Fake Loan App Harassment: Stop & Report 2026

Reviewed on: 2026-07-10.

It is 6 a.m. when the first message arrives. Not to you. To your boss. Your sister. A neighbour you called twice in your life. The message carries a morphed photograph and a caption that says you are a defaulter, a criminal, a fraud. Within the hour, two dozen people in your contact list have received the same message.

You borrowed five thousand rupees ten days ago from an app you downloaded from a link in a WhatsApp group. The app promised instant disbursal, no questions. It delivered. It also, silently, uploaded every name and number in your phone. Now it is using that list as a weapon.

This is the standard playbook of an unauthorised loan app. The harassment is not incidental. It is the product. Understanding that changes how you fight back. For a structured guide on how loan apps weaponise your contacts, see loan app threatening contacts: what to do.

The Reserve Bank of India issued the Digital Lending Directions in 2022 (updated in 2025), which bind every Regulated Entity (RE) and Lending Service Provider (LSP) operating in India. These directions are enforceable law, not advisories. You can read the full RBI digital lending guidelines at RBI Circular on Digital Lending Guidelines and the updated directions at rbi.org.in.

What an app is prohibited from doing:

• Accessing your contacts, call logs, or media files without your explicit consent. Even with consent, the app may use device data only for the stated purpose during onboarding and KYC. It cannot store or share contact data beyond operational need.
• Charging any fee that was not disclosed in the Key Fact Statement (KFS) before you accepted the loan. Learn more about the Key Fact Statement (KFS) and your loan rights.
• Disbursing money through any account other than the borrower's own bank account. If the app sent money via a wallet or third-party app and you never saw a proper sanction letter, this is a red flag for an unauthorised operator.
• Using recovery agents who resort to harassment, abuse, or public shaming. Lenders must communicate recovery agent details to borrowers at loan sanction. An agent who never identified themselves lawfully is not operating under any legitimate authorisation. See the recovery agent harassment complaint guide for your rights.

What you are legally entitled to:

• A Key Fact Statement before signing, which must include the Annual Percentage Rate (APR), all fees, and a cooling-off period.
• A cooling-off period of at least 3 days for loans longer than 7 days, during which you can repay only the principal plus proportionate APR and exit without any penalty.
• A nodal grievance officer at the lender's end, reachable by name and contact. If no grievance officer was ever disclosed to you, the entity is either non-compliant or unauthorised.
• Escalation to the RBI Ombudsman if your complaint is not resolved within 30 days. See the banking ombudsman complaint guide for step-by-step instructions.

If the app did not give you a KFS, disbursed to a wallet rather than a bank account, or cannot name a grievance officer, it is almost certainly not a Regulated Entity under RBI. It may be operating entirely outside the law.

Fake loan apps share common red flags that distinguish them from RBI-authorised digital lenders. Before installing any lending app, check these warning signs:

1. No NBFC partner disclosed: A legitimate app must name the RBI-registered NBFC or bank that is the actual lender. If the app says “we lend directly” without naming a registered entity, it is likely unauthorised.
2. Excessive permissions on install: The app demands access to contacts, call logs, gallery, location, and camera before you even apply. RBI rules restrict data access to KYC purposes only — see fake APK installation scams for how malicious apps exploit permissions.
3. Disbursal to wallet or UPI instead of bank account: RBI mandates direct disbursal to the borrower's bank account. An app sending money to a Paytm wallet or via UPI to a third party is violating core lending rules.
4. No Key Fact Statement: The KFS is mandatory before loan acceptance. If the app does not show a standardised KFS with APR, tenure, and all charges, do not proceed.
5. Seven-day loan with exorbitant fees: Legitimate lenders rarely offer sub-7-day loans. If the app offers a 7-day loan with a processing fee of 30-40%, the effective APR is astronomical and the app is designed for harassment-based recovery.
6. No physical address or grievance officer: RBI requires lending apps to display a registered office address and a named grievance officer. If neither is visible, report the app immediately.
7. Downloaded from a link, not the official store: Apps shared via WhatsApp links, Telegram channels, or APK download sites bypass Play Store review. These are the most dangerous variants. Read about how to report fake mobile apps and how to remove fake apps from your phone.

