Electronics, Information Technology and Artificial Intelligence Department, Mumbai: In a complaint preferred under Sections 43, 43(A), 66, 61 and 72-A read with Sections 85 and 46, Information Technology Act, 2000, regarding cyber fraud where complainant’s bank account credentials were hacked siphoning money to another account, the Adjudicating Officer Virendra Singh held the telecommunication services provider, i.e. Vodafone liable for negligent issuance of duplicate SIM leading to SIM-Swap fraud and directed to pay damages of ₹1,00,000 to the complainant on account of its structural negligence and deficient internal controls, and directed Respondent 3, i.e. Central Bank of India, to pay the complainant 12 per cent annual interest on the blocked principal amount as they failed to perform the physical release and remittance of the contractually frozen amount even after an interim order dated 9 May 2022, thereby unlawfully disrupting the velocity of the complainant’s capital despite the judicial intervention causing an unjustifiable operational delay in the final remittance of the tracked funds.
Background
A complaint was preferred under Sections 43, 43(A), 66, 61 and 72-A read with Sections 85 and 46, IT Act, with respect to a cyber fraud incident, against ICICI Bank (Respondent 1), Idea Cellular Ltd., i.e. Vodafone (Respondent 2) and Central Bank of India (Respondent 3) for their respective corporate omissions, systemic failures and statutory infractions. The FIR was registered under Section 66-D, IT Act.
The Complainant had sought aggregate compensation of ₹7,00,000, together with interest at 15% per annum, and legal and incidental expenses quantified at ₹2,00,000.
The complainant availed internet banking facilities on his salary savings bank account with Respondent 1 with secure access credentials, telecommunication services were provided by Respondent 2 mapping his registered mobile number to his internet banking profile for the receipt of transactional SMS alerts and secure one-time passwords (OTPs).
On 25 June 2013, at approximately 1.00 p.m., the complainant’s registered mobile SIM card was abruptly deactivated and disconnected from the cellular network resulting in a total blackout of network access, during which a fraudster procured a duplicate SIM card from a franchise office controlled by Respondent 2, without the complainant’s authorisation, consent, or any semblance of legitimate identity verification, gaining unauthorised access into the complainant’s secure electronic banking portal to intercept the requisite transactional authorisations and executed 2 successive unauthorised online National Electronic Funds Transfers (NEFT), siphoning away a sum of ₹5,30,000.
An emergency freeze was sought, acting upon which Respondent 1 intercepted and successfully froze the secondary fraudulent transaction of ₹31,000 re crediting it to complainant’s account.
Balance of ₹4,88,360, from the initial net loss of ₹4,99,928.091, resulting from the first transfer was successfully traced and placed under a regulatory lien within the beneficiary destination account hosted by Respondent 3, lying frozen pending formal adjudication.
Contentions
The complainant stated that the financial loss suffered was a direct and proximate consequence of gross institutional negligence, systemic vulnerabilities, and clear statutory omissions on the part of the respondents.
As per the complainant, Respondent 1 failed to deploy reasonable security practices and procedures, such as enforcing mandatory cooling-off or breathing periods upon the creation of new transaction beneficiaries as instructed by Reserve Bank of India (RBI) Guidelines, thereby attracting liability under Section 43-A, IT Act.
Respondent 2 committed severe infraction of the mandatory know your customer (KYC) guidelines prescribed by the Department of Telecommunications (DoT) and the Telecom Regulatory Authority of India (TRAI), by issuing a duplicate SIM card to an unverified third party without validating the primary identification documents, thereby occasioning a breach of confidentiality and security under Section 72-A read with Section 85, IT Act.
Respondent 3 failed to exercise due diligence and failed to monitor suspicious credit inflows or perform standard KYC validations on a suspicious beneficiary account, while simultaneously delaying the administrative reversal and restoration of the remaining frozen corpus of ₹4,88,360 back to the lawful owner.
Respondent 1, denying any liability, corporate omission or lack of due diligence, contended that they operate under the highest tiers of secure electronic protocols, featuring robust encryption and multi-factor authentication systems that fully satisfy the statutory mandates of “reasonable security practices and procedures” prescribed under Section 43-A, IT Act. The bank punctually and systematically transmitted the mandatory transactional OTPs and SMS alerts and the primary compromise did not originate from the bank’s secure servers, database infrastructure or any interior system vulnerability but was entirely triggered by an external breach of the complainant’s telecommunication link. Moreover, they demonstrated exemplary due diligence by instantly intercepting and freezing the secondary fraudulent transaction of ₹31,000 as the first one had already cleared the bank’s systems through automated electronic channels.
