SIM Swap Fraud: Where Does Liability Lie?

Introduction

At the nexus of the telecommunication industry and the digital banking space, SIM swap fraud represents one of the most detrimental cyber-attacks. While operating at this nexus, fraudsters leverage on human vulnerabilities as well as breaches in the identity verification systems at the mobile network operators to “hijack” a target’s phone number, thereby accessing one-time passwords (OTPs), 2FA codes, critical banking alerts, and thereafter siphoning out bank accounts, cryptocurrency wallets, etc. Within a span of minutes.

Given the widespread dependence on the mobile number for identity verification in modern digital financial ecosystems, who, amongst the TSP which wrongfully re-issued the SIM card to the fraudster(s) should bear the financial loss from such illicit withdrawal transactions over the accounts or the bank(s) processing those transactions, and more significantly, who holds the ultimate responsibility when a victim is stripped of all his funds.

This indeed brings to the forefront a plethora of complex legal and regulatory questions.

How SIM Swap Fraud Occurs

SIM swap fraud-in all of its names like SIM hijacking or port-out scamming – is account takeover attack that exploits the vulnerability of multi-factor authentications- the mobile network provider.

1. Information Gathering-Attackers harvest PII (e.g. Name, DOB, address, IDs and phone numbers) from targets via phishing, social engineering or through dark web data leaks.
2. Impression & Deception-Using the victim’s PII the attacker pretends to be the target (the customer) to the mobile provider and states that they lost, stole or broke their phone, or the fraudster can bribing an accomplice within a telecom retail store.
3. SIM Execution-The mobile operator disables the physical SIM Card and moves over the customer to the new SIM Card controlled by the fraudster. The target’s phone goes offline (shows “No Service”).
4. Financial Hijacking-The fraudster triggers password resets to the customer’s internet banking account, email accounts, digital payment systems etc.. Since major banks have an SMS OTP (One-Time Password) dependent security infrastructure and most other financial service providers have been following suit, all verification codes will appear on the device controlled by the fraudster.

Liability of Mobile Network Operators (Telecoms)

Telecoms are the principal site of the fault line of the telecom service. Their customer service-and importantly, identity verification processes- are the actual target of the primary violation and hence it should not be a wonder that courts and regulators are holding telecom companies more accountable for negligence.

Key aspects to prove telecom liability-

1. Non-compliance in KYC and Identity Verification process–Telecoms have obligations under stringent KYC guidelines. If the telco agent does not demand photographic identification or other documents of identification like government IDs, matching biometrics and signature confirmation before issuance of the duplicate SIM Card, the telecom company has breached their duty of care in terms of its actions.
2. Indulgence and vicarious liability of the insider– A large part of the SIM swap fraud includes inside complicity or the fraudster getting third-party dealers to verify him for cash. The legal principle of vicarious liability holds telecom companies strictly accountable for torts or acts of wrongdoing by their employees acting within the scope of their employment.
3. Deficiency in service– According to a framework governing consumer protection, the telco’s lack of implementation of elementary measures like email alert sent before SIM activation or a mandated 24 hour delay in services including SMS is itself a “deficiency in service”.

The courts regularly uphold that despite not being financial institutions, a telecom operator is liable towards its customers based on a duty of care due to providing the network infrastructure through which access to financial accounts is granted securely.

Liability of Banks and Financial Institutions

One argument the financial institution may try to establish themselves against would be one related to authorization, where they say that the bank carried out the transactions with proper authentication and correct SMS OTPs, which indicates banks held to high custodial duty.

Important criteria that can form the bank’s liability are:

1. Excessive reliance on one factor SMS OTPS: Modern financial security has established robust system on Multi Factor Authentication. Central Banks hold that dependence only on one factor delivery medium SMSOTP with additional data not being investigated into secondary context factors such as device MAC address, geolocation or a quick sudden increase in the amount of value to new added payees is systemic weakness.
2. Automated fraud detection system failure: A duty imposed on Banks is to have the capacity to use behavior monitoring system to detect anomalies, if account involved is small value and local remittance only adds many payees to itself and causes maximum possible value transfers in few minutes of password change, the fraud system of a Bank must alert and halt the payment.
3. Regulatory framework protection on no liability: Around the world, regulations like RBI circular on Limited liability of customers in unauthorized electronic banking transactions and PSD2 require strict customer protection norms; if a customer informs about unathorised electronic transactions after notice is given ( usually within 3 business day of customer notice), the bank must demonstrate customer fraud/gross negligence. Otherwise bank is obligated to credit the customer.