To verify whether a lending app is genuinely RBI-registered, use our guide: how to check if a loan app is RBI registered or check the RBI digital lending app directory.

Loan app harassment is not a single tactic. It is a multi-layered strategy designed to maximise fear and social pressure. Understanding which type you are experiencing helps you choose the right complaint channel and legal section.

Harassment escalates when victims make small payments to make the calls stop. Each payment confirms that the tactic works, and the demand grows. Do not transfer money to an app demanding a “settlement fee,” “processing charge,” or “legal fee” that was not part of your original loan agreement.

If you genuinely borrowed money and owe a lawful amount, that obligation does not disappear. But the obligation is only to the amount stated in the agreement, not to extortion-layer fees invented by an unlicensed operator. Understand the difference between penal charges vs penal interest under RBI rules and when you can demand an RBI refund for illegal loan charges.

Before you block anything, document everything:

1. Screenshot every threatening message, call log entry, and social media post targeting you.
2. Record the full name of the app, the version, the Google Play or App Store URL if it is still live, and the screenshots of its permissions screen.
3. Note the phone numbers from which calls were made. Many use VoIP numbers that still carry metadata useful for investigation.
4. Download a copy of the loan agreement if the app emailed you one. If it never sent a signed agreement, document that absence.
5. Save the morphed images or defamatory messages sent to your contacts — these are critical evidence under IT Act Section 67.

Evidence gathered before blocking is admissible. Evidence gathered afterwards is harder to reconstruct. If your photos were misused, also read how to take down misuse of your photos online and deepfake blackmail recovery steps.

The National Cyber Crime Helpline 1930 is the fastest first response. Call it and report the harassment. The operator will log your complaint and may initiate a hold on further fraudulent transactions if financial fraud is involved alongside the harassment. For a detailed script on what to say when you call, read the 1930 helpline call script.

After calling, file a written complaint on cybercrime.gov.in:

1. Select “Financial Fraud” as the complaint category (or “Other Cyber Crime” if the harassment is purely defamation/morphed images without financial fraud).
2. Use “Register and Track” so you receive a complaint reference number. This number is essential for follow-up.
3. Attach your screenshots, the app name, and the phone numbers used for harassment.

Your complaint on cybercrime.gov.in routes to the State Cyber Crime Cell for investigation. You will receive an acknowledgement, and the complaint is trackable. You can check progress via your cybercrime complaint status or file an RTI for cybercrime complaint status if the investigation stalls.

If you have already lost money to the app, also read the complete guide to reporting cyber fraud via 1930 for steps to freeze fraudulent transactions. For broader recovery options, see how to recover money after UPI fraud and RBI's Rs 25,000 digital fraud compensation.

For every loan app that is either unauthorised by RBI or violating the Digital Lending Directions, report directly on sachet.rbi.org.in. Sachet is RBI's platform for complaints about entities operating in the financial sector without proper authorisation or in breach of RBI norms.

File a complaint on Sachet for:

• An app disbursing loans without being an RBI Regulated Entity or an NBFC licensed under RBI.
• An app accessing your contact list or sending messages to third parties.
• An app charging fees not disclosed in any agreement.
• Recovery agents using threats or public shaming.

Keep your Sachet complaint reference number. If RBI takes action against the entity, your complaint becomes part of the regulatory record. If Sachet does not resolve your complaint within 30 days, escalate to the Banking Ombudsman or the RBI Integrated Ombudsman Scheme. For complaints where the RBI Ombudsman has already rejected your case, see what to do when your RBI Ombudsman complaint is rejected.

