What to do about loan app harassment

This is the diagnostic step and everything follows from it.

The Reserve Bank has stated the position directly: lending business can be carried out only by entities that are either regulated by it — banks and registered non-banking financial companies — or entities permitted to do so under other law, including state money lending legislation. It has also warned specifically about unauthorised digital lending platforms and mobile apps charging excessive rates and hidden charges, adopting unacceptable recovery methods, and misusing agreements to access borrower data.

Under the digital lending framework, a lending service provider or digital lending app operating on behalf of a regulated entity must disclose that entity. The app or its key fact statement should name the bank or NBFC on whose books the loan sits. If no regulated entity is named anywhere — not in the app, not in the loan agreement, not in the disbursal message — treat that as the answer.

Check the money trail as a cross-check. A regulated lending arrangement requires disbursal and repayment to flow between the borrower's bank account and the regulated entity's account, without pass-through accounts belonging to intermediaries. Money that arrived from, or must be repaid to, a personal account or an unnamed payment handle is a strong indicator.

Look at the loan documentation. A regulated lender must give you a key fact statement setting out the annual percentage rate, the recovery mechanism, the grievance redressal officer's details and the cooling-off arrangements. No documentation at all, or documentation that appears only after disbursal, is characteristic of unauthorised operations.

Note the deduction at source. Where a much smaller sum arrives than was agreed, with the difference described as a processing fee, that pattern combined with a very short tenure is the standard predatory structure and is inconsistent with the disclosure requirements a regulated lender operates under.

Do not rely on the app's own claims. Apps routinely display a plausible company name and an NBFC registration number that is either invented or belongs to an unconnected entity. Where a name is given, check it against the Reserve Bank's own published list of registered NBFCs rather than accepting the app's assertion.

Stop paying under pressure. Paying an inflated demand to make the calls stop is the most common response and it reliably produces more demands, because it identifies you as someone who pays under pressure. Where a genuine principal is owed to a genuine lender, that can be dealt with properly afterwards.

Preserve everything before you delete anything. Screenshot every message, every call log entry with the number and timestamp, every threat, every message sent to a contact of yours, and the app's own screens showing the terms, the disbursal amount and the demand. Save the loan agreement and the disbursal SMS. This evidence is what every subsequent route depends on and it disappears when you uninstall.

Revoke the app's permissions — contacts, storage, photos, SMS, call logs — in your phone settings, then uninstall it. Revoking before uninstalling matters, because uninstalling alone does not always withdraw permissions already granted, and the contact list is the mechanism of the harassment.

Tell your contacts before the messages reach them, or as soon as they do. This is unpleasant and it is the single most effective countermeasure available, because the entire business model depends on shame. A short message explaining that a predatory app has your contact list and may send them something removes almost all of the leverage.

If money has been debited fraudulently, or you have paid to an account you now believe to be fraudulent, call 1930 immediately and file on the national cybercrime reporting portal. For financial fraud the speed of that call matters more than anything else, because the chance of freezing funds falls sharply with time.

File on cybercrime.gov.in with the evidence attached. The portal is the formal route for cyber-enabled financial crime and the online report is itself a formal complaint.

File an FIR where there have been threats, intimidation, extortion, morphed images or defamatory messages to your contacts. These are offences in their own right. Registration is mandatory where the information discloses a cognisable offence, and a station cannot refuse on jurisdiction grounds.

Where a regulated entity is behind the app, complain to that entity's grievance redressal officer in writing, whose details it is required to give you, and keep the reference. That step is a precondition for the Ombudsman route.

Where a bank or a registered NBFC sits behind the app, you are not making a moral appeal — you are asserting compliance obligations that already bind them.

The Reserve Bank's guidelines on recovery agents are explicit about conduct. Recovery agents must not resort to harsh methods: no use of threatening or abusive language, no persistently calling the borrower outside the stated hours of the day, no harassing relatives, friends or co-workers, no publishing the borrower's name, no threats of violence or bodily harm, and no misleading representations about the nature or consequences of the debt.

The Fair Practices Code requires that lenders should not resort to undue harassment in recovery — persistently bothering borrowers at odd hours or using muscle power is specifically identified as impermissible.

The digital lending guidelines add a layer directed at exactly this business model: disclosure of the regulated entity behind a lending app, a key fact statement including the annual percentage rate, restrictions on the flow of funds through pass-through accounts, limits on the data an app may access from the borrower's device, and a requirement that borrower consent for data be explicit and revocable.

Every regulated entity must have a dedicated grievance redressal mechanism for recovery-related complaints, and the details of it must be given to the borrower at disbursal. If the app never gave you those details, that is itself a breach and is worth stating in the complaint.

The escalation, where the entity does not resolve the complaint, is the Reserve Bank's ombudsman scheme, which covers deficiency in service by regulated entities, is free to the complainant, and is designed to be used without representation.

None of this depends on whether you owe the money. The recovery conduct rules are about conduct, and a borrower in default is entitled to their protection in full.

If no bank or registered NBFC can be identified, the framing changes completely: this is not a lending dispute with a compliance problem, it is a criminal operation, and the regulatory routes have nothing to bite on.

The conduct involved typically maps onto several offences under the criminal law — criminal intimidation, extortion, defamation where messages are sent to third parties, and offences relating to obscene or morphed images where those are used. Where borrower data has been taken and misused, the information technology framework is engaged as well.

The route is therefore the national cybercrime reporting portal and an FIR, in parallel, with the 1930 helpline where money has moved. The online report on the portal is a formal complaint in its own right and does not replace the FIR for the intimidation offences.

Do not attempt to negotiate or to trace the operators yourself. These operations are frequently run from outside the country through layers of intermediaries, and engagement produces more contact rather than less.

Recognise the debt question honestly. Money that was actually disbursed to you is money you received, and the fact that the operation is unlawful does not mean the sum vanishes as a matter of principle. But the amount demanded — inflated by undisclosed charges, penalties and rollovers — is generally not the amount received, and an unregistered operation is not in a position to enforce anything through a court. The practical answer is to stop paying, document everything, and report.

Protect the rest of your finances. Where the app had access to your device, assume other credentials may be compromised: change passwords for banking and email, enable two-factor authentication, and check your credit report for accounts you did not open, since data harvested in these operations is reused.

Where threats extend to your workplace or family, tell them yourself first, and consider informing your employer's HR function directly rather than letting a message from an unknown number be their first information.

Once the immediate pressure is off, there are three pieces of clearing up worth doing.

Check your credit record. A regulated lender will have reported the loan and any default to the credit information companies, and an unregulated one will not have — which is itself a useful diagnostic. Where a default has been reported that you dispute, or where an account appears that you did not open, the credit information framework provides a dispute process through the credit information company and the lender.

Deal with any genuine underlying debt properly. Where a regulated lender is owed a real principal, engaging with its formal grievance and settlement process, in writing, is far better than either paying under pressure or ignoring it. A documented settlement closes the matter; a payment made to stop calls does not.

Review the permissions on every financial app on your phone. The specific permission that makes this harassment possible is access to contacts, and almost no legitimate lending app has a genuine need for it. Treat a request for contact list access from a lending app as disqualifying.

On borrowing safely in future, the checks are short. Confirm the regulated entity behind the app and check the name against the Reserve Bank's published list. Read the key fact statement, and specifically the annual percentage rate rather than a monthly or daily figure. Confirm that disbursal and repayment run through the regulated entity's account rather than an intermediary's. Reject anything with a tenure of days, deductions at source, or contact list access.

If the borrowing need is genuine and small, the alternatives are worth listing precisely because the apps market themselves on the absence of them: a bank overdraft, a loan against an existing deposit or against gold, a co-operative or self-help group facility, an employer salary advance, or a small credit facility through an entity that is actually registered.

Finally, if the harassment has affected your mental health, treat that as a serious consequence rather than an embarrassment. The coercion in this model is designed to be psychologically effective, and the shame it produces is manufactured. Free legal aid through the district legal services authority is available for the criminal complaint side of this for those eligible.