PUNJAB NATIONAL BANK,MADHYA PRADESH vs GREEN ENVIRONMENTAL TECHNOLOGY THROUGH ITS PROPRIETOR MR. MUKESH KAORE ADN ANR,MADHYA PRADESH on 5 November 2026

JUDGMENT

1. This Cyber Appeal, under Section 57 of the Information Technology Act, 2000, has been filed by Punjab National Bank, against Green Environmental Technology, through its Proprietor Mr Mukesh Kaore, and Bharat Sanchar Nigam Limited, against the Order, dated 01.09.2021, passed by Learned Adjudicating Officer/ Secretary,

Information and Technology, Government of Madhya Pradesh, Bhopal, in Case No. 23 of 2019, whereby, Learned Adjudicating Officer has ordered Appellant Bank to pay damages by way of compensation to the tune of Rs. 16,34,000/- (Rupees Sixteen Lakhs Thirty-Four Thousand Only) with compound interest (to be compounded as per the applicable directions of RBI regarding compounding) payable at the Bank rate (issued by RBI from time to time) from the date of fraudulent transaction i.e., 10th April, 2019 till date of payment. Further for mental agony, consultancy and legal expenses including Court fees, a lump sum of Rs. 1.50 Lakhs (Rupees One Lakhs and Fifty Thousand Only) be also paid to Applicant, Respondent No. 1 within a period of 30 days from the date of the Order, failing which additional simple interest @12% p.a, till date of actual payment, was to be made and this amount are to be borne equally by Punjab National Bank and Non-Applicant No. 3 – BSNL.

2. In brief, Punjab National Bank is a body Corporate, constituted under the Banking Companies (Acquisition & Transfer of Undertakings) Act, 1970, and as per Scheme of Amalgamation of Oriental Bank of Commerce, passed by the Central Government under Section 9 of the

Banking Companies (Acquisition & Transfer of Undertakings) Act, 1980, is the successor of Oriental Bank of Commerce, having its branches situated at various places, of which Mr Alok Jain, is a Principal Officer and duly Constituted Attorney of the Appellant Bank.

3. Respondent No. 1, Green Environmental Technology, through its Proprietor Mr Mukesh Kaore, was maintaining a Current Account No. 09321131000013, with Appellant Bank, at its Arera Colony Branch Bhopal, Madhya Pradesh. He also availed online banking facility from the Appellant Bank, for which a login ID and secured password was with User. User’s BSNL Cell Phone No. 9425043383 was a registered Cell Phone Number with the Internet Banking Services linked to above Current Bank Account of Complainant - Respondent No. 1 firm.

4. On 09.04.2019, this SIM Card became dead. Hence, it was got enquired from the Respondent No. 2, Telecom Service Provider, who asked him to come on 10.04.2019. He visited there on 11.04.2019. An application for re-issuance of SIM card number of the said Number was moved. This was obtained by User and just after insertion of this new SIM in the mobile set, he received a message of withdrawal of

Rs.3,84,000/- (Rupees Three Lakhs Eighty-Four Thousand Only). When account was got checked, it was found that Rs. 16,34,000/- (Rupees Sixteen Lakhs Thirty-Four Thousand Only) has been withdrawn by third parties, through net banking. Instantly, Complainant went to his Bank and informed the mis-utilisation of his Mobile Number through alleged duplicate SIM between 09.04.2021 to 11.04.2021, his account was got blocked. A Police complaint, with Local Police Station, and subsequently, this complaint before Adjudicating Officer, making above allegation, was got filed. On the notice of said application, issued by Learned Adjudicating Officer, reply by Appellant Bank as well as Telecom Service Provider was got filed and after hearing the arguments, the Impugned Judgment was got passed. This impugned order is bad in law and lack in judicial approach by Learned Adjudicating Officer. At no point of time, Appellant Bank was at any fault in its role with regard to security maintenance, in relation to the account of Respondent No. 1, nor it has violated any norm of RBI Guidelines in this regard. No negligence can be attributed to the Appellant Bank in respect of implementing and maintaining reasonable security practices and procedures in dealing or handling any sensitive personal data or information in a computer, thereby causing wrongful loss or wrongful gain to any person. This Appellant Bank has not violated the provisions of Section 43A of Information Technology Act, 2000 nor was any defiance of Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Complainant/ User/ Respondent No. 1, knowingly and intentionally avoided to take proper caution of non- working of his SIM Card, despite the fact the BSNL Officials called upon him on 10.04.2019, he wasted the day and went to the BSNL Office on 11.04.2019 and obtained the New SIM Card for the same number. It was the negligence on the part of Complainant himself. The transactions alleged to be fraudulently done, were with the same password and user login, for which the security credentials remained with the Respondent No. 1, and it was the negligence and collusion of the Complainant himself. The BSNL had issued a duplicate SIM to a third party without making proper and due diligence, hence, entire episode of the case was based on the misuse of Mobile Number by a third party. The Investigation report of the Police case was not taken into consideration. It was a case of contributory negligence by the Appellant Bank, Telecom Service Provider as well as Complainant. But, the liability has been totally imposed upon the Appellant.

