A TSP issuing a duplicate SIM card negligently shall be liable to compensate person who lost money in online fraud: TDSAT

The (Telecom Disputes Settlement and Appellate Tribunal) TDSAT ruled that in a case where a Telecom Service Provider (TSP) issued duplicate SIM card negligently to an applicant who was not the subscriber without verifying the credentials of the applicant, the TSP would be liable to compensate the subscriber who lost money in online fraud.

A businessman (complainant) lost Rs. 18.50 lakhs because of alleged negligence of Vodafone Cellular Ltd. (Vodafone). An amount of Rs. 18.50 lakhs had been debited from the complainant’s account as his SIM card was de-activated and a duplicate SIM had been issued to an imposter on the basis of fake and forged documents.

The imposter used the duplicate SIM card linked to the complainant's bank account to siphon off money from the complainant’s account.

It was alleged that the SIM was issued and activated without verifying the claim and cross-checking the documents submitted by the imposter. It was further alleged that duplicate SIM was issued without following the guidelines framed for the purpose, without verifying the documents of imposter and without ascertaining the imposter’s identity. A comparison showed that there could have been no scope to accept the claim of the imposter if the two sets of documents had been compared even casually. The photographs and signatures were quite different.

The Bank argued that the fraudulent transfer of money from complainant's account was entirely on account of lapses on the part of Vodafone in issuing duplicate SIM to the fraudster without taking any precautions necessary for KYC. On the other hand, Vodafone argued that it had no knowledge or awareness about the mobile connection being used for the purpose of operating bank accounts opened by the complainant with the Bank. According to Vodafone, it was not connected with the fraudulent withdrawal of money from complainant's account and that it issued the duplicate SIM card to an imposter in good faith after complying with the necessary formalities for issuance of another SIM card after it was reported to be lost.

The Adjudicating Officer (AO) held that Vodafone should have thoroughly checked all the relevant documents before issuing a duplicate SIM as per Telecom guidelines. There was a lapse on the part of Vodafone as it did not verify and tally the credentials of the complainant and that of the alleged imposter. The issuance of the duplicate SIM to the imposter resulted in money being transferred to the imposter thereby causing a loss of Rs. 18.50 lakhs to the complainant.

On the basis of the aforesaid findings against Vodafone, the learned AO awarded Rs. 15 lakhs as compensation to be paid by Vodafone to the complainant.

On appeal to the TDSAT, it was held that “it is lawful and permissible for the subscriber to depend upon communications through the mobile number allotted to him with his Banker and with other persons without threat or apprehension of unlawful invasion of his privacy. In such a situation transferring the aforesaid facilities by changing the SIM number already available in the personal data or information of the customer/subscriber can have serious adverse impact upon the subscriber. If such an eventuality happens because the Telecom Service Provider (TSP) is found to be negligent in implementing and maintaining reasonable security practice and procedures as mandated by Guidelines Rules of 2011 and thereby it has caused wrongful loss to the subscriber, section 43A of the Information Technology Act, 2000 (Act) can get attracted against the TSP.”

The tribunal went on to say that the plea that the lapses in verifying the bonafides and authenticity of the person applying for a duplicate SIM amounts to violation of CAF (Customer Acquisition Form) procedure or KYC (Know Your Customer) procedure cannot have any diluting effect upon the rigors of section 43A of the Act. Once the essential ingredients of negligence are attracted and established, the minor penalties for CAF violations or for KYC lapses cannot be treated to be an effective shield against claims arising under sections 43 and 43A of the Act.

The TDSAT observed that while dealing with application for duplicate SIM, the TSP has the added advantage of comparing the particulars of the applicant including his photograph and signature with that of the subscriber already existing in the data base which is required to be maintained under the CAF guidelines issued by (Department of Telecom) DoT. The concern for national security is quite relevant at the time of issue of duplicate SIM. Otherwise it can easily fall in wrong hands and cause additional loss to the original subscriber also. Further, the need for higher level of diligence in matters of security and procedures arises in such cases because the TSPs have important duties towards their subscribers not to compromise their personal information by sheer negligence and lack of security measures.

Further, no expert is required to compare the documents and conclude that the applicant for the duplicate SIM card was not the subscriber and such a claim was entirely bogus and fraudulent. Thus the claim of Vodafone that the details were verified and checked was incorrect and unacceptable.

The TDSAT concluded that Vodafone is liable under section 43(g) and section 43A of the Act whereas the Bank is found liable only under section 43A of the Act and ruled that the complainant was entitled to receive Rs. 15 lakhs from Vodafone and Rs. 3.5 lakhs from the Bank.

View Full Judgement