VI ordered to pay ₹30L compensation to customer over duplicate SIM card issuance
Maharashtra's IT authority orders Vodafone Idea to pay ₹30 lakh for issuing a duplicate SIM, leading to ₹28.8 lakh in customer losses due to fraud.
MUMBAI: Maharashtra’s adjudicating authority under the Information Technology Act has directed Vodafone Idea Ltd (VI) to pay ₹30 lakh in compensation to a customer, following a case involving the issuance of a duplicate SIM card to a fraud. The duplicate SIM card enabled unauthorised access, resulting in financial losses amounting to ₹28.8 lakh for the customer.
The order was issued by Parrag Nainutia, Principal Secretary of IT and Communications, who found VI responsible for failing to verify the documentation before issuing the duplicate SIM. This oversight enabled the fraudster to conduct unauthorised transactions under the customer’s identity, a clear case of SIM card swapping, according to advocate Mahesh Rajpopat, who represented the complainant.
The complaint was filed by directors of Eco Brilliance Pvt Ltd, a company based in Bandra, who cited significant financial losses and mental distress due to the telecom provider’s security lapse. The case underscores the responsibilities of telecom operators under the Information Technology Act to prevent unauthorised access through stringent verification processes.
The incident came to light in November 2018, as one of the directors, Ajay Shah, began facing network connectivity issues, after which the Vodafone customer service informed him of a temporary technical issue.
A day later, Kajal Raja, the second director found that the mobile number linked to the company’s bank account was blocked and upon contacting the bank, they found out that their account balance went down from ₹52.5 lakh to ₹15.5 lakh. They also found that the unauthorised transactions took place from their account as they were caused due to a one-time password sent to the registered Vodafone number.
However, after enquiring with the telecom company, the directors got to know that a duplicate SIM was issued for their number, and they claimed that the SIM card was issued by Vodafone without properly verifying the documents of the fraudsters. Based on their complaint, an FIR was registered at the BKC police station and two accused were arrested from Surat.
Vodafone, on the other hand, sought dismissal of the complaint, submitting that sensitive banking credentials needed for the transaction were only available with the complainants and their bank, IndusInd. They argued that being telecom providers, they only facilitate mobile service and do not store sensitive banking details.
The mobile service provider further argued that the complainant also failed to act on the OTP alert which is also sent through mail. Submitting that they were not responsible for the bank account linkage to the mobile number, the telecom operator said, “Evidence indicates that the unauthorised access to the bank account occurred before the duplicate SIM was issued, suggesting that the bank’s security systems were compromised prior to the SIM-related incident.”
Further, Vodafone claimed that they followed all security procedures to prevent fraud, adding that they are only an ‘intermediary’ under section 79 of the IT Act, which exempts them from liability regarding third-party information.
The adjudicating authority, however, held that the complainant also bears responsibility for the said offence, since the fraud occurred due to the exposure of credentials which lies with the complainant. The authority held the fraudulent transactions took place due to the deactivation of the registered mobile SIM card and issuance of duplicate SIM by the company.
The authority absolved the bank of all charges, observing that the actions of the telephone service provider were “entirely external to the scope of the Respondent Bank’s control or security responsibilities.”
The principal secretary, IT department directed Vodafone Idea Ltd to pay ₹25 lakh as reimbursement and an additional compensation of ₹5 lakh for the mental agony caused to the network users.
Despite repeated attempts, officials from Vodafone Idea Ltd could not be reached for comments.