Direct answer (50 words): If an illegal loan app is calling your spouse, parents or boss with morphed photos and abuse, you have rights. RBI Digital Lending Guidelines 2022 ban contact scraping. File NCRP at cybercrime.gov.in within 24 hours, lodge BNS §351 + §296 FIR, report the app to Google Play, freeze repayment to unregistered lenders.
My cousin in Pune borrowed ₹6,000 from a slick app called “RupeeQuick” in March 2026. The app promised “no paperwork, money in 5 minutes.” During install it asked for contacts, gallery, SMS, location. He clicked Allow All because he needed cash for his daughter's school fee.
The app deposited ₹4,200 (after a ₹1,800 “processing fee” he never agreed to). Repayment due in 7 days, not 30. He missed the deadline by 4 days. Then the abuse started.
A WhatsApp group was created with his entire phone book, 487 contacts. His face was morphed onto an obscene image with the caption “This man is a thief, he ran away with ₹50,000.” His daughter's school principal got the picture. His 71-year-old mother got a call at 2 a.m. saying her son had committed suicide and the body was at Sassoon Hospital. His boss was told he had stolen company laptops.
In 38 hours my cousin paid ₹47,000 to make it stop. It did not stop. The next demand was ₹1.2 lakh.
This is not a one-off. The Reserve Bank of India working group on digital lending found over 600 such illegal apps active in India in late 2025. If this is happening to you right now, this guide is the weekend playbook to break the cycle in 72 hours, with the exact statutes, the exact portals, and the exact wording.
Loan app harassment is the use of personal data harvested from a borrower's phone (contacts, photos, call logs, gallery) to coerce repayment by threatening, defaming or sexually intimidating the borrower's family, employer or social network. It is illegal under Indian law regardless of whether you actually owe the money. The Reserve Bank of India in its Digital Lending Guidelines dated 2 September 2022 prohibits regulated entities from accessing borrower contact lists, gallery, or call logs. Apps that violate this are operating outside the regulated ecosystem and have no legal authority to recover anything.
Para 5 of the guidelines (read with Annex II) restricts data access to “only camera, microphone, location or any other facility necessary for the purpose of onboarding/KYC requirements only, with the explicit consent of the borrower.” Contact scraping is expressly forbidden. The full circular is at https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12382. Any app that pulled your contact list during install is operating outside this framework and is, by definition, an unregulated entity.
Rule 3(1)(b)(ii) and 3(2) require intermediaries (Google Play, WhatsApp, Telegram) to remove morphed obscene content within 24 hours of a complaint by the affected person. The grievance officer details are mandatory and publicly listed.
Even regulated lenders cannot call before 8 a.m. or after 7 p.m., cannot contact relatives unless you have defaulted and they are guarantors, and cannot use abusive language. Unregulated apps have zero recovery rights, the entire interaction is criminal.
You can file an RTI under §6(1) to the RBI Department of Regulation asking whether the entity behind the app is a registered NBFC, and to the Ministry of Electronics and IT asking the status of action against the URL/APK. RTI is your weapon to expose institutional inaction within 30 days.
In Mohd. Bhasheer v. State of Telangana (2023, Telangana HC, Crl.P. 5234/2022) the court refused to quash an FIR against a Chinese-origin loan app director, holding that contact scraping plus morphed image distribution constitutes a continuing offence and that arguments about the borrower's “consent” at install do not survive when the app exceeds RBI's permitted data scope. In Sandeep Kumar v. Union of India (2022, Delhi HC, W.P.(C) 5450/2022) the court directed Google to remove 94 illegal loan apps within 48 hours of identification by the Ministry of Home Affairs.
Borrower: A 34-year-old delivery rider, Hadapsar, Pune. App: RupeeQuick (Play Store), removed 19 March 2026. Loan asked: ₹6,000. Net received: ₹4,200. Repayment demanded in 7 days: ₹9,400. Total extorted before intervention: ₹47,000 over 38 hours. NCRP filed: 16 March 2026, ack number MH-CYB-26-0394XXX. FIR: 17 March 2026, Hadapsar Police Station, BNS §§351, 296, 318, 356 + IT Act §§66E, 67A. UPI freeze: ₹31,000 of the ₹47,000 reverse-credited within 6 days via NPCI dispute. Outcome: App delisted by Google 19 March, two arrests in Bengaluru on 4 April 2026. Total out-of-pocket loss: ₹16,000 (against ₹4,200 actually received, a 281 percent loss before recovery).
