RAJKUMAR SREELAL SINGHEE Vs GAJANAN DOYE AND ORS

Appellant(in CA 20 of 2018) : Mr. Mahendra B Limaye, Advocate for Rajkumar Shreelal Singhee

For Respondent(s) : Mr. Vakul Sharma for PNB Mr. K Singhal and Mr. S Tiwari for R-4 in both appeals Mr. Vijay Kumar for R-13 in CA 20 of 2018 Mr Anand Shankar Jha and Mr. Shubhank Sharma for ICICI Bank Mr. Ashish Wad, Ms Swati Arya and Ms. Akriti Arya for Saraswat Bank Mr. Vijay Kumar for Indusind Bank in CA 20 of 2018 Ms. Shrinkhla Tiwari for United Bank of India JUDGMENT

1. This Cyber Appeal, under Section 57 (1) of Information Technology Act, 2000,(IT Act) has been filed by Appellant, Telecom Service Provider, i.e. Vodafone Idea Ltd. (formerly Idea Cellular Ltd.) against complainant/respondent No. 1, Mr. Rajkumar Shreelal Singhee and seven others, against impugned Judgment, of Shri S V R Srinivas, IAS, Principal Secretary (Information Technology), Government of Maharashtra, / Adjudicating Authority, under Information Technology Act, dated, 14.08.2018, passed in Complaint No. 39 of 2016 (Mr. Rajkumar Shreelal Singhee Vs. Gajanan Doye and others).

2. In brief, the memo of appeal contends that respondent no. 1, Rajkumar Shreelal Singhee is a subscriber of appellant i.e. Vodafone Idea Ltd., which is a public limited company, duly incorporated under the Companies Act, 2013, having its registered office at Suman Tower, Plot No. 18, Sector 11, Gandhinagar, Gujarat 382011, and Circle office at The Metropolitan, F.P. No. 27, S. No. 21, Old Mumbai Pune Highway, Wakdewadi, Shivajinagar, Pune 411003. This is a cellular network service provider and a licensee, under the Unified access Service License (UASL), duly licensed by the Department of Telecommunications(DoT), Government of India, to provide mobile telephony services.

3. Respondent No. 1, had originally been the customer of Idea Cellular Ltd., which is the erstwhile name of the Appellant Company, but this name has been changed from Idea Cellular Ltd. to Vodafone Idea Ltd. w.e.f. 31.08.2018, and the Certificate of Incorporation of Registrar of Companies, evidencing change of name is Annexure A1 to this memo. Complainant / respondent no. 1, Mr. Rajkumar Shreelal Singhee was issued a SIM card for mobile number 9822227982 in his name with a CAF alongwith supporting documents, which are collectively annexed as Annexure A2 to the memo.

4. A Complaint No. 39 of 2016, dated 9.8.2016, was filed with Adjudicatory Authority, with a contention, that on 02.07.2016, a person, claiming himself to be Rajkumar Shreelal Singhee, visited “My Idea” store namely, Shreemant Services, situated in Gondia Town, Nagpur, Maharashtra, which is a franchisee store of the appellant, with a grievance that he has lost his original SIM card and requested for issuance of a duplicate SIM card. Upon the receipt of SIM replacement request, alongwith requisite documents of the subscriber, namely, the PAN Card copy, bearing the name of respondent no. 1, the appellant verified the documents and subsequently, issued a new SIM card to that person, after following the strict prescribed procedure. But owing to this issuance of SIM card, the entire liability of Rs. 26,70,000/- has been imposed over appellant vide impugned order dated 14.08.2018, by adjudicatory authority, with a direction to make payment of compensation in the tune of Rs. 26,70,000/-. Whereas, complaint was with contention that complainant is the proprietor of Suryodaya Metal Craft Pvt. Ltd., Sanket Steel Industries and Swastik Refrigeration located at Nagpur.

The complainant had accounts with United Bank of India (A/c No. 1258210031851), Punjab National Bank(A/c No. 03530002100965426) and Saraswat Bank (A/c No. 067500100000271) for above said business units, wherein complainant’s mobile number 9822227982 was registered as registered mobile number and this mobile number was being used since last 10 years. On July 2,2016, the complainant noticed that his mobile had no connectivity and upon visiting the office of respondent no. 2, it was informed by the service provider that a new duplicate SIM card was issued on the number of complainant on 2.7.2016 by one of the dealers i.e. respondent no. 1 in complaint. The complainant protested the said un-authorised activation of SIM card without his consent and on 04.07.2016, a new SIM card was issued to the present complainant on the same mobile number with an assurance for its activation after complete verification being made. On 05.07.2016 morning, complainant received two messages from United Bank regarding debit of Rs. 5,00,000/- each. On visiting the office of concerned bank i.e, respondent no. 4 of the complaint, the complainant observed that a total of Rs. 17,00,000/-was got transferred from his United Bank of India Account on July 4 and July 5, 2016, through NEFT and RTGS mechanism.

