A duplicate SIM, stolen OTPs and ₹87 lakh gone: Know why BSNL is now paying ₹55 lakh
The court said that a mobile number being transferred to a stranger without the subscriber's knowledge was not something that could happen in the normal course of events.
- Jun 7, 2026,
- Updated Jun 7, 2026 3:32 PM IST
The Karnataka High Court has held BSNL responsible for a SIM-swap fraud that helped cybercriminals steal more than ₹87 lakh from a cooperative bank's account. The court found that a duplicate SIM card was issued without the bank's permission, allowing fraudsters to receive OTPs and carry out unauthorised transactions, according to a report by Bar & Bench.
Justice Suraj Govindaraj dismissed BSNL's challenge to a compensation order and increased the amount to be paid to Sri Basaveshwara Pattana Sahakara Bank Niyamitha. The court directed BSNL to pay ₹50,50,762 as compensation, ₹5 lakh as consequential damages, and interest at 9 per cent per annum from February 7, 2019.
Don't Miss: 'Bottom of the pyramid is not growing': Niranjan Hiranandani sounds alarm on affordable housing
How the fraud happened
The cooperative bank had a current account with Canara Bank and used a BSNL mobile number to receive OTPs for internet banking transactions.
Between February 6 and 7, 2019, seven unauthorised RTGS and NEFT transactions worth ₹87.7 lakh were made from the bank's account.
An inquiry later found that an unknown person had obtained a duplicate SIM card linked to the bank's registered mobile number from a BSNL office in Bengaluru. The SIM was issued without the bank's request, consent or knowledge.
The fraudsters used OTPs received on the duplicate SIM to complete the transactions.
Out of the total amount lost, ₹30 lakh was later reversed and ₹7.12 lakh was recovered by the Cyber Crime Police. However, the bank still suffered a loss of ₹50,50,762.
The bank sent legal notices to BSNL and Canara Bank in January 2021 and later approached the Permanent Lok Adalat in Mangaluru. The tribunal found BSNL negligent but awarded only ₹5 lakh in compensation. Both sides then moved the High Court.
Why the court blamed BSNL
The High Court looked at several issues, including whether BSNL was negligent and whether it could be held responsible for the actions of its employee.
The court said BSNL had a greater responsibility because the mobile number belonged to a bank and was being used for OTP-based authentication of financial transactions.
"The duty is particularly heightened when the subscriber is a banking institution that has registered the mobile number for OTP-based authentication of high-value financial transactions. The potential for catastrophic financial harm from a negligent SIM swap in such a case is disproportionately high. Heightened risk demands a heightened standard of care," the court observed.
The court also said that a mobile number being transferred to a stranger without the subscriber's knowledge was not something that could happen in the normal course of events.
"The very fact that a duplicate SIM reached a non-subscriber is proof that verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless," the court held.
The bench noted that a BSNL official, Mr. Karunakaran, had been identified as the person who issued the duplicate SIM. It also pointed out that BSNL had started disciplinary proceedings against him.
"BSNL cannot maintain two contradictory positions simultaneously: that the act was within official employment so as to justify disciplinary proceedings, and that it was outside official employment so as to escape vicarious liability," Justice Govindaraj stated.
Insurance payment does not reduce BSNL's liability
BSNL argued that since the Cyber Crime Police had not filed a chargesheet against its manager, it could not be held responsible. The court rejected the argument.
"The same evidence that may be insufficient for a criminal conviction may be entirely sufficient to establish civil negligence on the balance of probabilities," the court said.
BSNL also argued that the bank had already received ₹57.65 lakh from its insurer and recovered additional amounts, taking the total recovery above the ₹87.7 lakh fraud amount.
The court rejected this argument as well.
"It would be deeply unjust to allow BSNL to escape liability because the Co-operative Bank had prudently insured itself. It is like saying that because a robbery victim received compensation from his insurer, the robber need not pay or cannot be prosecuted."
The Karnataka High Court has held BSNL responsible for a SIM-swap fraud that helped cybercriminals steal more than ₹87 lakh from a cooperative bank's account. The court found that a duplicate SIM card was issued without the bank's permission, allowing fraudsters to receive OTPs and carry out unauthorised transactions, according to a report by Bar & Bench.
Justice Suraj Govindaraj dismissed BSNL's challenge to a compensation order and increased the amount to be paid to Sri Basaveshwara Pattana Sahakara Bank Niyamitha. The court directed BSNL to pay ₹50,50,762 as compensation, ₹5 lakh as consequential damages, and interest at 9 per cent per annum from February 7, 2019.
Don't Miss: 'Bottom of the pyramid is not growing': Niranjan Hiranandani sounds alarm on affordable housing
How the fraud happened
The cooperative bank had a current account with Canara Bank and used a BSNL mobile number to receive OTPs for internet banking transactions.
Between February 6 and 7, 2019, seven unauthorised RTGS and NEFT transactions worth ₹87.7 lakh were made from the bank's account.
An inquiry later found that an unknown person had obtained a duplicate SIM card linked to the bank's registered mobile number from a BSNL office in Bengaluru. The SIM was issued without the bank's request, consent or knowledge.
The fraudsters used OTPs received on the duplicate SIM to complete the transactions.
Out of the total amount lost, ₹30 lakh was later reversed and ₹7.12 lakh was recovered by the Cyber Crime Police. However, the bank still suffered a loss of ₹50,50,762.
The bank sent legal notices to BSNL and Canara Bank in January 2021 and later approached the Permanent Lok Adalat in Mangaluru. The tribunal found BSNL negligent but awarded only ₹5 lakh in compensation. Both sides then moved the High Court.
Why the court blamed BSNL
The High Court looked at several issues, including whether BSNL was negligent and whether it could be held responsible for the actions of its employee.
The court said BSNL had a greater responsibility because the mobile number belonged to a bank and was being used for OTP-based authentication of financial transactions.
"The duty is particularly heightened when the subscriber is a banking institution that has registered the mobile number for OTP-based authentication of high-value financial transactions. The potential for catastrophic financial harm from a negligent SIM swap in such a case is disproportionately high. Heightened risk demands a heightened standard of care," the court observed.
The court also said that a mobile number being transferred to a stranger without the subscriber's knowledge was not something that could happen in the normal course of events.
"The very fact that a duplicate SIM reached a non-subscriber is proof that verification was either not conducted, or was conducted in so perfunctory a manner as to be worthless," the court held.
The bench noted that a BSNL official, Mr. Karunakaran, had been identified as the person who issued the duplicate SIM. It also pointed out that BSNL had started disciplinary proceedings against him.
"BSNL cannot maintain two contradictory positions simultaneously: that the act was within official employment so as to justify disciplinary proceedings, and that it was outside official employment so as to escape vicarious liability," Justice Govindaraj stated.
Insurance payment does not reduce BSNL's liability
BSNL argued that since the Cyber Crime Police had not filed a chargesheet against its manager, it could not be held responsible. The court rejected the argument.
"The same evidence that may be insufficient for a criminal conviction may be entirely sufficient to establish civil negligence on the balance of probabilities," the court said.
BSNL also argued that the bank had already received ₹57.65 lakh from its insurer and recovered additional amounts, taking the total recovery above the ₹87.7 lakh fraud amount.
The court rejected this argument as well.
"It would be deeply unjust to allow BSNL to escape liability because the Co-operative Bank had prudently insured itself. It is like saying that because a robbery victim received compensation from his insurer, the robber need not pay or cannot be prosecuted."