Loan App Threatening Your Contacts or Misusing Your Photos? Here Is How to Stop It and Report It

Who this guide is for

This guide is for anyone who took a small loan from a mobile app and is now facing harassment because of it. It is especially for you if:

• The app is sending messages or calls to your saved phone contacts, telling them you are a defaulter or a fraud.
• The app has taken your photos or selfies and is misusing or morphing them to threaten or shame you.
• You are getting abusive calls, threats of violence, or demands for amounts far higher than what you borrowed.
• You suspect the app is an unregistered or illegal digital lender that hides its real interest and fees.

It helps whether you still owe a genuine balance or not. The harassment, contact misuse, and photo misuse are separate wrongs you can report even while sorting out any real dues.

Who this guide is NOT for

This guide does not cover an ordinary loan or EMI dispute with a regulated bank or NBFC where there is no harassment of your contacts. If a recovery agent is calling you within civil limits, or your loan is wrongly marked on your credit report, see our guides on an unauthorised loan app or NBFC loan showing on your credit report and on a loan wrongly marked NPA despite regular payment. It also does not give you tailored legal advice. If you face serious threats of violence, blackmail with intimate images, or a demand for a large sum, consult a qualified lawyer and approach the police without delay.

What you can do this weekend

Friday evening

Stay calm and start collecting evidence before you change anything. Open the app store and note the exact app name and developer name, and screenshot the listing. Take screenshots of the loan agreement or sanction screen, the amount you received, and the amount being demanded. Save every threatening message, call log entry, voice note, and email with the date and time visible. If any morphed or misused photo has been sent, screenshot it too. Do not delete anything and do not uninstall the app yet, because the evidence lives inside it.

Saturday

Now cut off the app's reach. Open your phone Settings, find the loan app, open its Permissions, and screenshot what it currently holds. Then revoke access to Contacts, Photos and Media, SMS, and Storage. On Android you can also use Settings, then Privacy, then Permission Manager. Next, send a short, calm message to your close family and key contacts. Tell them an app you borrowed from is sending fake threats, that you are reporting it, and that they should ignore, block, and screenshot any message. This single step removes most of the power the app is trying to use against you.

Sunday

Prepare your complaints. Organise all your screenshots and records into one folder named by date. Draft a plain account of what happened: when you took the loan, how much you received, what was demanded, and how the app threatened you and your contacts. Keep your bank or UPI records of money received and repaid handy. On Monday you can file online at the cyber-crime portal and visit the police station with a printed complaint. If the lender is unregistered or clearly illegal, plan to lodge a complaint on the RBI Sachet portal as well. Having everything ready makes the filing quick and credible.

Evidence and documents checklist

Step-by-step action plan

Step 1 — Capture the app details and all evidence

Before you touch anything, record what you are dealing with. Note the exact app name and the developer or company name shown in the app store, and screenshot that listing. Screenshot the loan agreement, the amount disbursed, and the amount now demanded. Save every threatening message, missed-call and call-log entry, voice note, and email, making sure the date and time are visible. If your photos have been morphed or shared, capture those too. Collect everything first, because some of this evidence disappears once you uninstall.

Step 2 — Revoke the app's permissions

These apps cause harm through the permissions you granted at install: Contacts, Photos or Gallery, SMS, Storage, and sometimes Camera and Location. Open your phone Settings, find the app, open Permissions, and first screenshot what it holds. Then switch off Contacts, Photos and Media, SMS, and Storage. On Android you can also use Settings, then Privacy, then Permission Manager, to confirm nothing is left on. Cutting access stops fresh data being harvested. You may uninstall the app afterwards, but only once your evidence is saved.

Step 3 — Warn and protect your contacts

The app's main weapon is shame. Defuse it by telling your circle first. Send a short, calm note to close family and important contacts: you took a small app loan, the app is now sending fake or threatening messages, you are reporting it to the police and cyber cell, and they should ignore, block, and screenshot any such message without replying. Ask them to forward you screenshots if they receive anything. When the people who matter already know the truth, the threats lose their grip.

Step 4 — File a cyber-crime complaint

Report the harassment on the National Cyber Crime Reporting Portal at cybercrime.gov.in, or call the cyber-crime helpline 1930. Choose the category that fits your situation, describe the app, the contact and photo misuse, and the threats, and upload your evidence. If money was extorted or you were defrauded through hidden charges, use the financial-fraud option and act quickly, because early reporting improves the chance of tracing funds. Save the acknowledgement and the complaint reference number carefully.

