Loan app harassment in India — stop abuse and complain in 2026

Loan repayment does not authorise threats, public shaming, impersonation, misuse of contacts or publication of morphed images. Do not pay an unknown personal UPI ID merely because a caller threatens you. Preserve evidence, identify the actual regulated lender, secure your phone and payment accounts, complain to that lender, and use cybercrime or police channels immediately where there is fraud, extortion, threats or intimate-image abuse.

Two questions must be handled independently:

1. What amount, if any, is lawfully due under the loan contract? Ask for the Key Fact Statement, sanction letter, account statement, APR, charges and repayment destination.
2. Is the collection conduct lawful? Threats, impersonation, doxxing, contact-list shaming, obscene messages and unauthorised access can require regulatory and criminal complaints even where a genuine balance exists.

Do not claim that harassment automatically cancels a genuine loan. Equally, do not accept abuse as a lawful collection method.

Save evidence in a folder that the loan app cannot access:

• screenshots showing number, date, time and full message;
• exported chats, voice notes, call logs and voicemails;
• screen recording of the app profile, permissions and repayment demand;
• app-store URL, developer name, package identifier and version;
• Key Fact Statement, loan agreement and sanction email;
• bank statement showing the account that disbursed the money;
• every payment receipt and UTR/reference number;
• names or numbers of relatives or colleagues contacted; and
• the exact threat, false claim or image circulated.

Ask affected contacts to preserve their own original messages. Do not forward abusive images widely; retain them securely for the complaint.

Review the app's permissions in phone settings. Revoke access that is unnecessary, especially contacts, storage/media, microphone, camera, SMS and location. Remove unknown device-administrator, accessibility, screen-sharing or configuration permissions. Update the phone, run its built-in security scan and change banking, email and social passwords from a trusted device if compromise is suspected.

Uninstall only after preserving evidence and identifying the lender. Uninstallation does not erase copied data or end a genuine loan.

Pay only through the lender's verified official channel and into the account specified by the regulated entity. A caller's personal UPI ID, QR code or newly messaged account is a fraud warning. Confirm any changed repayment route through contact details independently obtained from the lender's official website.

A loan app may be only a Digital Lending App (DLA) or a Lending Service Provider (LSP) working for a bank or NBFC. RBI regulates the bank or NBFC, not every app simply because it appears in an app store.

Check:

1. the regulated entity named in the Key Fact Statement and loan agreement;
2. the sender name and bank account behind the disbursal;
3. whether the lender appears in RBI's regulated-entity information;
4. whether the regulated entity's own website lists the app or LSP; and
5. the grievance officer details displayed by the app and lender.

An app using an RBI logo or saying “RBI approved” is not proof. RBI's 2026 public information explains that its directory helps citizens check associations reported by regulated entities; it does not transform every listed app into an RBI-guaranteed product.

RBI now places digital-lending rules in entity-specific Credit Facilities Directions. The current commercial-bank and NBFC directions contain the core protections below and make the regulated lender responsible for its LSP arrangements. Use RBI's Master Directions directory to select the lender category before quoting a rule.

• a Key Fact Statement before execution, including the annual percentage rate and essential loan terms;
• digitally signed loan documents sent to the borrower;
• disbursal and repayment flows controlled under the Direction rather than an opaque pass-through account, subject to stated exceptions;
• an exit option during the disclosed cooling-off period on the terms in the Direction;
• collection of data only for a lawful, need-based purpose with consent and a privacy policy;
• restrictions on accessing phone resources such as contact lists, call logs and telephony functions;
• grievance officers of the regulated entity and LSP/DLA; and
• prior communication of the authorised recovery agent's particulars before that agent contacts the borrower.

Consent is not a blank cheque to shame contacts. Ask the lender to disclose what data was collected, the purpose, recipient, retention policy and deletion options available under the Direction and applicable law.

Document conduct such as:

Do not threaten the caller back, publish their personal information, or install a “refund recovery” app offered by another stranger.

Send a single indexed complaint. State the loan account, disputed amount, caller identifiers, conduct, dates, evidence list and relief sought. Ask the lender to:

• confirm whether the caller/agency is authorised;
• stop unlawful contact and contact-list use;
• give a complete account statement and calculation;
• provide the KFS, agreement, recovery-agent authority and grievance decision;
• preserve call, assignment, consent and data-access logs; and
• correct any unsupported credit reporting after investigation.