On verifying with other accounts also, he observed that his PNB and Saraswat Bank accounts were also showing fraudulent transfer of Rs. 3,70,000/- and Rs. 6,00,000/- respectively. These transactions through NEFT / RTGS and mobile mechanism transfers were not authorised by the complainant. Rather, were a result of fraud. A Police complaint was got lodged in this respect on 6.07.2016 at Tahsil Police Station, Nagpur vide FIR No. 135/2016. The matter was got investigated by the police, with a conclusion, on the basis of documents including complainant’s plea and the responses given by the respondents, investigated by the police. The immediate reason for the occurrence of un-authorised transaction in the bank account of the complaint appears to be a duplicate SIM card issued by a service provider, through its franchisee Shreemant Services, i.e. respondent no. 1 in complaint, a franchisee of respondent no. 2, without properly verifying the KYC of the person requesting for a duplicate SIM Card. It was also alleged by the complainant that there is lack of observance of reasonable security practices and procedures by the banks i.e. respondent nos. 4, 5 and 6, as the complainant used to carry out NEFT/RTGS transactions by issuing cheques and never through online fund transfer option, except in matters of government tenders and the same deviation was not caught by the respondent banks.

It was alleged by respondent that respondent nos. 7,9,11 and 13, being the beneficiary banks, did not follow KYC norms while opening accounts. Therefore, it is claimed that the financial loss, suffered by the complainant, be got compensated by these respondent banks.

5. The adjudicatory authority issued notices to respondents in complaint, and in response, the present appellant, respondent no. 2 for it and on behalf of respondent nos. 1 and 3, vide reply dated 26.7.2017 stated that they have implemented all security practices and layers mandated by DoT and TRAI guidelines, and that the complainant and respondent banks have been negligent in keeping his account details, safe and confidential. Respondent no. 2 stated that the request for issue of SIM card was made by the fraudster, citing loss of SIM card as a reason and documents given for the same i.e. PAN Card copy with name of Rajkumar Singhee and the request form, signed by said fraudster ,were properly verified. Since complainant had not provided his registered email address to the respondent, notification of SIM Card change was sent on the alternate mobile number of the complainant. Respondent no. 2 also stated in their written response, dated 14.08.2018 that the bank transfer cannot be completed without a customer ID or Login ID and the same cannot be recovered or changed using mobile number.

The United Bank of India, respondent no. 4 of the complaint, vide its reply dated 13.08.2018, stated that the details of the transaction were delivered to the complainant via SMS alert and all beneficiaries were added on 02.07.2016, the information of which was also sent to the complainant. No deviation in the system with respect to security and OTP based transaction and no lapse in Bank’s internet banking were observed by the bank. Complainant must have compromised with the login ID and transaction passwords, without which these transactions may never occurred. More so, complainant ought to visit the bank branch immediately on noticing the registered mobile number had no connectivity, in order to avoid illegal transactions. Punjab National Bank, respondent no. 5 in complaint, in its reply dated 9.08.2018 stated that the fraud was practiced by creating duplicate SIM Card facilitated by respondent nos. 1, 2 and 3. SMS intimation was served for the transaction in question on the registered mobile number of complainant. Meaningful investigation through Fraud Investigation Unit was carried out by respondent no. 5. They have necessary checks and balances to ensure that no fraud takes place and they have taken all precautions, while KYC norms to be in place.

Saraswat Bank, respondent no. 6, in its reply dated 6.8.2018, had stated to have taken measures to mitigate the risks of unauthorised use of the customer’s online banking and mobile banking facilities and have inbuilt codes in their software systems to avoid suspicious transactions. In present case, the person who accessed the online banking of the complainant was already aware of the login ID and transaction passwords, because the bank only generates OTP, when it was requested from the registered mobile number. The IP address, from which the fraudulent transaction took place, is the same IP address, from where number of other transactions have been carried out by the complainant. Bank had taken all necessary actions in relation to complainant’s online banking account. The beneficiaries banks, in their respective replies, have categorically denied their responsibilities, with regard to concerned transactions. Rather, had mentioned that transactions were made through RTGS and were completed by way of subsequent withdrawal of same. All KYC norms were followed at the time of opening of those beneficiary accounts and after this communication of fraud, those credit and debit were freezed immediately on intimation of fraudulent transactions.

