Karnataka HC Holds BSNL Liable for SIM Swap Fraud Effective June 2026

The Karnataka High Court, in a ruling on June 5, 2026, held Bharat Sanchar Nigam Limited (BSNL) liable for a cooperative bank's loss of Rs 50,50,762 following a SIM swap fraud. The court determined that the negligent issuance of a duplicate Subscriber Identity Module (SIM) card was the proximate cause of the theft, which enabled unauthorized RTGS and NEFT transactions.

What Changed

The court overturned a previous Permanent Lok Adat award that had granted the bank only Rs 5 lakh. Instead, it directed BSNL to pay the full net loss of Rs 50,50,762 plus Rs 5 lakh in consequential damages. The ruling includes a 9% annual interest rate effective from February 7, 2019, and a default interest rate of 12% if payment is not made within a three-month window.

Key Provisions and Liability

The ruling establishes several critical legal precedents regarding telecom service providers (TSPs):

• TSP as Custodian: The court treated the TSP as a custodian of mobile connectivity, akin to a vault keeper, holding them responsible for frauds enabled by careless or dishonest SIM issuance.
• Proximate Cause: The duplicate SIM was identified as the direct cause of the loss, as the interception of One-Time Passwords (OTPs) would have been impossible without the SIM swap.
• Vicarious Liability: BSNL was held vicariously liable for its employee's actions, rejecting arguments that the absence of criminal chargesheets absolved the company of civil negligence.
• Insurance Offset: The court ruled that insurance proceeds from independent policies cannot be used to reduce the wrongdoer's liability.

Operational Impact

This ruling highlights a structural vulnerability in India's digital payments architecture, where the mobile number serves as the master channel for OTP-based authentication across UPI, internet banking, and RTGS/NEFT transfers. While device binding protects the UPI app itself, it does not protect the fallback channels that rely on SMS-based OTPs. Telecom operators must now ensure rigorous verification processes for duplicate SIM requests to mitigate significant civil liability risks.

Financial institutions and telecom operators should monitor the implementation of TRAI's cooling-off periods and DoT's SIM binding mandates to ensure compliance with evolving security standards.

Source: Duplicate SIM exposes a structural flaw in UPI, Karnataka HC ruling shows
Domain: medianama.com