Marking an important decision under the Information Technology Act, the Adjudicating Officer of Gujarat has delivered a key verdict in a major cyber-fraud case involving a loss of over ₹1.19 crore through unauthorised bank transactions carried out using a cloned SIM card.
The case was filed by the directors of Collective Trade Links Pvt. Ltd., an Ahmedabad-based bearings trading company, against ICICI Bank, Vodafone Idea Limited (VIL), and local law enforcement authorities. The complaint, registered under Sections 43 and 43A of the IT Act, explained how criminals performed a SIM swap, bypassed OTP security, and transferred money from the company’s overdraft account during a weekend in March 2023.
How the Fraud Happened
One of the directors, Prakash Mehta, was travelling in Vietnam at the time. On March 11, 2023, an email—claiming to be from the company—requested a SIM swap for Mehta’s mobile number, which was linked to OTPs for banking transactions. Vodafone Idea approved the request and activated the new SIM by 4:30 PM the same day, without detailed verification, even though the number was on international roaming.
Using the duplicate SIM, the fraudsters received OTPs and completed 22 transactions worth ₹1,19,37,000 through RTGS and NEFT. They registered 10 new beneficiaries and transferred unusually large amounts to unknown accounts. Another director, Bharatkumar Mehta, received delayed alerts on his alternate number, but the transactions had already been completed.
The fraud was discovered the next day when the accountants checked the bank statement. The company immediately informed ICICI Bank and filed a police complaint. An FIR was registered at the Cyber Crime Police Station under cheating, conspiracy, and IT Act offences.
Defence by ICICI Bank and Vodafone Idea
ICICI Bank said that all transactions were completed using valid OTPs, passwords, and MPIN, and that the bank followed RBI rules. It froze the beneficiary accounts, gave provisional shadow credit, and started an internal investigation. The bank argued that the customers failed to protect their credentials, and under the RBI’s 2017 circular, the bank was not liable if there was customer negligence.
Vodafone Idea claimed that it followed the standard procedure for corporate mobile connections and processed the SIM swap request sent from the registered email ID. The company stated that it acts only as an “intermediary” under Section 79 of the IT Act and is protected from liability for communication content. It also argued that SIM issuance is governed by DoT rules, not the IT Act.
Allegations of Negligence
The complainants argued that both organisations failed in their responsibilities.
- VIL allegedly ignored the roaming status of the number and did not perform additional verification through secondary contacts or required audio-video checks.
- ICICI Bank allowed high-value transfers on a non-working day and failed to follow the mandatory cooling-off period for new beneficiaries.
An official familiar with the investigation said, “This is not just a mistake; it exposes deeper weaknesses in the system.”
Pattern of SIM-Swap Scams
The Cyber Crime Branch reported that Ahmedabad had seen at least 20 similar cases involving Vodafone Idea SIMs. The enquiry revealed an organised fraud network:
- 34 mule bank accounts were identified
- 3 FIRs are being filed against handlers of these accounts
- Employees of two banks are under investigation
- 18 SIM sellers are accused of issuing SIM cards using forged documents
The adjudicating officer also referred to previous cases in Jaipur and Mumbai that highlighted repeated KYC failures by telecom companies.
Final Order and Penalties
Hearings were held from February 2024 to January 2025. The complainants demanded refund of the fraud amount, compensation, and penalties under the IT Act.
The officer accepted several arguments, including the principle of Res Ipsa Loquitur (the situation itself proves negligence).
The final order imposes a total penalty of ₹15,00,000 on the respondents:
- ICICI Bank must pay ₹10,00,000 as penalty and compensation under Sections 43(g) and 43(j) of the IT Act.
- Vodafone Idea Ltd. must pay ₹5,00,000 under Section 43(g) of the IT Act.
- ICICI Bank must refund ₹1,05,00,000 (the principal amount) to the petitioner within six weeks as per RBI guidelines.
-
-
-
-
-
-