5. The Jurisdiction of this Appellate Tribunal is there for hearing this Appeal, and this Cyber Appeal has been filed well within the period of limitation. The delay in filing appeal is in accordance with the general exemption given by Hon’ble Supreme Court in the matter of Miscellaneous Appeal No. 665/2021 in Suo Motu Writ Petition No. 03/20. The prayer is for allowing this Appeal and setting aside Impugned Order.

6. Reply by Complainant - Respondent No. 1, was filed over Interim application moved for stay of execution of the Impugned Order against which this appeal is, was got filed by Complainant – Respondent No. 1, wherein, the contention of Appellant was negated and this Tribunal, vide Order dated 18.01.2022, had directed to make the deposit of the decretal amount with the Registrar of this Tribunal, and after its deposit the same was to be disposed of as per final Judgment of Appeal. In compliance of same, amount was got deposited by Appellant Bank.

7. A notice to Respondent No. 2 was also issued. Time was given for filing reply if any, but, no reply was got filed by Respondent No. 2.

8. Even after moving application for hearing of this Appeal at an earliest, the notice was given to both side, and inspite of this notice and acceptance of MA No. 84/2026, none appeared for BSNL. Neither reply got filed nor argument was got placed by BSNL. Whereas, Learned Counsel for Appellant Bank and Respondent No. 1 – Complainant appeared.

9. Heard argument of Learned Counsels as above and gone through materials placed on record.

10. From the very perusal of the Complaint, filed under Section 43, 43-A read with Section 85 of the Information Technology Act, 2000, the Information Technology (Intermediaries Guidelines) Rules, 2011 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011) was got filed by Green Environmental Technology, through its Proprietor Mr Mukesh Kaore, against Oriental Bank of Commerce, Arera Colony Branch, E-7, Arera Colony, Bhopal, Madhya Pradesh, Respondent No. 1, Branch Manager of Oriental Bank of Commerce of above Branch, Respondent No. 2 and Bharat Sanchar Nigam Limited,

Sehore, Madhya Pradesh, Respondent No. 3, with a contention that Mukesh Kaore is a proprietor authorized representative of the Petitioner, Green Environmental Technology, who operates Account No. 09321131000013 in the name of Green Environmental Technology in the Oriental Bank of Commerce, Branch Arera Colony, Bhopal, having Internet Banking facility of same with secured login credentials such as Login ID, Password, Transaction Password and registered Mobile Number associated with above Bank Account. On 09.04.2019 to 10.04.2019 some fraudster hacked and accessed Petitioner’s above Bank Account without permission/ authorisation of Petitioner and fraudulently got access to operate the Bank Account by unauthorised fraudulent transfer in the tune of Rs. 16,34,000/- (Rupees Sixteen Lakhs Thirty-Four Thousand Only) by adding beneficiaries detailed in the complaint. This organised fraud was completed through RTGS/ NEFT/ IMPS by using Internet Banking Service for Rs. 16,34,000/- (Rupees Sixteen Lakhs Thirty-Four Thousand Only) in Petitioners Bank account in between 09.04.2019 to 10.04.2019, and this illegal transfer was held under Police Investigation report to be of unauthorised access and hacking, defined in Section 43 and 66 of IT Act, 2000. Bank and its Officers failed to protect Login ID, User Password and

Transaction Password or fraudster breach the Internet Banking System of the Respondent No. 1, which was owing to Respondent No. 3, who had issued duplicate SIM Card on forged documents without verifying them and the negligence in handling of sensitive personal information. No one can get full account access only with Login ID, User password and Transaction password or only one time password. But, it is necessary to know all the information. Hence, Respondent No. 1 and 2 alongwith Respondent No. 3 had helped and facilitated unauthorised access in Petitioner’s Bank account to fraudster defined in Section 43(g) of the Information Technology Act, 2000. Hence, both are liable to pay compensation of damage.

11. The reply of BSNL was that it was unaware of the fact, that the number used to get duplicate SIM, was of link with Bank Account of the Complainant. Had the fraudster not access to login ID and transaction password, they would not have taken the money transacted against the Online Bank Account of Complainant. This Telecom Service Provider was not at fault with regard to protection of personal sensitive information and data. After hearing all side, the

Impugned Order was got passed by Learned Adjudicating Officer, wherein the points for determination were –

(i) Whether any fraudulent transactions took place and if so, what is the value of the transactions?

