Karnataka High Court Holds BSNL Liable For Enabling Bank Fraud; Directs Compensation Of ₹50 Lakh; Urges Strict Duty Of Care In Digital Banking Operations

The Court directed BSNL to compensate the affected co-operative bank to the extent of approximately ₹50 lakh after finding that the unauthorised issuance of a duplicate SIM card enabled diversion of One-Time Passwords (OTPs), thereby facilitating fraudulent RTGS/NEFT transactions from the bank’s current account.

The Court was hearing two connected writ petitions challenging an award passed by the Permanent Lok Adalat, Dakshina Kannada, arising out of fraudulent online banking transactions involving unauthorised transfer of ₹87.70 lakh from the account of Sri Basaveshwara Pattana Sahakara Bank Niyamitha maintained with Canara Bank.

A Bench of Justice Suraj Govindaraj observed: “The issuance of a SIM card, including a duplicate SIM card, is a core function of BSNL's telephone service. The allegation against BSNL is that its official issued a duplicate SIM card without proper verification and without the subscriber's authorisation. This act, whether negligent or fraudulent, is fundamentally an act performed in the course of providing a telephone service. Any civil claim for compensation arising from such an act is a claim for deficiency in telephone service”.

The Court further observed: “The issuance of the duplicate SIM card without verification amounted to negligence and deficiency in service, and was the proximate cause of the loss”.

The Bench also underscored the evolving obligations of telecom operators in digital banking systems, observing: “Telecom service providers like BSNL are critical infrastructure providers. They hold in trust the mobile connectivity upon which millions of citizens and institutions depend for their financial security. With this position of trust comes an unequivocal obligation: to guard the gate conscientiously, to verify identity rigorously before issuing duplicate SIM cards, and to treat every such request with the gravity it deserves. When a gatekeeper opens the gate to a fraudster, whether through negligence or through the misconduct of its own official, it enables the fraud and must bear the civil consequences”.

Advocate Mahesh R. Uppin appeared for the Co-operative Bank. Advocate A.N. Gangadharaiah appeared for BSNL. Advocate M. Mohan Rao appeared for Canara Bank. Mahantesh Shetter, AGA, appeared for the State.

Background

The Co-operative Bank maintained a current account with Canara Bank and had availed internet banking facilities linked to a BSNL mobile number registered for OTP authentication.

According to the case records, on 07.02.2019, the Co-operative Bank detected seven unauthorised RTGS/NEFT transactions carried out between 06.02.2019 and 07.02.2019 involving transfers aggregating to ₹87.70 lakh.

The Bank immediately informed Canara Bank and lodged a complaint before the Cyber Crime Police Station, Bengaluru, on 08.02.2019. During the investigation, it allegedly emerged that unknown persons had procured a duplicate SIM card pertaining to the registered BSNL mobile number linked to the Bank’s internet banking account, thereby gaining access to OTP-based authentication required for online transactions.

The Co-operative Bank contended that the duplicate SIM had been issued without any request, authority or consent from the Bank and that such issuance directly enabled the fraudulent transactions.

Although ₹30 lakh was subsequently reverse-credited and ₹7.12 lakh was recovered during police investigation, the Bank asserted that a substantial amount remained unrecovered. It thereafter initiated proceedings before the Permanent Lok Adalat seeking compensation from BSNL and Canara Bank.

The Permanent Lok Adalat partly allowed the claim and directed BSNL to pay ₹5 lakh compensation with interest while dismissing the claim against Canara Bank. Both BSNL and the Co-operative Bank challenged the award before the High Court.

Court’s Observation

Permanent Lok Adalat Had Jurisdiction Over Dispute

BSNL initially challenged the jurisdiction of the Permanent Lok Adalat by contending that the dispute related to fraud, cheating and non-compoundable offences and therefore fell outside the scope of proceedings under Chapter VI-A of the Legal Services Authorities Act, 1987.

Rejecting the contention, the High Court held that the proceedings before the Permanent Lok Adalat were essentially civil proceedings seeking monetary compensation for deficiency in telephone service and not criminal adjudication.

The Court observed: “The proceedings before the Permanent Lok Adalat were initiated by the Co-operative Bank as a civil claim for recovery of monetary compensation for financial loss suffered on account of deficiency in BSNL's telephone service. The relief sought was payment of money as compensation. The Permanent Lok Adalat was not asked to determine whether any offence was committed, to convict any person, or to impose any penalty.”

The Court further held: “A civil compensation claim, even one arising from facts that also constitute criminal offences, does not 'relate to an offence' in this sense. Its resolution requires only a determination of civil liability on the balance of probabilities. It does not require adjudication of criminal guilt, does not result in punishment, and does not affect any State interest in prosecution.”

The High Court observed that accepting BSNL’s interpretation would defeat the entire purpose behind establishing Permanent Lok Adalats for expeditious adjudication of disputes concerning public utility services.

Duplicate SIM Enabled Entire Fraudulent Chain

The Court held that the issuance of the duplicate SIM card was not a mere procedural irregularity but the foundational event that enabled the fraudulent banking transactions.

