If you are stuck in such a situation, here is what to do.

Mr. Rohan, a resident of Nagpur, found himself in a distressing situation. He had a prepaid mobile number from a major telecom provider, “Global Connect,” which he used primarily for his professional networking groups and for logging into various digital accounts. After not recharging the number for several months as it was a secondary SIM, he was shocked to discover that it had been deactivated and reassigned to another individual, a Ms. Anjali. Consequently, Ms. Anjali was now part of his professional groups, and Rohan had lost access to his email, social media profiles, and cloud storage, as they were all linked to that mobile number for verification and recovery. This is a severe breach of privacy and a significant security risk.

Advice in such cases

If your mobile number has been wrongly reassigned, leading to a loss of access to your personal data and accounts, it is a serious issue. Here are the immediate steps you should consider:

• Immediately contact the telecom service provider (in this case, Global Connect) through their customer care and nodal officer. File a formal written complaint detailing the issue, the date you noticed the problem, and the potential data breach. Keep a record of all communication.
• Try to regain control of your online accounts (email, social media, banking) by using alternative recovery methods, if available. Inform the platforms about the security breach.
• Send a legal notice to the telecom company for deficiency in service and for causing a data breach. This often prompts a faster and more serious response.
• File a complaint with the Telecom Regulatory Authority of India (TRAI) and the Department of Telecommunications (DoT).
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Applicable Sections of Law

This situation involves multiple legal domains. The primary laws applicable are:

• The Consumer Protection Act, 2019: Reassigning a number without proper notification and causing financial or personal loss amounts to a “deficiency in service” by the telecom provider. A complaint can be filed in the appropriate consumer commission seeking compensation.
• The Information Technology Act, 2000: If the new user accesses your personal data, it can constitute an offence. More importantly, the telecom company, as a body corporate, is liable for failing to protect your sensitive personal data under Section 43A of the Act.
• Bharatiya Nyaya Sanhita, 2023 (BNS): If the new user impersonates you or uses your identity fraudulently, they could be charged under Section 243 of the BNS for identity theft. The telecom company’s negligence could also be linked to abetment of such an offence.
• Telecom Regulatory Authority of India (TRAI) Regulations: TRAI has specific guidelines for the deactivation and reallocation of mobile numbers, which typically require a 90-day grace period after the last recharge. The company’s failure to adhere to these rules is a violation.

If you are the complainant

As the person who has lost their number and access to their accounts, you are the complainant. Your course of action should be systematic:

• Gather all proof of ownership: old bills, recharge records, and the SIM card packaging if you still have it.
• Document the breach: Take screenshots of the new user being active in your groups, and any login failure messages from your online accounts.
• File a detailed complaint with the telecom company’s appellate authority if the initial response is unsatisfactory.
• File a complaint with the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) detailing the unauthorized access to your digital accounts.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

As the victim whose privacy and digital security have been compromised, your primary goal is to mitigate the damage and hold the responsible party accountable.

• Act quickly to secure your most critical accounts, especially banking and financial apps. Contact your bank to delink the compromised mobile number immediately.
• Do not engage directly with the new user of the number, as this could complicate the legal proceedings. Let the authorities or your lawyer handle communication.
• Consider filing a police complaint (FIR) under the relevant sections of the BNS and IT Act, not just against the new user (who may be innocent), but primarily against the telecom company for their gross negligence that enabled this situation.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Police response can be mixed. Initially, some officers at the local police station might view this as a civil dispute between you and the telecom company and may be reluctant to file an FIR. They might advise you to approach a consumer court. However, you should insist that it is a case of criminal negligence and a potential cybercrime. It is often more effective to approach the dedicated Cyber Crime Cell in your city, as they are better equipped to understand the technical and legal nuances of such cases. Presenting your case clearly with all documentary evidence can persuade them to register an FIR and investigate the matter, particularly the role of the telecom company in the data breach.

FAQs people normally have

• Can the telecom company legally reassign my number?
  Yes, as per TRAI guidelines, a telecom company can deactivate and reassign a prepaid number if it has not been used (no calls, SMS, data usage, or recharge) for a continuous period of 90 days. However, they are supposed to follow a due process, which often fails, leading to situations like this.
• Is the new user of the number at fault?
  Not necessarily. The new user likely obtained the number through a legitimate process from the telecom company’s store. They may be unaware that the number is linked to your accounts. However, if they knowingly and maliciously access your data or impersonate you, they commit a crime.
• Can I get my old number back?
  It can be very difficult. Once a number is reassigned, the telecom company is often reluctant to reverse the process. However, through legal action and pressure, it may be possible, especially if you can prove continuous (even if infrequent) usage or a flaw in their deactivation process.

What evidence is required?

To build a strong case, you must collect and preserve the following evidence:

• Proof of your ownership of the SIM card (e.g., invoice, SIM jacket).
• Records of your recharge history and call data records (CDRs) if you can obtain them from the provider.
• Screenshots showing the new user in your groups or any evidence of your lost access to accounts linked to the number.
• Copies of all written complaints, emails, and letters sent to the telecom company, TRAI, and other authorities.
• A copy of the legal notice sent to the telecom company.
• Any communication you receive from the telecom company in response to your complaint.

How long will the investigation take?

The duration depends on the path you choose. A complaint to the consumer court can take anywhere from a few months to over a year to resolve. A police investigation’s timeline is also variable; it depends on the complexity, the cooperation of the telecom company in providing data, and the workload of the cyber cell. Sending a well-drafted legal notice can sometimes lead to a faster resolution or settlement from the telecom company, often within 30 to 60 days, as they may wish to avoid litigation.

Advocate Sudhir Rao, Supreme Court of India