The averments made in pleadings as well as evidences placed on record, with written submissions filed by the parties were heard and impugned order, directing to make payment of Rs. 26,70,000/- by this service provider – appellant, was made without observing and making discussion over the pleadings and negligence of complainant himself regarding compromise with user password ID, transaction ID, alert for these transactions. Hence, this appeal with this ground that the complaint, at best will fall under the telecom dispute, which falls outside the scope and ambit of IT Act.

6. Appellant company is a cellular network service provider and a licensee under the Unified Access Service License, duly licensed by the DoT, Government of India, in the State of Maharashtra and Goa, with effect from 11.10.2013. It’s functions were governed by the provisions of the Indian Telegraph Act, 1885, Indian Wireless Telegraphy Act, 1933 and TRAI Act, 1997. Allegation in the instant case revolves around the unauthorised / fraudulent transfer of money from the bank accounts of respondent no.1, complainant, maintained with respondent banks. And there exists no contractual relationship between the Telecom Service Provider i.e., appellant with respondent banks.

7. The subscriber verification is not a subject matter of IT Act. Rather, it falls under the jurisdiction and domain of DoT, under the Telegraph Act and the rules made therein. Learned Adjudicatory Authority is not the appropriate forum for adjudication of the alleged general negligence. Rather, deviation of required precaution by and on behalf of TSP will originate a telecom dispute to be resolved through a specific mechanism prescribed under Telecommunication statues and not under IT Act. No cause of action had arisen against the TSP under section 43A, of IT Act because the appellant does not possess, handle or deal with the sensitive personal data or information. Learned Adjudicating Authority failed to appreciate that in the process of issuance of SIM cards, Replacement of SIM card, or issuance of duplicate SIM card, the documents required and mandated to appellant are limited to personal identification documents, such as PAN Card, authority letter and the requisite form, which does not include the information such as bank accounts number, online banking and login account password etc. which were constituting sensitive personal data for the purpose of commission of any offence as alleged under the IT Act.

8. In the present case, TSP, i.e appellant has no role to play in the completion of NEFT/RTGS transaction in any way, whatsoever, rather, the complainant i.e. respondent no. 1 had himself been negligent in compromising his sensitive personal data i.e. login password, transaction password of his bank accounts. The exemption from liability under section 79 of IT Act accrues in favour of appellant.

Hence, this appeal with a prayer to set aside the impugned order, dated 14.08.2018.

9. Reply to this memo was by complainant - respondent no. 1 with the same contention as were in the complaint, written as above. The sensitive personal data of complainant’s SIM Card was compromised at the location of TSP, present appellant and thereby complainant suffered a loss of Rs. 26,70,000/- for which approach was made to Hon’ble adjudicatory authority of State of Maharashtra, wherein impugned judgment has been passed. Failure to protect sensitive personal data, in the control of TSP, and thereby commission of such fraudulent transaction, is governed and exclusively covered under section 43 of IT Act with a remedy of filing complaint within the scope of IT Act before Adjudicating Authority as per section 46 of IT Act. Unauthorised / fraudulent transfer of money was resultant of the issuance of duplicate SIM card, without proper verification of data, held by the TSP-appellant, is genesis of present dispute.

10. Telecom Service Provider, present appellant has violated two significant guidelines issued by DoT, No. 1 - File No. 800-09/2010 - VAS dated 29.12.2014, issued to all CMTS/UAS/UL(AS)/UL Licensee(s) highlighting collecting aadhar numbers alongwith Customer

Application form and storing in data base alongwith other data by TSP. No. 2 - File No. 800-09/2010 -VAS dated 09.08.2012, highlighting instructions on verification of New Mobile Subscribers (Pre- Paid & Post Paid) which makes passport size photograph of customer mandatory alongwith CAF and physical verification of documents with original and updation of SIM in data base of licensee. Both these guidelines make the information about the subscribers to be uploaded in data base. At the time of verification, this data base residing in computer resource of appellant is assessed and in present case, it is relevant that negligence in handling of above data base, thereby causing huge loss to complainant is established. Hence, the prayer was for dismissing the appeal.

11. The objection was further replicated by rejoinder wherein again, contention of reply as well this memo of appeal was reiterated.

12. The reply of PNB and rejoinder over it, reply of Saraswat Bank and rejoinder over it, reply of UBI and rejoinder over it, reply of UBI and rejoinder over it, reply by respondent no. 5 SBI, are with the same contention and reiteration as were written before Learned Adjudicatory Authority, written as above.