Online complaints do not replace a formal First Information Report. Visit your nearest police station or the State Cyber Crime Cell and:

1. Present the screenshots and your cybercrime.gov.in reference number.
2. Ask for an FIR under the Information Technology Act (especially Section 66C for identity theft and Section 67 for transmitting obscene material if morphed images were used).
3. Ask for an FIR under Indian Penal Code / Bharatiya Nyaya Sanhita for criminal intimidation if explicit threats were made.
4. If you need to file the complaint entirely online without visiting a police station, read the complete cyber crime complaint guide and cybercrime portal vs police station — which to choose.

A registered FIR enables the police to request data from the platform or telecom operator under lawful process, which is the primary tool for unmasking anonymous harassment numbers. To download an existing FIR copy, see how to download your FIR copy online.

If the app also tricked you with false promises about loan terms, the digital arrest scam playbook may overlap. Read the guide on digital arrest scams for additional protection steps.

Some loan apps request access to your banking app, UPI PIN, or OTP as a “verification step.” If you shared any such credentials:

• Call your bank's 24×7 helpline immediately and report a suspected compromise.
• Request a temporary block on your account or UPI handle until the risk is assessed.
• File a complaint with the Banking Ombudsman if your bank is unresponsive or a fraudulent transaction has occurred and is not being reversed.

The RBI Ombudsman can order restitution for fraudulent transactions where the bank failed to act promptly after being notified. If your bank account has been frozen as part of a cyber fraud investigation, read bank account freeze due to cyber fraud and the bank's process for freezing accounts after fraud.

If your bank refuses to refund under the zero-liability framework, escalate using the bank-refused-refund escalation guide. For UPI-specific fraud recovery, see UPI fraud recovery steps.

Loan app harassment falls under the jurisdiction of multiple agencies. Knowing which agency handles what helps you file complaints to the right authority and avoid wasted time.

Before borrowing from any digital lending app, verify:

1. The app must name an RBI-Regulated Entity (bank or NBFC) that is the actual lender. Check that the NBFC is registered on the RBI website at rbi.org.in under “List of NBFCs.” Our guide how to check if a loan app is RBI registered walks through this step by step.
2. The app must provide a physical address and a grievance officer's name and contact in-app or in the agreement.
3. The loan must be disbursed to your bank account, not a wallet, not cash.
4. The app must provide a signed loan agreement and KFS before disbursing. See everything you need to know about the Key Fact Statement.

If any of these are missing, do not proceed. Report the app on sachet.rbi.org.in even if you have not borrowed from it yet. Reporting prevents others from being trapped. You can also check the RBI digital lending app directory for authorised apps.

Loan app harassment triggers multiple criminal provisions under both the Bharatiya Nyaya Sanhita (BNS) 2024 and the Information Technology Act 2000. Knowing these sections helps you insist on specific charges when filing your FIR.

Yes, recovery is possible especially if you act quickly. The key principle is the golden hour — the first 30-60 minutes after a fraudulent transaction where banks can freeze the destination account before funds are withdrawn.

Recovery timeline for money paid to fake loan apps:

Read the complete guides: the golden hour zero-liability framework and how to recover money after UPI fraud. If the payment was made via UPI to a wrong account or fraudulent merchant, see recovering money from a wrong bank account.

If your complaint was closed without refund, escalate using UPI fraud complaint closed without refund — escalation steps.

Preventing loan apps from weaponising your personal data is better than recovering after the fact. Take these protective measures:

1. Never grant contact access to any lending app. RBI rules already prohibit this — if an app refuses to proceed without contact access, it is a red flag. Read how fake APKs exploit app permissions.
2. Revoke permissions after install. Go to Settings → Apps → [Loan App] → Permissions and disable Contacts, Call Logs, Camera, and Storage.
3. Use Android's “Nearby Share off” and “Install unknown apps blocked” settings to prevent APK sideloading from WhatsApp or Telegram links.
4. Report your phone number to Sanchar Saathi if SIM misuse is suspected: sancharsaathi.gov.in lets you check SIMs linked to your Aadhaar and block unauthorised connections.
5. If morphed photos are circulating, file a takedown request. See how to remove misused photos from online platforms and deepfake blackmail recovery.
6. Pre-notify close contacts that they may receive defamatory messages and should ignore/report them. This reduces the social damage the app relies on.
7. If the harassment extends to cyberstalking, read stalking and cyberstalking under BNS Section 78 and the cyberbullying complaint guide.