Keep the acknowledgement or ticket. A payment dispute should identify which line item is disputed rather than merely stating “all charges illegal”.

The Reserve Bank — Integrated Ombudsman Scheme, 2026 applies from 1 July 2026. First complain to the bank or NBFC. If its response is rejected or unsatisfactory, or no response arrives within the applicable Scheme period, check eligibility and submit at cms.rbi.org.in. Filing is free.

RBI CMS is not the route for an unidentified criminal app with no regulated entity. It also does not replace an urgent police report.

Use cybercrime.gov.in for cyber offences and 1930 for recent cyber financial fraud. Report credible threats, extortion, impersonation, stalking, obscene or intimate-image abuse, forgery and unauthorised account access to police with the evidence index.

Do not wait for the lender's internal grievance process where immediate safety or fast-moving fraud is involved.

A consumer complaint may be relevant to proven service deficiency or unfair practice. A lawyer can advise on an injunction, criminal complaint, debt dispute or privacy remedy where harm is serious. Use the consumer-rights guide to distinguish pre-litigation help from adjudication.

Subject: Urgent recovery-conduct and data-misuse complaint — loan [ID]

I received the attached calls/messages from [number/account] on [dates]. The
sender claimed to act for [lender/app] and [state exact conduct]. Please confirm
whether this person is authorised, stop abusive or third-party contact, preserve
all assignment/call/consent/data-access records, and provide my KFS, agreement,
complete account statement and reasoned grievance decision. I remain willing
to communicate about any verified lawful balance through your official channel.

Send facts, not insults. Redact Aadhaar, card and bank credentials from public-facing attachments.

Check your reports from the relevant credit information companies through their official channels. If the loan is unknown or an amount is wrong, dispute it with both the lender and the credit information company and preserve their reference numbers.

Do not take a fresh high-cost app loan merely to silence the first collector. If repayment difficulty is genuine, ask the lender in writing about available restructuring or hardship options. There is no universal right to settlement, waiver or a particular instalment reduction.

RTI can seek records held by RBI, police or another public authority, subject to exemptions: action on a complaint, file movement, applicable circulars or status. It cannot order a private lender to waive debt, investigate your phone or compensate you.

Use the AI RTI Drafter only after identifying the public authority and exact records. Keep it separate from the lender grievance and criminal report.

• Paying a newly supplied personal UPI ID under threat.
• Deleting the app and chats before preserving evidence.
• Assuming an app-store listing means RBI approval.
• Publicly posting unredacted KYC or intimate material.
• Disputing abuse but never requesting the actual account statement.
• Claiming harassment automatically cancels a genuine debt.
• Using RBI CMS before first complaining to the regulated entity.
• Waiting for a grievance reply despite an immediate threat or cyber fraud.

The Reserve Bank of India issued the Digital Lending Directions in 2022 (updated in 2025), which bind every Regulated Entity (RE) and Lending Service Provider (LSP) operating in India. These directions are enforceable law, not advisories. You can read the full RBI digital lending guidelines at RBI Circular on Digital Lending Guidelines and the updated directions at rbi.org.in.

What an app is prohibited from doing:

• Accessing your contacts, call logs, or media files without your explicit consent. Even with consent, the app may use device data only for the stated purpose during onboarding and KYC. It cannot store or share contact data beyond operational need.
• Charging any fee that was not disclosed in the Key Fact Statement (KFS) before you accepted the loan. Learn more about the Key Fact Statement (KFS) and your loan rights.
• Disbursing money through any account other than the borrower's own bank account. If the app sent money via a wallet or third-party app and you never saw a proper sanction letter, this is a red flag for an unauthorised operator.
• Using recovery agents who resort to harassment, abuse, or public shaming. Lenders must communicate recovery agent details to borrowers at loan sanction. An agent who never identified themselves lawfully is not operating under any legitimate authorisation. See the recovery agent harassment complaint guide for your rights.

What you are legally entitled to:

• A Key Fact Statement before signing, which must include the Annual Percentage Rate (APR), all fees, and a cooling-off period.
• A cooling-off period of at least 3 days for loans longer than 7 days, during which you can repay only the principal plus proportionate APR and exit without any penalty.
• A nodal grievance officer at the lender's end, reachable by name and contact. If no grievance officer was ever disclosed to you, the entity is either non-compliant or unauthorised.
• Escalation to the RBI Ombudsman if your complaint is not resolved within 30 days. See the banking ombudsman complaint guide for step-by-step instructions.