13. This Tribunal while hearing this appeal at the very admission stage had observed that the actual alleged fraudulent transaction was of Rs. 26,70,000/- and the award was of Rs. 26,70,000/- i.e. with no interest, no cost, no cost for damage or for mental harassment etc.

14. Hence, the complainant was given an opportunity to raise a counter appeal with regard to it in case of any advise to him. And in response to this order, Cyber Appeal No. 20 of 2018 was filed by complainant- Mr. Rajkumar Shreelal Singhee, as appellant, against same respondents, who were opposite parties in original complaint i.e. Gajanan Doye / Shreemant Services, Shop No. 39, Raj Laxmi Complex, Pal Chowk, Rail Toli, Gondia, Maharashtra and 14 others, with the grievance against impugned judgment dated 14.8.2018 of Ld. Adjudicating Authority, Maharashtra, passed in Complaint No. 39 of 2016, with this contention that complaint was filed before adjudicatory authority for a compensation of Rs. 30 lakhs for failure to protect sensitive personal information, under Section 43 A of IT Act, but Rs. 26,70,000/- was ordered to be paid by TSP only, with no denial or finding regarding the remaining claim and aggrieved by this order for awarding less/inadequate compensation, present appeal has been filed with the same contention of the complaint, as was made before Ld. Adjudicatory authority, written as above and this appeal too, was being countered and rejoindered, with the same contentions by respective parties, as have been there in connected Cyber Appeal no. 10 of 2018, that is the leading appeal, being decided together.

15. The prayer in this subsequent appeal is to enhance the amount of compensation with a direction for making a compensation in the tune of Rs. 3,30,000/- to be paid by respondent nos. 1 to 3 in addition, to previously granted one and additional compensation for the loss of interest, as well as business loss due to delay of 18 months for deciding the matter by adjudicating authority to the tune of Rs. 10 lakhs and expenses of this litigation in the tune of Rs. 50,000/- with any other relief, which this appellate court thinks fit.

16. The very legal argument, made by learned counsel for appellant, with regard to jurisdiction of learned adjudicating authority, under section 43 of IT Act, appeal under section 56/57 of IT Act, caring for personal data, ouster of jurisdiction of this Tribunal, because of matter being telecom in nature, not under the domain of IT Act, 2000 etc. etc. have been vehemently argued in previously decided Cyber Appeals argued by this very learned senior counsel and have been heard and decided against the Telecom Service Provider, with proposition of law that the issuance of duplicate SIM card, without observing the due procedure and precaution, thereby fraudulently syphoning of money, is within section 43 of IT Act, to be raised and got adjudicated by learned adjudicatory authority, under section 46 of IT Act. Few of judgments, with citations are being mentioned below for avoiding repetition of same and in the interest of brevity of judgment:

CYBER JUDGMENTS

Cyber Appeal No. Name of parties Date of disposal/ judgment CA 1 of 2010 ICICI Bank Vs Umashankar 10.01.2019 Sivasubramanian CA 5 of 2013 ICICI Bank Vs Saurabh Ravi 24.09.2019 Shankar Jain CA 16 of 2015 Vodafone Idea Vs UOI 25.09.2024 CA 18 of 2015 Dhanlaxmi Bank vs Rajesh 25.09.2024 Aggarwal CA 33 of 2015 Punjab National Bank vs 16.05.2024 Suhas Enterprises CA 7 of 2019 Vodafone Idia Vs Mrs. 25.09.2024 Harshada Bindu Dholepatil CA 6 of 2014 Vodafone India Ltd. Vs Mr. 12.09.2024 Prashant Mahadeorao Buradkar CA 8 of 2014 The Branch Manager, SBI Vs 21.01.2020 Managing Director Nakoda

Chemicals CA 14 of 2015 State Bank of Patiala Vs Suhas 25.09.2024 Enterprises CA 10 of 2019 Indusind Bank Vs Amos 07.02.2025 Corporation CA 11 of 2019 Mohit Rajpal Vs My Taxi India 15.05.2019

17. The basic dispute was with regard to issuance of duplicate SIM card on the basis of PAN, produced before franchisee of TSP at Nagpur and this PAN with CAF has been filed alongwith memo of appeal as well as reply and even before adjudicating authority. On the very first sight it is apparent that PAN card was not available with TSP, because it was not filed at the time of issuance of original SIM card ten years back and the PAN card submitted for issuance of duplicate SIM card was with different name of parent / father of person in whose name the SIM card was originally issued. Hence, even if the cursory diligence was made, it would have been apparent that the person who is praying for change of SIM card is a fraud. By a bare naked eyes it is apparent. The learned senior counsel, appearing for appellant, had fairly admitted this aspect. But his grievance is that no compensation was awarded against the other respondents i.e. banks from whom these fraudulent transactions were made and for whom the allegations were there in the complaint itself. The reasoning in this respect is not there in impugned order. Rather, a cryptic administrative order with no reason for this conclusion in four to five lines with no specific acceptance of pleading or denial of pleading or appreciation of evidence filed in this respect is there. Even the banks in their pleadings have categorically said that without compromising login ID, transaction password, the transaction would not have been completed and it can never be generated even by change of SIM card, but no finding on this point is there.

