On 31 July 2025, the tribunal (legal panel) ordered Vodafone and ICICI Bank to jointly pay over Rs 1.20 crore (compensation + penalties) to an Ahmedabad-based company named Collective Trade Links Private Limited. Govt ordered vodafone and ICICI Bank to pay this amount within 6 weeks.
In March 2023, Collective Trade Links Pvt Ltd, which deals in ball bearings, lost Rs 1.19 crore (₹1.19 Cr) from its bank account due to a SIM swap fraud that took place on March 11–12, 2023.
What happened in the fraud?
- The fraudsters sent a fake email that looked like it came from Vodafone (using the email corporatecare.india@vodafoneidea.com).
- The fake email tricked Vodafone into giving them a duplicate (new) SIM card linked to the company’s phone number.
-
This allowed the fraudsters to take control of the company’s phone number.
- With the phone number, they started receiving all SMS alerts and OTPs from the bank.
-
They used these OTPs to log in and transfer money from the company’s ICICI Bank account, stealing over ₹1.19 crore.
- With control over the phone number (via the duplicate SIM), the fraudsters were able to bypass security checks and made 22 unauthorized bank transactions on a Sunday, when offices were closed and the director was in Vietnam.
Criminals used fake documents to get this SIM, and a Vodafone store manager in West Bengal, Prashanta Datta, was found to have helped in this by breaking rules.
What Action Was Taken Against The Fraud?
The company filed a civil complaint under the Information Technology Act (sections 43 and 43A) for unauthorised access and negligence.
- Cyber Crime Police in Ahmedabad, led by Inspector MR Paradva, investigated the case.
-
They tracked the fraud all the way to West Bengal and arrested six people, including, the person who owned the bank account where the money went, people who arranged the fake SIM card and bank account, a Vodafone store manager who helped issue the fake SIM.
- The police recovered Rs 15 lakh from frozen accounts and returned it to the company.
- After hearings in 2024 and January 2025, a final decision was given on July 31, 2025
Summary of the Final Tribunal Order
The company got back the full Rs 1.2 crore through penalties imposed on ICICI Bank and Vodafone Idea.
ICICI Bank was held responsible for not properly checking before allowing new people to be added as beneficiaries and allowing large transactions to go through without extra verification, even though they were above the usual limit and on a non-working day. Govt ordered penalty of Rs 10 lakh as a fine and Rs 1.05 crore as compensation to the company for the bank.
Vodafone Idea was also held responsible for Issuing the SIM card without following proper checks and employee involvement in breaking the rules. Govt ordered penalty of Rs 5 lakh as a fine for Vodafone Idea.
The case was heard by Mona Khandhar, who is the Principal Secretary of the Department of Science and Technology (DST), Gujarat, and also the Adjudication Officer under the IT Act. Both companies must pay the amounts within 6 weeks and were also told to do the internal security checks within 3 months. ICICI Bank was also told to upgrade its digital security systems within 6 months to prevent such fraud in the future.
It’s a landmark legal decision that strengthens accountability and protection for victims of cyber fraud, especially in cases involving financial loss due to lapses in cybersecurity. This shows that banks and telecoms can no longer escape liability by blaming each other or the victim. The decision holds both banks and telecom service providers (like Airtel, Jio, etc.) jointly responsible when cyber fraud occurs due to lapses in their systems.