- Was got decided to be undisputed fact.

(ii) If any fraudulent transaction had taken place, is the Applicant eligible for compensation under the IT Act?

- Was decided in favour of Complainant.

(iii) If the Applicant is eligible for compensation and other relief the quantum of relief to be provided?

- These points were decided with above finding of payment of damages in the tune of Rs. 16,34,000/- (Rupees Sixteen Lakhs Thirty-Four Thousand Only) with Interest written Supra by Bank – Appellant and for Rs. 1.50 Lakhs alongwith given interest in ratio of half towards mental agony and expenses, by Appellant Bank as well as Telecom Service Provider.

12. Learned Adjudicating Officer has categorically held that the given procedures for issuing new SIM as per DoT Guidelines before issuing a duplicate SIM, the Telecom Service Provider or its authorised licensee is required to verify the documents submitted by the subscriber, with the Original Proof of Identity documents already available with them. In the instant case, this has not been done and Non applicant No. 3 has issued the duplicate SIM without following the laid down procedure and against what appear to be forged documents. The Non Applicant No. 3 cannot be exempted from liability as an intermediary under Section 79 (1) of the IT Act, 2000. Firstly, it failed to observe due diligence while discharging its duty under the Act. Secondly, when a Telecom Service Provider is able to establish that it is handling only the information, data or communication link for any third party, then subject to provisions in sub-section (2) and (3), it can lawfully claim exemption from liability. There is a specific finding that Telecom Service Provider, BSNL has not followed the reasonable security practices and procedure as well as established guidelines before issuing a duplicate SIM Card, which has led to the access of sensitive personal data and information of the Appellant to an unauthorized person. There is no appeal by Telecom Service Provider. Hence, this finding has not been challenged by Telecom Service Provider. Hence, it is apparent that requisite due diligence as per laid procedure and guideline was not taken by Telecom Service Provider BSNL at the time of issuing duplicate SIM on 09th April 2019.

13. It was a specific plea by BSNL, before Learned Adjudicating Officer that the Telecom Service Provider BSNL had issued SIM Card to a named person and it was not aware that the same was being used for a proprietorship concern, in whose name this complaint was got filed, and this was not placed before Learned Adjudicating Officer nor before this Appellate forum, as to whether, this SIM was issued to proprietorship concerned or to individual person, and whether this Telecom Service Provider was with knowledge of using this SIM Card by a proprietorship concern. Hence, the loss is being said to be of the account of a proprietorship concern, because in the Complaint it has been specifically given in Para 5 that the account holder name is ‘Green Environmental Technology’. Nowhere, it has been written to be the account of Individual Person to whom SIM was issued. Hence, Learned Adjudicating Officer was fully with reason to award half of the mental agony and legal expenses over this Telecom Service Provider and Appellant Bank to pay the whole money siphoned illegally.

14. The fact is undisputed that fund was withdrawn without authorization of the Applicant. The RBI circular dated 06.07.2017 is of specific provision with regard to reversal time line for Zero Liability/ Limited Liability of customer, and in present case Applicant had reported the matter regarding fraudulent transactions taking place to the Non- applicants 1/2 on 15.04.2019. As per the above clause the Non- applicants 1/2 should have credited back the amount to customer’s account within 10 working days from the date of receipt of such notice, but, they have failed to comply with the above directions and have been charging interest on the said amount from the Applicant. The confidential data regarding Users Name, Users Profile, Users Login ID, Login Password, Transaction Password, adding of beneficiaries, cooling period, statutorily directed to be observed for making a transfer in favour of beneficiary added by user then making transaction of same is within the domain of Bank providing Internet Banking facility and any compromise made with the computer of the Bank by its technical hands, will amount a failure in observing reasonable practices of protecting sensitive personal data, and for that, guidelines of Reserve Bank of India, will become applicable. Hence, Learned Adjudicating Officer has discussed the facts and circumstances of the case in hand vis-à-vis the law given under IT Act, 2000, as well as guidelines and circular of Reserve Bank of India effective in present case. There is no failure in coming to conclusion and drawing the Impugned Order. This Appeal merits dismissal. Dismissed accordingly.

15. The decretal amount has been deposited by JD Appellant Bank with the Registrar of this Tribunal, which shall be paid to Complainant Respondent No. 1 alongwith with all its accrued interest there at. So far as liability of Telecom Service Provider/ BSNL is concerned, appropriate execution proceeding will be taken before appropriate forum.

….......……………… (Justice Ram Krishna Gautam) Member 05.11.2026 /BN/