To, The Central Public Information Officer, Department of Regulation, Reserve Bank of India, Central Office, Mumbai 400 001. Subject: Request for information under §6(1) of the RTI Act, 2005 Sir/Madam, Under §6(1) of the Right to Information Act, 2005, I request the following information for the period 1 January 2025 to 30 April 2026: 1. The total number of complaints received by RBI against the digital lending app "[App Name]" / package ID "[com.example.xxx]". 2. Whether the said app is operated by a Regulated Entity (RE) within the meaning of the RBI Digital Lending Guidelines dated 2 September 2022. If yes, the name and CoR number of the RE. 3. Action taken by RBI under §45L and §45MA of the RBI Act, 1934 read with the Digital Lending Guidelines, 2022, against the said app. 4. Copy of any advisory issued to scheduled commercial banks regarding freezing of merchant UPI VPAs linked to the said app. I am enclosing the IPO of ₹10 towards application fee. I claim exemption / fee waiver under §7(5) if applicable as I am a victim of the harassment that is the subject of this RTI. Should any portion be claimed exempt under §8, I request severance under §10. If the information is held by another public authority, please transfer under §6(3) within 5 days. Reply is due within 30 days under §7(1). I reserve my right to first appeal under §19(1). Yours faithfully, [Name] [Address] [Email and phone] [Date]
No legal recovery action lies against you for an unregulated lending entity. The amount actually disbursed (not the inflated demand) may be morally repayable, but no court will entertain a recovery suit by an unlicensed lender, and the Maharashtra Money Lending Act, 2014 plus the Karnataka Prohibition of Charging Exorbitant Interest Act, 2004 make the contract void at the borrower's option.
Never. It is a criminal offence under BNS §296 + §356 and IT Act §66E + §67A regardless of any “consent” you clicked at install, because consent under §43A SPDI Rules and Rule 3 of IT Rules 2021 must be specific and informed, and bulk contact extraction fails this test per Justice K.S. Puttaswamy (2017) 10 SCC 1.
A dismissal solely on the basis of an external defamatory message, especially one tied to a registered FIR, is challengeable as victimisation under §25F of the Industrial Disputes Act, 1947 (for workmen) or under contract law. Forward your FIR copy to HR proactively, the moment they see “registered criminal case, identified scam” the calculus flips.
Forward the image to WhatsApp's grievance officer at [email protected] with your FIR number and a §43A IT Act takedown demand. WhatsApp policy commits to action within 36 hours; with an FIR attached, our case studies show 4 to 12 hours.
Even if you owe a regulated NBFC ₹50,000 and have defaulted, contact harassment, morphed images and night calls remain criminal. The debt and the harassment are two separate legal channels. Pay the genuine debt through normal channels, prosecute the harassment regardless.
Yes. Recording a call you are a party to is legal in India per R.M. Malkani v. State of Maharashtra AIR 1973 SC 157, and is admissible as evidence under §63 of the Bharatiya Sakshya Adhiniyam, 2023, provided you can authenticate it with a §63(4) certificate.
Yes. Under §35 of the Companies Act, 2013 and the doctrine of personal criminal liability under BNS, the directors of the operating company are personally liable. The MeitY block-list and Ministry of Corporate Affairs filings give you the names. The Bhasheer judgment confirms personal prosecution survives even when the company is shell-structured offshore.
First-level acknowledgement is instant. Bank-level UPI freeze on a fresh complaint averages 4 to 18 hours. App takedown averages 36 to 96 hours when supported by an FIR. Arrest of operators averages 30 to 90 days.
Need an RTI to RBI or MeitY about a specific app right now? The free AI RTI Drafter generates a citation-perfect RTI in 90 seconds, including the §6(1), §6(3), §7(1), §10 and §19(1) hooks already drafted into your facts.