Step 5 — File a police complaint for the threats

Submit a written complaint at your local police station. Describe the criminal intimidation, the extortionate demands, and the defamation through messages to your contacts and misuse of your photos. Attach printed copies of your key evidence and a list of your complaint references. Ask for a stamped, dated acknowledgement of your complaint. The exact sections of criminal law that apply depend on the facts, so let the police record the offences; if they are reluctant, you can escalate to a senior officer in writing and, where needed, take legal advice.

Step 6 — Complain on the RBI Sachet portal

Many predatory apps are unregistered digital lenders operating outside the regulated system. Lodge a complaint on the RBI Sachet portal at sachet.rbi.org.in, which is meant for complaints about entities that take deposits or lend without authorisation. Under RBI's broader digital-lending framework, regulated lenders must follow fair-practice and data-protection norms, and a genuine lender should not be harvesting your contacts or threatening third parties. Reporting the app here adds it to the regulator's radar. Keep the reference number with your other complaint records.

Escalation ladder

Copy-paste complaint template

Use this for the police station and adapt it for the cyber-crime portal. Replace the text in square brackets with your own details before sending.

When RTI can help

The Right to Information Act, 2005 applies only to public authorities. A predatory loan app, and the private company behind it, is not a public authority, so you cannot file an RTI against the app itself. The correct first route is always cyber-crime, police, and the RBI Sachet portal, as set out above. That said, RTI can still play a supporting role once a public authority is involved in your case:

• After you file a police complaint, you may file an RTI with the police department, where it is a public authority and the information is not exempt, asking about the status of action taken on your complaint.
• The Reserve Bank of India is a public authority. You may file an RTI with the RBI to ask, in general terms, about the status of a complaint you lodged or about publicly available information on action against unregistered digital lenders, subject to the exemptions in the Act.
• If a public sector bank's account or payment channel was used to disburse or collect the money, RTI to that bank may help you obtain certain records held by it, again subject to the exemptions and to third-party-information limits.

To use this route, read our guides on how to file an RTI online in India and, if a public authority does not respond in time, on how to file a first appeal under Section 19. Note that RTI gives you information; it does not by itself stop the harassment, so it works alongside, not instead of, your cyber-crime and police complaints.

When RTI will not help

The loan app and its company: these are private bodies, not public authorities, so RTI does not apply to them at all. Do not waste time trying to file an RTI with the app. Use cybercrime.gov.in, the 1930 helpline, the police, and the RBI Sachet portal instead.

Other people's personal data: RTI does not let you obtain the personal details of the app's operators or other private individuals where that information is exempt as personal information with no public interest. Tracing the offenders is the job of the police and cyber-crime investigators, not of an RTI application.

Ongoing investigation material: information that could impede an investigation may be withheld under the Act's exemptions. So while you can ask about the status of action taken, you may not get the full investigation file. For anything sensitive or high-stakes, rely on the investigating agency and, where needed, a qualified lawyer.

Common mistakes to avoid

• Uninstalling the app before saving evidence. Once the app is gone, the loan agreement, chat history, and permission list may be lost. Always screenshot and export everything first, then revoke permissions, and only then uninstall.
• Paying inflated amounts under threat. Predatory apps demand far more than you borrowed and often escalate after each payment. Do not make panic payments. Confirm whether the lender is even a regulated entity before paying anything, and take legal advice for large sums.
• Hiding it from your family and contacts. Silence is exactly what the app exploits. Warning your circle first removes the shame, so they ignore and screenshot the messages instead of believing them.
• Only blocking numbers and doing nothing else. Blocking helps, but the app simply switches numbers. You must also report it on the cyber-crime portal and to the police so there is an official record and an investigation.
• Not noting complaint reference numbers. Without the acknowledgement and reference numbers from cybercrime.gov.in, the police, and Sachet, you cannot follow up or escalate. Save every reference the moment you get it.
• Trying to file an RTI against the app. A private app is not a public authority, so RTI does not apply. Use RTI only for a public authority's record of action taken on your complaint.
• Granting these permissions again on a new app. Before installing any loan app, check who the lender is and never grant Contacts, Photos, or SMS access to a lending app. A genuine lender does not need your contact list.