. BSNL chose not to produce any of them before the Permanent Lok Adalat or before the High Court. Applying the principle codified in Section 114, illustration (g) of the Indian Evidence Act, 1872, the court inferred that these records, if produced, would have shown that no proper verification was conducted before the duplicate SIM was issued.
The court also addressed BSNL's argument based on the charge sheet filed by the Cyber Crime Police, which gave up the BSNL Manager from prosecution for want of sufficient evidence. The court rejected this argument squarely: civil liability and criminal liability are governed by entirely different standards of proof. A prosecutorial decision that evidence is insufficient to sustain a criminal conviction beyond reasonable doubt does not constitute a finding that the person was not negligent. The same evidence may be entirely sufficient to establish civil negligence on the balance of probabilities.
Vicarious Liability of BSNL and Exoneration of Canara Bank
BSNL contended that even if the issuance of the duplicate SIM amounted to negligence, it could not be held vicariously liable because Mr. Karunakaran, the official allegedly responsible, was not acting within the course and scope of his employment. BSNL argued that issuing a SIM without following prescribed verification procedures, and allegedly in collusion with criminals, was an act of personal criminal misconduct committed for his personal benefit, wholly outside the scope of his authorised duties.
The court rejected this argument. It applied the distinction between the “nature” of the act and the “manner” of its performance. The nature of the act — issuance of a SIM card, including a duplicate SIM card — was squarely within the scope of functions entrusted to officials at BSNL's subscriber management offices. The manner of performance — without verification, in alleged collusion with fraudsters — was wrongful. But the wrongful manner does not change the nature of the act and does not take it outside the course of employment.
The court applied the “close connection” test: Mr. Karunakaran used BSNL's subscriber management system, BSNL's official records, BSNL's office infrastructure, and BSNL's authority to issue SIM cards. He performed the act within BSNL's office, during office hours, wielding the authority of his employer. From the co-operative bank's perspective, the duplicate SIM was issued by BSNL itself.
The court also turned BSNL's own conduct against it. BSNL had initiated departmental disciplinary proceedings against Mr. Karunakaran, and the Chief General Manager had on 9 April 2025 recommended such proceedings. Mr. Karunakaran had been arrayed as an accused and remanded to judicial custody. The court held that the initiation of disciplinary proceedings was conclusive evidence that Mr. Karunakaran was acting in the course of his employment: disciplinary proceedings are only available against an employee for acts committed in the course of employment. An employer cannot simultaneously initiate disciplinary proceedings against an employee for an act and deny that the act was committed in the course of employment.
On Canara Bank's liability, the court affirmed the Permanent Lok Adalat's finding of exoneration. Canara Bank's internet banking architecture operated on multi-factor authentication. The primary login credentials — user identification and password — remained exclusively within the knowledge and control of the account holder. Canara Bank neither stored nor communicated these credentials to third parties. For the fraudulent transactions to have been completed, access to the login credentials was also necessary; if those credentials reached unauthorised persons, that could only have occurred due to compromise at the end of the co-operative bank itself, not due to any act attributable to Canara Bank. No specific allegation of negligence on Canara Bank's part relating to its banking systems was established on the record.
Treatment of Insurance Proceeds and Other Recoveries
BSNL argued that the co-operative bank had received insurance reimbursement of Rs 57,65,329 from its insurer, in addition to the Rs 7,12,238 recovered through police proceedings and the Rs 30,00,000 reverse-credited to its account. On this basis, BSNL contended that the co-operative bank had been fully compensated and there was no justification for directing BSNL to pay any additional amount.
The court rejected this argument in part. It drew a distinction between direct recoveries of the stolen funds and collateral insurance proceeds. The Rs 7,12,238 recovered through police proceedings and the Rs 30,00,000 reverse-credited to the account were direct recoveries of the stolen funds and were properly deducted in arriving at the net compensable loss of Rs 50,50,762. However, the insurance proceeds were a collateral benefit flowing from an independent contractual relationship between the co-operative bank and its insurer, funded by the co-operative bank's own premium payments. A wrongdoer cannot take advantage of collateral benefits received by the injured party from independent sources. Accepting BSNL's contention would result in BSNL deriving benefit from the co-operative bank's prudence in obtaining insurance coverage. The insurer's subrogation rights were also preserved by the court's order.
Order
W.P. No. 4674 of 2025, filed by BSNL, was dismissed. The findings of negligence, vicarious liability, and the direction to pay compensation, as contained in the Permanent Lok Adalat's award dated 9 August 2024 in PLD No. 64 of 2021, were affirmed subject to the enhancement of quantum.
W.P. No. 16104 of 2025, filed by the co-operative bank, was partly allowed. The award was modified as to quantum. BSNL was directed to pay the following amounts to Basaveshwara Pattana Sahakara Bank Niyamitha within three months from the date of the order: