Loan App Harassment and Fake Instant Loan App Scams in India — Laws, RBI Rules, and How to Report

This article is for educational and legal awareness purposes only. It does not constitute legal advice or solicitation. Please consult a qualified advocate for advice on specific legal matters.

Introduction

Instant loan apps promise money in minutes with no paperwork and no collateral. For thousands of borrowers across India, that promise has turned into months of harassment, threats, and public humiliation. A small loan of a few thousand rupees can balloon, through hidden charges and steep interest, into a demand many times the original amount. When borrowers cannot pay — and sometimes even before any default — recovery agents linked to unregulated apps have been documented threatening callers, abusing borrowers, and circulating morphed photographs to the borrower’s friends, family, and colleagues.

This article explains how these fraudulent lending operations work, what the Reserve Bank of India’s digital lending rules require of legitimate lenders, the criminal offences such harassment can attract under Indian law, and the practical steps an affected person may take to report and respond. The aim is legal awareness, not alarm. Borrowing from a legitimate, regulated lender carries none of these risks; the problem lies with unregistered and illegal apps operating outside the law.

How Illegal Instant Loan Apps Operate

Investigations by police and reporting by news organisations have documented a recurring pattern in the operation of unregulated loan apps, many of which were run through shell companies, in several cases with overseas control.

Broad permissions at installation. On installation, many such apps demanded sweeping access to the user’s phone — the contact list, photo gallery and media, and call logs — far beyond anything needed to assess a loan.
Small loans, large recoveries. Loans were disbursed quickly but carried heavy hidden charges and high effective interest. Amounts recovered often far exceeded the principal borrowed.
Harassment on default — and before it. When repayment was delayed, recovery agents resorted to threatening and abusive calls and messages. In documented cases, agents circulated morphed or obscene images of the borrower to the contacts harvested from the phone, and sent messages branding the borrower a cheat or fraud.
Organised call-centre networks. The recovery harassment was frequently run through organised telecaller operations, with the lending entities themselves often having no genuine office address.

In 2020 and 2021, this harassment was linked to suicides in some states, prompting police investigations, arrests, and a formal request from a state government to the Reserve Bank of India to act against harassing loan-app agents. These events drove much of the regulatory tightening that followed.

The RBI Digital Lending Framework

The Reserve Bank of India (RBI) regulates lending in India. Legitimate digital lending must flow through RBI-regulated entities, and the RBI has issued detailed rules to protect borrowers.

Guidelines on Digital Lending, 2022

The RBI issued its Guidelines on Digital Lending on 2 September 2022 (circular RBI/2022-23/111). New digital loans had to comply immediately, and existing digital loans were given until 30 November 2022 to fall in line. Key protections introduced include:

Lending only by regulated entities. Loans may be extended only by banks and Non-Banking Financial Companies (NBFCs) that are regulated by the RBI, or by lending service providers acting as their agents. An app by itself is not a lender.
Direct fund flow. All loan disbursals and repayments must move directly between the borrower’s bank account and the regulated entity’s bank account. No third-party “pass-through” or pool account of an app or service provider may sit in between.
Key Fact Statement (KFS). Before a loan is sanctioned, the borrower must receive a Key Fact Statement disclosing the Annual Percentage Rate (APR), the recovery mechanism, and the details of the grievance redressal officer.
Cooling-off period. Borrowers must be given a cooling-off period during which they may exit the loan by repaying the principal and proportionate charges.
Consent-based, need-based data only. Data may be collected only with the borrower’s prior and explicit consent, on a need-based basis, and apps are directed to desist from accessing the phone’s contacts, media files, and call logs.
Grievance redressal. Each regulated entity must appoint a nodal grievance redressal officer to handle digital lending complaints.

Reserve Bank of India (Digital Lending) Directions, 2025

On 8 May 2025, the RBI issued the consolidated Reserve Bank of India (Digital Lending) Directions, 2025 (circular RBI/2025-26/36), which brought the earlier guidelines and related circulars into a single instrument. The Directions carry forward the core borrower protections and tighten reporting obligations on regulated entities, including a requirement to report all their digital lending apps to the RBI.

How to Check if a Lender Is Legitimate

To help borrowers verify a lender, the RBI operationalised a public directory of Digital Lending Apps (DLAs) on its website with effect from 1 July 2025, listing apps reported by regulated entities. An important caveat applies: the RBI has clarified that it does not validate or endorse the apps in the directory — the list is a verification aid, not a recommendation. A borrower may also check the RBI’s published list of registered NBFCs to confirm whether a lender is RBI-registered.

Separately, app store policy now requires that personal-loan apps offered in India be associated with an RBI-regulated entity, and the government has used its blocking powers to remove large numbers of illegal lending apps from circulation.

Criminal Law Provisions

Harassment and extortion by loan-app agents can attract several offences under the Bharatiya Nyaya Sanhita, 2023 (BNS) — India’s penal code that replaced the Indian Penal Code with effect from 1 July 2024 — and under the Information Technology Act, 2000 (IT Act).

Key Statutory Provisions

Under the Bharatiya Nyaya Sanhita, 2023:

Section 308 — Extortion. Putting a person in fear of injury in order to dishonestly induce payment is extortion. Threatening calls demanding money beyond what is lawfully due can fall within this provision.
Section 351 — Criminal intimidation. Threatening a person with injury to their person, reputation, or property to cause alarm.
Section 318 — Cheating. Dishonestly inducing a person to part with money or property by deception, which can apply to hidden charges and misrepresented loan terms.
Section 108 — Abetment of suicide. Where harassment drives a person to suicide, this provision may be invoked against those who abetted it.
Section 75 — Sexual harassment and Section 79 — words, gestures or acts intended to insult the modesty of a woman. These may apply where the harassment of women borrowers takes a sexual or modesty-related form.

Under the Information Technology Act, 2000:

Section 66C — Identity theft.
Section 66D — Cheating by personation using a computer resource.
Section 66E — Violation of privacy, which addresses capturing, publishing, or transmitting the image of a private area of a person without consent.
Sections 67 and 67A — publishing or transmitting obscene material, and material containing a sexually explicit act, in electronic form. These provisions are directly relevant where morphed or obscene images are circulated.

Where morphed or indecent images of women are circulated, the Indecent Representation of Women (Prohibition) Act, 1986 may also be relevant, though its provisions predate digital media and the principal protection for image-based abuse online comes from the IT Act and BNS provisions above.

A Note on Recent Court Developments

In an order dated 26 February 2026, the Supreme Court of India dismissed an appeal by the Enforcement Directorate and upheld the quashing of money-laundering proceedings against a payment gateway that had merely processed transactions for an entity linked to alleged illegal loan apps, on the view that there was no material to show the intermediary knowingly handled proceeds of crime. The significance of this development is narrow and procedural: it concerns the liability of a payment intermediary under money-laundering law, and does not dilute the criminal liability of those who operate illegal apps or carry out harassment.

How to Report and Respond

An affected person has several official channels available. The following are public, government-operated avenues.

Step-by-Step Reporting

Report financial cyber fraud quickly. Call the cyber crime helpline 1930 (operated under the Indian Cyber Crime Coordination Centre, Ministry of Home Affairs) and file a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Prompt reporting improves the chances of freezing fraudulent transactions.
Report unregistered lenders to the RBI. Use the RBI’s Sachet portal at sachet.rbi.org.in to report unregistered or unauthorised lending entities.
File a police complaint or FIR. Approach the local police station or cyber cell with all available evidence.
Women facing harassment may also contact the national women helpline 181, available around the clock.

Important Points to Remember

Preserve all evidence. Take screenshots of threatening messages, abusive calls and call logs, morphed images, and bank or transaction statements before deleting anything or uninstalling the app.
Verify before borrowing. Check whether the lender is an RBI-registered bank or NBFC, and whether the app appears in the RBI’s DLA directory, remembering that the directory is a verification aid and not an endorsement.
Review app permissions. Be cautious of any loan app demanding access to contacts, photos, and call logs, and revoke such permissions where possible.
Harassment is not a lawful recovery method. Even where a genuine debt exists, recovery through threats, abuse, or circulation of private images is a criminal offence and can be reported, independent of any dispute over the loan amount.
Seek qualified advice. A person facing such harassment, or unsure whether a loan agreement with an unregulated lender is enforceable, may consider consulting a qualified advocate.

Useful Resources

Disclaimer: The information provided on this website is for general legal awareness and educational purposes only. It does not constitute legal advice, advertisement, or solicitation. No reader should act or refrain from acting based on this information without seeking professional legal counsel. Advocate Akhil Singh and this website are not liable for any actions taken based on the content provided herein.