You can get a fake loan app removed from the Play Store or App Store, cutting off its victim pipeline:

1. Google Play: Open the app's Play Store page → tap “Flag as inappropriate” → select “Harmful or dangerous” or “Impersonation.”
2. Apple App Store: Use the “Report a Problem” feature on the app's page.
3. MeitY takedown: The Ministry of Electronics and Information Technology has the power to direct Google and Apple to take down apps that violate Indian law. Your cybercrime.gov.in complaint triggers this channel. Report at meity.gov.in.
4. Sanchar Saathi: Report the phone numbers used by the app's recovery agents at sancharsaathi.gov.in for blocking.

When enough users report an app, the platform removes it. Your report protects future victims.

Verify independently. Search the NBFC list on rbi.org.in using the entity name. Authorised digital lenders are also required to display their RE partner's name and CIN in their app and in the loan agreement. A claim of RBI registration without a verifiable NBFC name is a fabrication. Report via Sachet.

Also check our guides: how to verify if a loan app is RBI registered and the RBI digital lending app directory. If the app claimed NBFC backing that turns out to be false, this is an additional cheating charge under BNS §318.

Loan app harassment is one of several cyber fraud variants that use psychological pressure to extract money. Understanding the differences helps you identify the exact threat and find the right recovery guide.

No. Under RBI's Digital Lending Directions, a lending app cannot access your contact list, call logs, or media without your explicit consent. Even where you did grant consent during installation, the app can only use device data for the stated purpose such as KYC onboarding. Using your contact list to send harassment messages to third parties is both a breach of RBI rules and potentially an offence under the Information Technology Act and the DPDP Act 2023.

Payments made under coercion or fraud are recoverable in law, but recovery depends on tracing the operator. File a complaint with 1930 and on cybercrime.gov.in with full transaction details. The bank may be able to initiate a dispute or freeze if the payment was made recently to an identifiable account. The RBI Ombudsman can also be approached via Banking Ombudsman if your bank does not cooperate with a reversal request. See RBI's Rs 25,000 digital fraud compensation and the golden hour zero-liability framework for your rights.

Threats of legal action from an unauthorised lender carry no legal force. A genuine creditor files a civil suit or approaches a tribunal. They do not threaten borrowers on WhatsApp at 2 a.m. using borrowed photographs. If the entity is not a licensed NBFC or bank partner, it cannot initiate court proceedings in its own name as a lender. Report the threat as criminal intimidation in your FIR. To verify if a legal notice is genuine, see how to check if a legal notice from a recovery agent is fake.

They can file their own complaint on cybercrime.gov.in for receiving unsolicited, defamatory, or threatening messages. Their complaints strengthen the aggregate case against the operator. If morphed images were sent, Section 67 of the Information Technology Act makes the transmission itself an offence regardless of whether the target has an existing loan relationship with the app. For defamation-specific action, read the defamation legal notice and case process.

Yes. Report the app on Google Play or Apple App Store using the “Flag as inappropriate” or “Report app” function. Also report the app URL to the Ministry of Electronics and Information Technology through the Cybercrime portal. MEITY has the power to direct Google and Apple to take down apps that violate Indian law. Your cybercrime.gov.in complaint triggers this channel.

Verify independently. Search the NBFC list on rbi.org.in using the entity name. Authorised digital lenders are also required to display their RE partner's name and CIN in their app and in the loan agreement. A claim of RBI registration without a verifiable NBFC name is a fabrication. Report via Sachet.

Not always instantly. The police or Cyber Cell investigation takes time. However, several things happen quickly: 1930 may be able to coordinate a hold on transactions; the lender's harassment is itself evidence in a criminal complaint which increases risk for them; and RBI action on Sachet can trigger suspension of the entity's operations. Block the numbers, restrict social media sharing, and notify your contacts not to respond to messages from the app.