If the app did not give you a KFS, disbursed to a wallet rather than a bank account, or cannot name a grievance officer, it is almost certainly not a Regulated Entity under RBI. It may be operating entirely outside the law.

Loan app harassment is not a single tactic. It is a multi-layered strategy designed to maximise fear and social pressure. Understanding which type you are experiencing helps you choose the right complaint channel and legal section.

Loan app harassment falls under the jurisdiction of multiple agencies. Knowing which agency handles what helps you file complaints to the right authority and avoid wasted time.

Loan app harassment triggers multiple criminal provisions under both the Bharatiya Nyaya Sanhita (BNS) 2023 and the Information Technology Act 2000. Knowing these sections helps you insist on specific charges when filing your FIR.

Yes, recovery is possible especially if you act quickly. The key principle is the golden hour — the first 30-60 minutes after a fraudulent transaction where banks can freeze the destination account before funds are withdrawn.

Recovery timeline for money paid to fake loan apps:

Read the complete guides: the golden hour zero-liability framework and how to recover money after UPI fraud. If the payment was made via UPI to a wrong account or fraudulent merchant, see recovering money from a wrong bank account.

If your complaint was closed without refund, escalate using UPI fraud complaint closed without refund — escalation steps.

Preventing loan apps from weaponising your personal data is better than recovering after the fact. Take these protective measures:

1. Never grant contact access to any lending app. RBI rules already prohibit this — if an app refuses to proceed without contact access, it is a red flag. Read how fake APKs exploit app permissions.
2. Revoke permissions after install. Go to Settings → Apps → [Loan App] → Permissions and disable Contacts, Call Logs, Camera, and Storage.
3. Use Android's “Nearby Share off” and “Install unknown apps blocked” settings to prevent APK sideloading from WhatsApp or Telegram links.
4. Report your phone number to Sanchar Saathi if SIM misuse is suspected: sancharsaathi.gov.in lets you check SIMs linked to your Aadhaar and block unauthorised connections.
5. If morphed photos are circulating, file a takedown request. See how to remove misused photos from online platforms and deepfake blackmail recovery.
6. Pre-notify close contacts that they may receive defamatory messages and should ignore/report them. This reduces the social damage the app relies on.
7. If the harassment extends to cyberstalking, read stalking and cyberstalking under BNS Section 78 and the cyberbullying complaint guide.

Harassment escalates when victims make small payments to make the calls stop. Each payment confirms that the tactic works, and the demand grows. Do not transfer money to an app demanding a “settlement fee,” “processing charge,” or “legal fee” that was not part of your original loan agreement.

If you genuinely borrowed money and owe a lawful amount, that obligation does not disappear. But the obligation is only to the amount stated in the agreement, not to extortion-layer fees invented by an unlicensed operator. Understand the difference between penal charges vs penal interest under RBI rules and when you can demand an RBI refund for illegal loan charges.

Before you block anything, document everything:

1. Screenshot every threatening message, call log entry, and social media post targeting you.
2. Record the full name of the app, the version, the Google Play or App Store URL if it is still live, and the screenshots of its permissions screen.
3. Note the phone numbers from which calls were made. Many use VoIP numbers that still carry metadata useful for investigation.
4. Download a copy of the loan agreement if the app emailed you one. If it never sent a signed agreement, document that absence.
5. Save the morphed images or defamatory messages sent to your contacts — these are critical evidence under IT Act Section 67.

Evidence gathered before blocking is admissible. Evidence gathered afterwards is harder to reconstruct. If your photos were misused, also read how to take down misuse of your photos online and deepfake blackmail recovery steps.

For every loan app that is either unauthorised by RBI or violating the Digital Lending Directions, report directly on sachet.rbi.org.in. Sachet is RBI's platform for complaints about entities operating in the financial sector without proper authorisation or in breach of RBI norms.

File a complaint on Sachet for:

• An app disbursing loans without being an RBI Regulated Entity or an NBFC licensed under RBI.
• An app accessing your contact list or sending messages to third parties.
• An app charging fees not disclosed in any agreement.
• Recovery agents using threats or public shaming.

