Telecom Service Providers are liable for fraudulent banking transfers resulting from negligent issuance of duplicate SIM cards.

The Respondent No. 1 (Complainant), Managing Director of Narbada Forest Industries Pvt. Ltd., maintained a corporate bank account with Respondent No. 2 (Bank of Baroda).

The Complainant had obtained six mobile connections from the Appellant (Bharti Airtel), including the impugned number used for internet banking OTPs.

On April 2, 2013, an unauthorized person obtained a duplicate SIM card for the impugned number from an Airtel retail outlet using a forged letterhead and without proper verification.

Subsequently, on April 4, 2013, Rs. 49.99 lakhs were fraudulently transferred from the Complainant’s account to third-party accounts in Respondents No. 3 and 4 banks via internet banking, facilitated by OTPs received on the duplicate SIM.

The Adjudicating Officer (AO), Madhya Pradesh, held the Appellant and Respondent No. 2 liable under Sections 43(g) and 43A of the IT Act, 2000, awarding Rs. 51,21,727 in compensation to the Complainant.

The AO apportioned the liability as 2/3rd (Rs. 34,14,515) upon the Appellant (TSP) and 1/3rd (Rs. 17,07,257) upon the Bank.

The Appellant challenged this order before the TDSAT.

1. Whether the Appellant (Telecom Service Provider) can be held liable under Sections 43(g) and 43A of the IT Act for negligence in issuing a duplicate SIM card used in a financial fraud.

2. Whether the apportionment of 2/3rd liability on the Appellant was disproportionate and lacked reasoning compared to the Bank’s liability.

The Court applied Section 43(g) of the Information Technology (IT) Act, 2000, which imposes liability for providing assistance to facilitate unauthorized access to a computer system, and Section 43A, regarding compensation for failure to protect sensitive personal data.

The Court further referenced the Subscriber Verification Guidelines issued by the Department of Telecommunications (DoT), which mandate strict due diligence for SIM issuance.

It relied on the precedent set in Vodafone India Ltd vs. Prashant Mahadeorao Buradkar (Cyber Appeal No. 6 of 2014), which established that TSPs are liable for failing to exercise diligence during the "SIM-swap" process.

The Appellant argued that it was an intermediary under Section 79 of the IT Act and that the Complainant lacked locus standi as they were not the owner of the bank's computer system.

However, the Tribunal noted that the legal principles regarding TSP liability for negligent duplicate SIM issuance were already settled by previous TDSAT judgments and did not require re-interpretation.

On the issue of apportionment, the Tribunal found that the issuance of the duplicate SIM to a perpetrator without verifying the credibility of the forged documents was the "point of initiation" for the entire cybercrime.

While the Bank had security layers like OTPs, these were rendered infructuous because the Appellant’s negligence allowed the perpetrator to intercept the OTPs.

The Tribunal reasoned that the AO’s decision to hold the TSP 2/3rd liable was logical because the TSP’s failure enabled the unauthorized access that the Bank’s systems could not then prevent.

It held that the Appellant’s failure to follow due diligence in issuing a duplicate SIM directly resulted in the financial pilferage.

The 2/3rd apportionment of the compensation amount (Rs. 34,14,515) and the penalty of Rs. 25,000 imposed on the Appellant were confirmed as being based on sound logic and evidence.

No interference with the trial court's findings was deemed necessary.