18. The other grievance argued vehemently is that the complaint / claim has been filed by Rajkumar Shreelal Singhee in his name, claiming his loss. Whereas in the complaint itself as well memo of appeal in Cyber Appeal No. 20 of 2018, it was specifically said that those three accounts were accounts of Suryodaya Metal Craft Pvt. Ltd., Sanket Steel Industries and Swastik Refrigeration located at Nagpur and all these units were business units of which Rajkumar Shreelal Singhee is said to be a director and once, the business unit is a corporate company, either private company or a public company, and one person is a director, then loss to this business unit is the loss of that company and company ought to be made a party in this proceeding. Though this complaint was be got filed by a director, Rajkumar

Shreelal Singhee, but the complaint ought to be, for and on behalf of those three independent units. But it is not at all on record. This was raised before learned adjudicatory authority, but was not taken in account at all.

19. From the very perusal of impugned judgment, it is apparent that the loss was there to those three business units, but none of them had been made as a party in this proceeding, nor the claim is there for their favour. Apparently, this is a blatant error on the face of record. For a loss to a company a claim / petition / complaint, with a prayer to compensate that loss by a individual director without making company as a claimant or array in the party is not maintainable.

20. The judgment in its concluding para is with cryptic finding that “on the basis of averments and the written statements submitted by the complainant as well as respondents, it is clear that the loss was caused to the complainant due to the duplicate Sim Card issued to the alleged fraudster without following the KYC norms. The Respondent No.1 should have thoroughly checked all the relevant documents before issuing a duplicate Sim Card, as per telecom guidelines. The complete name as well as the signature of Mr. Rajkumar Shreelal Singhee on the Pan Card should have been properly tallied. Thid does not seem to have been done by the IDEA franchise. Because of this issuance of duplicate Sim Card, the money transfer was facilitated and as a consequence, a loss of Rs. 26,70,000/- was caused to the complainant. As far as the responsibility of Respondent Banks and other beneficiary banks is concerned, they seem to have followed all the norms and security measures.

In the final analysis, the responsibility of Respondent No. 1, 2 and 3 is quite serious and cannot be condoned. The undersigned, therefore, directs that the complainant be compensated Rs. 26,70,000/- as the loss was caused due to the issuance of duplicate Sim Card by Respondent No. 1, 2 and 3 without proper due diligence. Respondent No.1,2 and 3 are directed to pay the said amount to the complaint within one month of the receipt of this order.

The case is disposed as of above. No order as to costs.”

21. There is no reasoning, no discussion with regard to compromise of login password, transaction password, KYC norms observation by fiduciary banks through which the money was syphoned, deviation and pattern in withdrawal of those fraudulent money though RTGS / NEFT, without issuing cheques, as was previously being made by complainant, or as per complaint itself, no loss of complainant

Rajkumar Shreelal Singhee. Rather, the loss of independent three business units, including company and business units. Hence, the finding and observation of learned adjudicating authority is cryptic, not within the domain of judgment, to be said to be a result of a judicial or quasi-judicial proceeding. The maintainability of this petition / complaint by Rajkumar Shreelal Singhee in its individual capacity, without mentioning himself as director, of those three legal and independent entities, whether acceptable or not are to be adjudged by learned adjudicating authority.

22. Under above discussions, both of these two appeals merits to be allowed and the impugned judgment dated 14.8.2018, is liable to be set aside, with a further direction of remand of this proceeding to concerned learned adjudicating authority, Maharashtra with a direction to hear afresh in view of the observations made above and the perspective of law and procedure. Thenafter to pass a reasoned judgment on the basis of fact and evidence placed before it.

23. One thing is also to be apprised that the claim is of the year 2016 and it ought to be decided at an earliest.

ORDER

With above observations, the Cyber Appeal No. 10 of 2018 and Cyber Appeal No. 20 of 2018 are being allowed. Impugned judgment / order dated 14.08.2018 of adjudicatory authority, is being set aside and file and proceeding is being remanded back to learned adjudicatory authority for hearing and decision afresh, as above.

….......……………… (Justice Ram Krishna Gautam) Member 28.11.2025 /NC/