RBI typically acknowledges Sachet complaints within 7 working days and aims to resolve them within 30 days. If the entity is found to be unauthorised, RBI can issue a cease-and-desist order and direct the platform to remove the app. If your Sachet complaint is not resolved within 30 days, escalate to the RBI Integrated Ombudsman via the banking ombudsman complaint guide.

Yes. If the app charged hidden fees, misrepresented loan terms, or engaged in unfair trade practices, you can file a consumer complaint under the Consumer Protection Act 2019. The District Commission handles claims up to Rs 50 lakh. Read how to file a consumer court case and file online via e-Daakhil online consumer commission filing.

Yes. If your cybercrime.gov.in complaint has been pending for more than 3 months without update, you can file an RTI application asking for the investigation status. See the RTI guide for cybercrime complaint status and use our cybercrime complaint status checker.

If your bank account was frozen as part of a cyber fraud investigation triggered by a loan app complaint, this is a temporary measure while the bank verifies the transactions. Read what to do when your bank account is frozen due to cyber fraud and the bank's freeze process explained. If the freeze is not lifted within a reasonable time, file a complaint with the Banking Ombudsman.

No. Education loan harassment typically involves banks or NBFCs that are RBI-regulated but use aggressive recovery tactics against students or parents. Personal loan app harassment involves unauthorised apps that may not be RBI-regulated at all. The complaint channels differ. For education loan harassment, see education loan harassment recovery and NBFC education loan rights. For recovery agent harassment from a legitimate bank, read the recovery agent harassment guide.

File an RTI to: the State Cyber Cell and RBI (Sachet portal) for the lending entity

Ask:

• What is the current status of my cybercrime complaint bearing reference number [number] filed on [date] against loan app [name]?
• Is the entity named [name] registered as an NBFC or partner of any RBI Regulated Entity for digital lending as of [date]?
• How many complaints have been received against the digital lending app [name] or its associated NBFC on the Sachet portal in the last 12 months?
• What action has been taken by the State Cyber Crime Cell against loan apps operating without RBI authorisation in [state] in the current financial year?
• What is the timeline prescribed for investigating and resolving a harassment complaint filed against an unregistered digital lending entity?
• How many unauthorised digital lending apps have been identified and blocked by the I4C in the current financial year?

→ Use our free AI RTI Drafter to generate a complete Section 6(1) application.

Also consider escalating your grievance via CPGRAMS to the Ministry of Home Affairs (for cybercrime response) or the Ministry of Finance (for RBI enforcement).

• National Cyber Crime Reporting Portal - cybercrime.gov.in (Helpline 1930 confirmed on portal; complaint categories: Financial Fraud, Other Cyber Crime; updated 10/07/2026)
• Indian Cyber Crime Coordination Centre (I4C) - i4c.mha.gov.in (MHA apex body for cybercrime coordination; confirmed live 10/07/2026)
• RBI Sachet Portal - sachet.rbi.org.in (File a Complaint and Track Complaint functions confirmed live; covers RBI-regulated entities including NBFCs)
• RBI Circular on Digital Lending Guidelines - RBI/2022-23/111, dated 02 September 2022 (Key Fact Statement, cooling-off period, contact access prohibition, fund disbursal rules, grievance officer requirement, 30-day escalation window; note: subsequently superseded by RBI Digital Lending Directions, May 2025)
• Reserve Bank of India - rbi.org.in (NBFC list for verification of authorised digital lenders)
• Ministry of Electronics and Information Technology - meity.gov.in (App takedown authority; digital policy and intermediary compliance)
• Sanchar Saathi (DoT) - sancharsaathi.gov.in (Report and block fraudulent phone numbers/SIMs; check SIMs linked to your Aadhaar)
• Press Information Bureau - pib.gov.in (Enforcement action data and public advisories on loan app scams)

By Dr. Shrawan Kumar Pathak