Banks Must Take Steps To Prevent SIM Swap Fraud, Says Karnataka High Court

The Karnataka High Court highlighted the growing threat of cybercrime while hearing an appeal and held Bharat Sanchar Nigam Limited (BSNL) liable for SIM swap fraud. The fraud drained around Rs 88 lakh from a cooperative bank’s account in 2019. Justice Suraj Govindraj emphasised that a telecom provider cannot escape its responsibility when their negligence or an official’s misconduct directly enables financial theft.

In this case, the Basaveshwara Pattana Sahakara Bank Niyamitha, Shiralkoppa, in Shivamogga district, fell victim to a SIM swap attack between February 6 and 7, 2019. Fraudsters managed to procure a duplicate SIM card linked to the bank’s registered mobile number from BSNL without proper verification. This allowed them (fraudsters) to intercept the one-time passwords (OTPs) supposed to be received only by the bank. They then executed seven unauthorised real-time gross settlement (RTGS), and national electronic fund transfer (NEFT) transactions amounting to Rs 87.70 lakh, as per the LiveLawBiz report.

Upon finding the fraudulent transactions, the bank sought legal recourse to recover the loss. The bank approached the Permanent Lok Adalat (PLA) and filed the claim against both BSNL and Canara Bank. The bank argued that the dispute was a civil claim because it happened due to a deficiency in telephone services and contended that it was BSNL’s failure to secure the SIM issuance process.

While the fraud occurred in 2019, it took more than five years for the legal matter to reach a milestone. On August 9, 2024, the Permanent Lok Adalat delivered its award. The adalat directed BSNL to pay Rs 5 lakh in compensation along with a 6 per cent interest per annum to the bank, starting from March 1, 2021.

Considering it an inadequate awareness, the cooperative bank challenged this decision in the Karnataka High Court in 2025. On the other hand, BSNL also filed a petition challenging the decision about their liability in the fraud.

Upon hearing the parties, the court observed that the harm was swift, severe, and largely irreversible when the fraud occurred. It found that the unauthorised issuance of the duplicate SIM was a critical security failure and the primary fault.

The court held that the verification of the subscriber’s identity is not a mere formality. It is a critical security measure, and millions of bank account holders’ financial safety depends on it.

The court held the telecom company liable for the financial loss and directed it (BSNL) to pay Rs 50,50,762, along with 9 per cent interest per annum from February 2, 2019 (the last date of the fraudulent transaction) until the date of actual payment. In addition to this, it also ordered BSNL to pay Rs 5 lakh in consequential damages.

While the court held BSNL primarily liable for the fault, it also warned the bank involved. It emphasised that banks must become proactive to protect themselves and their customers from SIM swap fraud. It suggested the steps, such as registering multiple OTP delivery channels for faster detection of security compromise, implementing time delays for large transactions following SIM swap, sending transaction alerts to alternate communication channels, and educating customers about awareness initiatives regarding cyber risks.

FAQs