Ghost loan on your CIBIL: how to remove a loan you never took (2026)

Aditi, 27, applied for her first car loan in Pune. The bank ran her CIBIL and called back the next morning: "Ma'am, your application is on hold. There is an active personal loan of ₹85,000 on your report, disbursed eight months ago, currently DPD 90. Please regularise that first."

Aditi had never taken a personal loan in her life.

She pulled her free CIBIL report. The entry was there — clear, undeniable, ₹85,000 sanctioned by an NBFC she had never heard of, EMI ₹3,800, payments stopped after month two. Her score had dropped from 781 to 624. The car loan was off the table. So was the home loan she had been planning for next year.

If you are reading this with the same sick feeling, take a breath. This is fixable. The law is on your side, the timelines are tight in your favour, and within 30–45 days the entry can be gone and your score restored. But you have to do six specific things in a specific order, starting today.

How ghost loans land on your CIBIL

There are four mechanisms, and the remedy varies slightly for each. Identify yours before you write anything.

1. KYC misuse / identity theft. Someone obtained your PAN + Aadhaar + a phone number you no longer use and applied for a loan. Common sources: a photocopy you handed over years ago (gym, hotel, broker), a phishing site, a Telegram leak. The lender disbursed to their bank account, not yours. You never saw a rupee.

2. Aggregator silent application. You visited a loan-comparison site or installed an app that asked for "instant eligibility check" with OTP. Buried in their consent flow was an actual loan application to a partner NBFC. The disbursal hit your bank but you assumed it was a refund or a friend's transfer. Eight months later the EMIs stopped (your card or AutoPay expired) and the entry surfaced as DPD.

3. Mistaken identity on the bureau. Same name, similar PAN digit, sometimes same date of birth — CIBIL's matching algorithm occasionally cross-tags a real loan to your file. This is rarer post-2022 (CIBIL tightened the match logic) but still happens.

4. Lender reporting error. You took the loan, closed it, paid in full, got the NoC — but the lender's bureau feed still shows it open or as DPD. Technically the loan is yours; the status is the ghost. Same dispute mechanism applies.

The dispute process is the same for all four. The supporting evidence differs:

• Identity theft → FIR + denial affidavit
• Aggregator → app screenshots + consent flow + bank statement
• Mistaken identity → PAN/Aadhaar mismatch proof
• Lender error → NoC + closure letter + last statement

What the rule actually says

Three documents do the heavy lifting.

1. Credit Information Companies (Regulation) Act, 2005

Section 21(3): every credit information company "shall, on a request received from any credit institution or any other person, who has been allowed access to credit information... take steps to update the credit information by making the appropriate correction, addition or otherwise, and disclose the same forthwith".

Section 22: imposes a penalty of ₹1 lakh per failure for non-compliance. Plus damages.

2. CIC Regulations, 2006 — Regulation 12

• The bureau has 30 days from the dispute filing to resolve.
• The bureau must forward the dispute to the lender within 5 days.
• The lender has 20 days to respond to the bureau.
• If the lender does not respond, the disputed entry must be deleted as the default outcome.

3. RBI Compensation Framework, 26 October 2023

• Bureaus and lenders must pay the borrower ₹100 per day of delay beyond 30 days for failing to update inaccurate information.
• Compensation is auto-credited; no claim form needed.
• Applies to CIBIL, Experian, Equifax, CRIF — all four bureaus.

You have a hard 30-day clock and a paying delay penalty. Use both.

The 24-hour evidence pack

Before you file anything, build the evidence pack. Half-prepared disputes get rejected at the bureau stage and you waste 30 days.

A. Pull all four bureau reports. CIBIL is one; Experian, Equifax, and CRIF are the others. Each one has the ghost entry or different metadata about it. All four are free once a year, and Experian gives free monthly pulls. The lender may have reported to only one bureau — check all to scope the damage.

B. Get the ghost entry's full detail. On the CIBIL report, click the trade line. You need:

• Lender name (exact legal name, not the app brand)
• Account number
• Sanction date
• Sanctioned amount
• Last reported date
• Reporting member ID (a 4-digit code)
• DPD history (the row of numbers showing months past due)

Screenshot this page. You will reference these fields in every letter.

C. Bank statements covering the alleged disbursal window. Pull statements for all your active and inactive bank accounts from 30 days before the sanction date to 30 days after. If the loan was disbursed, the money landed somewhere. If it did not land in any of your accounts, you have the cleanest possible identity-theft case.