Customer / Subscriber Liability

Despite legal provisions favor the subscriber, subscribers are not fully protected against the loss. Liability is normally placed on customer in two situations:

1. Gross negligence or unlawful disclosures: where subscriber, willingly divulges net banking credentials, MPINs or debit card details to a third-party, using phishing links or social engineering; then customer shall be the subject of negligence.

2. If there is unreasonable delay: In case of SIM swap, the victim’s mobile phone would immediately have loss of mobile service or will show ‘No Service’. When the regulators are expecting a consumer to act diligently, and if consumer does not bother, loses entire mobile network in an unwarranted extension of time (while it is not down, in real), not contact telecom provider nor monitor their bank accounts; courts are prone to place contributory negligence on customer for diminished relief.

Judicial Precedents and Comparative Legal Approaches

Various judiciary in the globe has become increasingly firm against telecom service providers and financial institutions, holding that service providers cannot be authorized to recover their cost of dealing with operational deficiency in system security from a consumer.

1. Established Laws and Judiciary standards Consumer Disputes Redressal Commissions (India): In a variety of milestone cases (e.g. A. Raghavendra v. Telecom Operator & Bank), State and National Consumer Commissions held Telecom Operators directly liable for issuing a duplicate SIM on an forged or improperly verified Identity Documents, regular ordered to restore all money lost to fraud, punitive damages to the victim for physical and emotional pain in a suit and cost for the lawy.
2. Federal Communications Commission (FCC) Regulations (United States): TheFCC established specific and firm rules concerningSIM swapping and port-out fraud. A wireless carrier must have safeguards in place to verify a customer requesting a SIM swap before carrying it out, must immediately inform a customer whenever any request to swap a SIM is made, and must permit a customer to prevent any transfer off service by locking that customer’s SIM profile.
3. Judiciary Verdicts on Joint and Several Liability: The doctrine of Joint and several liability has consistently applied against a Telecom Operator and a bank. In case a fraudsters used a Telecom Service provider, an innocent customer’s money lost to account could be restored back by holding both bank and telecom operator solely responsible to refund.

Critical Action Plan for SIM Swap Victims

If there is an unexpected sharp drop of cellular network to “No Service,” follow these emergency steps to limit monetary losses:

1. Call the Telecom Operator Immediately: From another phone or via wi-fi calling, call customer care to investigate whether a duplicate SIM card request has been made. Immediately request suspension of the account if the SIM has been swapped.

2. Block Your Financial Bank Accounts Immediately: Call the bank’s emergency helpline, or block net-banking using your mobile/web banking over a wi-fi connection, debit/ATM cards and close your linked digital wallets.

3. Register an Official Complaint at Cyber Crime authorities: Register an official complaint in cybercrime authorities nationally and also locally to be provided with the FIR / Police Complaints against the misuse of your mobile and bank account information.

4. Send Formal Dispute Letters: Write a formal letter to the Bank and Telecom Operators along with the registered police complaint. Send it and request the regulatory limited-liability clause against the restoration of your account

Conclusion

So the main focus of liability in SIM swap fraud is to find a flaw in the duty of care. Primarily Telecom Service Provider has primary liability due to weakness in identity verification & customer authentication when SIM was reissued. Alongside the responsibility is Shared between Telecom Service Provider and Financial Institutions as systems used are SMS based which can be exploited and when their systems do not monitor erratic transactional pattern.

Apart from few cases which are subscriber’s clear negligence- like sharing details with friends, making the financial loss due to delaying on receiving lost service etc. The onus is solely on corporate service providers. As government authorities reinforce stringent identity verification regulations and enforce robust consumer protection; telecoms and banks need to move away from insecure SMS-based authentication to device-bound cryptographical strong authentic security systems.

References

1. Reserve Bank of India (RBI): Circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions(DBR.No.Leg.BC.78/09.07.005/2017-18).

2. Federal Communications Commission (FCC): Rules and Regulations Guiding SIM Swap and Port-Out Fraud Prevention (47 CFR Part 64).

3. European Parliament & Council: Directive (EU) 2015/2366 on Payment Services in the Internal Market (PSD2).

4. National Consumer Disputes Redressal Commission (NCDRC): Precedents on Telecom Service Deficiency and Bank Negligence in Unauthorised Electronic Transactions.

5. Department of Telecommunications (DoT): Instructions on Know Your Customer (KYC) Norms for Mobile Connections and SIM Reissuance Guidelines.