The Bench observed: “The issuance of the duplicate SIM card constituted the proximate cause of the loss suffered by the Cooperative Bank, as it directly enabled the diversion of OTPs and thereby made possible the authentication and completion of the fraudulent transactions”.

The Court further observed that the registered mobile number was directly linked to sensitive financial transactions and therefore telecom service providers were expected to exercise the “highest degree of care and due diligence” before issuing duplicate SIM cards.

Duty Of Care In OTP-Based Authentication And Digital Financial Systems

The High Court made detailed observations regarding the role of telecom providers and banks in the digital banking environment.

The Court observed: “BSNL's officials are expected to exercise the degree of care that a responsible licensed operator in that position must exercise. The standard of care applicable to a licensed public utility service provider is higher than that applicable to an ordinary commercial entity, precisely because public utility service providers occupy a position of trust and their failures can cause widespread harm”.

It further held that the issue was not confined merely to a telecom transaction but involved broader implications concerning banking security and digital authentication systems increasingly dependent on mobile infrastructure.

The Court observed that modern digital payment systems, including internet banking, NEFT, RTGS and UPI platforms, fundamentally rely upon OTP-based two-factor authentication as the final layer of security protecting customer accounts and financial transactions. In such a framework, the integrity of SIM issuance and SIM replacement mechanisms assumes central importance.

The Bench noted that once a duplicate SIM card is improperly issued to an unauthorised person, the entire authentication architecture underlying digital banking systems collapses, since OTP access effectively translates into transactional access over the linked banking account.

Underscoring the systemic significance of the issue, the Court observed: “This Court pauses to note the broader significance of this case. India's digital economy depends on the integrity of the OTP-based authentication architecture. The Government of India's Digital India programme, the NEFT and RTGS payment systems, the UPI ecosystem, and virtually every internet banking platform use OTP-based 2FA as the last line of defence. That last line of defence is only as strong as the telecom service provider's fidelity to the obligation of exclusive SIM control. When a telecom company, through its official channels, issues a duplicate SIM to a fraudster, it demolishes that last line of defence and exposes the subscriber to catastrophic financial loss. The duty of care of telecom service providers in relation to SIM issuance is therefore not a peripheral concern; it is central to the integrity of the digital financial system.”

BSNL Liable for Acts of Its Employees

The Court rejected BSNL’s attempt to avoid liability by attributing the wrongdoing to its individual employee. The Court noted that issuance of SIM cards and duplicate SIM cards formed part of the regular duties entrusted to BSNL officials and were undertaken through systems and infrastructure controlled by BSNL itself.

The Bench observed: “The argument that BSNL did not 'authorise' the specific act (issuance without verification) is rejected. The employer's vicarious liability is not confined to acts which the employer explicitly authorised. The employer is liable for wrongful acts committed by the employee in the exercise of functions the employer entrusted to him. When the employee performs those functions improperly, the employer is liable to the third party, even if the employer did not authorise and would not have approved the improper performance”.

“BSNL is a public sector undertaking of the Government of India. It owes an elevated duty of accountability to the citizens it serves. When a PSU's official misuses his official authority, whether negligently or corruptly, to cause financial loss to a member of the public, the PSU must answer for it”, the Bench added.

The Court also noted that BSNL itself had initiated disciplinary proceedings against the concerned official and that the official had been arrayed as an accused during the investigation.

Insurance Payment Did Not Extinguish BSNL’s Liability

BSNL contended that since the Co-operative Bank had received insurance reimbursement and certain recovered amounts, no further compensation could be awarded.

Rejecting the contention, the Court held that insurance proceeds arose from an independent contractual arrangement between the Bank and the insurer and could not be appropriated by the wrongdoer to avoid liability.

The Court observed: “The insurance proceeds arose from an independent contractual arrangement between the Co-operative Bank and its insurer. The Cooperative Bank paid insurance premiums over the years and earned the right to indemnification under the policy. These proceeds are the realisation of the Bank's own investment in financial protection. BSNL had no role in procuring the insurance, paying the premiums, or maintaining the coverage. To allow BSNL to reduce its liability by the amount of the insurance proceeds would be to allow BSNL to benefit from the Co-operative Bank's own prudence, at no cost to BSNL.”

Canara Bank Not Liable

The High Court upheld the finding exonerating Canara Bank from liability.

The Court observed: “The Permanent Lok Adalat's finding that Canara Bank is not liable for the loss suffered by the Co-operative Bank is correct in law and fact, for the detailed reasons set out under Point 3. The Co-operative Bank shall have no claim against Canara Bank arising from the disputed transactions. No relief is granted against Canara Bank”.

Conclusion

The High Court ultimately upheld the finding regarding negligence attributable to BSNL and substantially enhanced the compensation payable to the Co-operative Bank.

The Court held that unauthorised issuance of the duplicate SIM card directly facilitated diversion of OTP authentication and constituted the originating cause of the fraudulent online banking transactions. It further held that telecom service providers owe a heightened duty of care while dealing with SIM replacement requests connected to digital banking operations.

Cause Title: Sri Basaveshwara Pattana Sahakara Bank Niyamittha v. Canara Bank & Connected Matter (Neutral Citation: 2026:KHC:25587)

Click here to read/download Judgment