Keep your Sachet complaint reference number. If RBI takes action against the entity, your complaint becomes part of the regulatory record. If Sachet does not resolve your complaint within 30 days, escalate to the Banking Ombudsman or the RBI Integrated Ombudsman Scheme. For complaints where the RBI Ombudsman has already rejected your case, see what to do when your RBI Ombudsman complaint is rejected.

Online complaints do not replace a formal First Information Report. Visit your nearest police station or the State Cyber Crime Cell and:

1. Present the screenshots and your cybercrime.gov.in reference number.
2. Ask for an FIR under the Information Technology Act (especially Section 66C for identity theft and Section 67 for transmitting obscene material if morphed images were used).
3. Ask for an FIR under Indian Penal Code / Bharatiya Nyaya Sanhita for criminal intimidation if explicit threats were made.
4. If you need to file the complaint entirely online without visiting a police station, read the complete cyber crime complaint guide and cybercrime portal vs police station — which to choose.

A registered FIR enables the police to request data from the platform or telecom operator under lawful process, which is the primary tool for unmasking anonymous harassment numbers. To download an existing FIR copy, see how to download your FIR copy online.

If the app also tricked you with false promises about loan terms, the digital arrest scam playbook may overlap. Read the guide on digital arrest scams for additional protection steps.

Some loan apps request access to your banking app, UPI PIN, or OTP as a “verification step.” If you shared any such credentials:

• Call your bank's 24×7 helpline immediately and report a suspected compromise.
• Request a temporary block on your account or UPI handle until the risk is assessed.
• File a complaint with the Banking Ombudsman if your bank is unresponsive or a fraudulent transaction has occurred and is not being reversed.

The RBI Ombudsman can order restitution for fraudulent transactions where the bank failed to act promptly after being notified. If your bank account has been frozen as part of a cyber fraud investigation, read bank account freeze due to cyber fraud and the bank's process for freezing accounts after fraud.

If your bank refuses to refund under the zero-liability framework, escalate using the bank-refused-refund escalation guide. For UPI-specific fraud recovery, see UPI fraud recovery steps.

You can get a fake loan app removed from the Play Store or App Store, cutting off its victim pipeline:

1. Google Play: Open the app's Play Store page → tap “Flag as inappropriate” → select “Harmful or dangerous” or “Impersonation.”
2. Apple App Store: Use the “Report a Problem” feature on the app's page.
3. MeitY takedown: The Ministry of Electronics and Information Technology has the power to direct Google and Apple to take down apps that violate Indian law. Your cybercrime.gov.in complaint triggers this channel. Report at meity.gov.in.
4. Sanchar Saathi: Report the phone numbers used by the app's recovery agents at sancharsaathi.gov.in for blocking.

When enough users report an app, the platform removes it. Your report protects future victims.

RBI's current commercial-bank and NBFC credit-facilities directions restrict covered digital lenders' data access and use. Preserve proof and complain to the regulated lender; report threats or unlawful publication separately.

Preserve full evidence first. You may then block abusive numbers, while keeping one written official channel open with the verified lender.

No. Liability under a genuine contract and unlawful collection conduct are separate issues.

Treat it as a warning sign. Verify the repayment destination independently with the lender and report suspected fraud promptly.

Tell the lender's fraud team, secure accounts, check credit reports and make a cybercrime or police report with identity-misuse evidence.

No. It covers eligible complaints against regulated entities under the current Scheme after the entity-level complaint step.

Ask for the privacy policy, collected-data inventory, purpose, recipients and available deletion controls. Some records may have lawful retention duties.

Use a written verified channel. If you discuss repayment, request the complete calculation and written terms before paying.

• Consumer rights and complaint process
• Online payment fraud recovery
• Cybercrime complaint filing guide
• Bank locker access and disputes
• AI RTI Drafter
• PIO Reply Checker
• The RTI Playbook
• RTI Wiki home
• Bihar's microfinance coercive-recovery law — what it bans and how to invoke it
• All loan, credit report and recovery guides in one place

• RBI — Commercial Banks Credit Facilities Directions, updated July 2026
• RBI — NBFC Credit Facilities Directions, updated July 2026
• RBI — current Master Directions directory
• PIB — Government measures against illegal digital lending apps, July 2026
• RBI — Integrated Ombudsman Scheme, 2026 FAQ
• RBI — Integrated Ombudsman Scheme, 2026
• RBI Complaint Management System
• Ministry of Home Affairs — National Cyber Crime Reporting Portal

Last reviewed: 1 September 2026.