Respondent 2 submitted that it functions strictly within the regulatory parameters, circulars, and standard operating procedures set forth by the DoT and TRAI. The issuance of the duplicate SIM card from the franchise outlet was executed upon the documents presented by an applicant representing themselves to be the lawful subscriber and in absence of forensic machinery or deep-tier criminal verifications or biometric handwriting analysis, any forgery committed by an unknown third-party fraudster cannot be equated to institutional or corporate negligence. No direct, proximate causal nexus between the temporary deactivation of the SIM card and the electronic compromise of the confidential internet banking credentials was established. The SIM card alone cannot facilitate a financial siphon unless the user’s highly confidential online banking passwords, transaction PINs, and login IDs had already been compromised.
Respondent 3 submitted that they were merely a proforma party to the present adjudication, with no direct allegations of cyber fraud, electronic hacking, or statutory contravention. The account which received the primary fraudulent credit inflow was opened and maintained under standard KYC compliances. Operating within the automated clearing networks of RBI, they were statutorily bound to execute and credit incoming NEFT seamlessly. The bank had no prior institutional knowledge, electronic warnings, or systemic indicators to suggest that the incoming credit pool was the product of an illicit siphoning operation initiated at another bank. They acted swiftly and in accordance with law, upon receiving a regulatory freeze directive and placed an administrative lien over the account, thereby, preserving a core balance of 4,88,360.
Analysis
The Court observed that the primary catalyst for the entire cyber fraud infrastructure was the unauthorised and negligent deactivation of the complainant’s genuine SIM card and issuance of a duplicate to an unverified third party by Respondent 2, established by itemised billing records and that they failed to present any proof demonstrating that identity verification was conducted at their franchise outlet prior to overriding the genuine subscriber’s network link.
The Court held that the defense that a telecom provider cannot forensically verify every document is legally untenable. DoT and TRAI have laid down strict, non-negotiable KYC guidelines to mitigate the risk of “SIM-swap” frauds and by permitting its franchise outlet to issue a duplicate SIM card without validating the credentials of the applicant against the master records of the genuine subscriber, Respondent 2 committed a gross infraction of its statutory duty.
The Court noted that the principal amount siphoned via the cyber fraud mechanism had been fully recovered and re-credited to the complainant but Respondent 3 caused an unjustifiable operational delay in executing the final remittance of the tracked funds from interim order dated 9 May 2022 up to the date of final actualisation and release, i.e., 17 May 2024. Therefore, while the principal financial loss suffered stands mitigated by way of subsequent recovery, the statutory injury, lack of due diligence, and deprivation of liquidity endured demand equitable legal restitution.
The Court held that the initial gate of vulnerability was opened by Respondent 2 through its negligent issuance of a duplicate SIM card but Respondent 3 cannot be fully absolved of their auxiliary liability, insofar as they failed to perform the physical release and remittance of the contractually frozen amount back to the complainant even after an interim order, thereby unlawfully disrupting the velocity of the complainant’s capital despite the clear judicial intervention of this Court.
Decision
The Court directed Respondent 3 to pay the complainant 12 per cent annual interest on the blocked principal amount of 4,88,360 for the period from 9 May 2022 to 17 May 2024.
Respondent 2 was directed to pay damages of ₹1,00,000 to the complainant on account of its structural negligence, deficient internal controls and failure to controvert the allegations of an unauthorised SIM swap leading to financial loss, mental agony and deprivation of livelihood suffered by complainant. No liability was found against Respondent 1.
[Ajaz Lal Attar v. ICICI Bank Ltd., Complaint Case No. 59 of 2014, decided on 16-6-2026]
Advocates who appeared in this case:
Complainant: Jayshree Nangare
Respondent: Viswanath Mannadiar, Janhavi Sakalkar, Sanjay Kumar
1. Ed. Note: The order refers to the “initial net loss” from the first transfer as ₹4,91,928.09 in one instance, which appears to be a typographical error as the figure is given as ₹4,99,928.09 everywhere else the transaction is described in the order. This report follows the ₹4,99,928.09 figure throughout for consistency.