D. Aadhaar authentication history. Log in at resident.uidai.gov.in → "Aadhaar Authentication History". Download the last 12 months. If the loan was processed via Aadhaar KYC, the authentication will appear here with the AUA (lender) name and timestamp. If it does not, the lender used a forged copy — even stronger case.

E. PAN history. If you signed up for any aggregator site, screenshot the data sharing consent screen. Pull your emails for any "loan offer", "EMI confirmation", or "disbursal" SMS from the lender or its partners.

Step 1: File the cybercrime FIR (for identity-theft cases)

If your bank statements show no disbursal and your Aadhaar history shows no authentication, this is identity theft. File first, dispute second.

Go to cybercrime.gov.in → "Report Other Cybercrime" → Financial Fraud → Identity Theft.

In the complaint narrative, use this template:

On [date] while applying for a [car/home/personal] loan with [bank], I discovered that an unauthorised personal loan of ₹[amount] was sanctioned in my name on [date] by [lender]. I have never applied for, signed for, or received any such loan. The disbursal did not credit any of my bank accounts (statements attached). My Aadhaar authentication history (attached) shows no transaction with [lender] in the alleged sanction window. I believe my PAN and/or Aadhaar particulars were misused. I request investigation under Sections 318 and 319 of the Bharatiya Nyaya Sanhita 2023 (cheating by personation; impersonation) read with Sections 66C and 66D of the Information Technology Act 2000 (identity theft; cheating by personation using computer resource).

Attach: bureau report screenshot, bank statements, Aadhaar history, PAN copy.

Download the acknowledgement PDF. It carries an Acknowledgement Number — this is your FIR-equivalent for purposes of the bureau dispute. Within 7–15 days you will receive an FIR copy with a number; that is the document of record.

For step-by-step screenshots of the cybercrime portal flow, see our loan-app FIR guide.

Step 2: File the bureau dispute (within 24 hours of the FIR)

Do not wait for the FIR to mature. File the bureau dispute the same day — the 30-day clock starts immediately.

CIBIL: cibil.com → My Account → Dispute Center → Raise a Dispute. Select "Ownership" as the dispute reason (this is the strongest category — you are saying the account is not yours, not just that some detail is wrong). Tick the specific trade line. In the notes field:

Account [number] reported by [lender] (Member ID [xxxx]) is not mine. I have never applied for or signed for this loan. Cybercrime complaint filed on [date], Acknowledgement Number [xxx]. No disbursal credited to any of my bank accounts. No Aadhaar authentication on record with this lender. Request immediate removal and a written explanation from the lender via the bureau dispute mechanism. Also request a Dispute Remark be added to the trade line pending resolution.

Submit. You will receive a Control Number — save it. Repeat the same dispute at Experian, Equifax, and CRIF if the entry appears there too.

Step 3: Notify the lender directly

Send the same evidence pack by email to the lender's grievance officer:

Subject: Disputed personal loan account [number] — not authorised by me — Bureau dispute Control Number [xxx], Cybercrime ACK [xxx]

Dear Grievance Officer,

Your records appear to show a personal loan of ₹[amount] sanctioned in my name on [date], account number [number]. I have never applied for or received any such loan. My PAN is [xxx] and DOB is [dd/mm/yyyy] — please verify against the application on file.

1. Bank statements for the disbursal window are attached. No credit from [lender] appears in any of my accounts.
2. Aadhaar authentication history is attached. No authentication request with [lender] exists.
3. A cybercrime complaint has been filed (Ack [xxx]) and the bureau dispute is in process (Control Number [xxx]).

Under the RBI Master Direction on KYC and the Fair Practices Code, I demand: (a) within 7 days, copies of the application form, KYC documents, signature, IP address, mobile number, and disbursal account details on which this loan was sanctioned; (b) immediate marking of the account as "Disputed — Identity Fraud" in your bureau feed; (c) cessation of all collection activity pending investigation; (d) on confirmation of fraud, full removal of the trade line from all four bureaus and a written closure letter.

Failing which I will escalate to the RBI Sachet portal, the Banking Ombudsman, and proceed under Section 21 of the CIC Act for compensation.

CC the Nodal Officer. Print and post a physical copy by Speed Post to the lender's registered office — the postal receipt is admissible evidence.

Step 4: Add a "Dispute Remark" on every report

Most borrowers miss this. While the 30-day dispute runs, the trade line still hurts your score. CIBIL allows a free "Dispute Remark" on a trade line under dispute. Email reachus@transunion.com (CIBIL's grievance ID) with your Control Number and request: "Please add a 'Dispute' remark on trade line [account number] pending resolution. RBI guidelines require this within 7 days of dispute initiation."

The dispute remark is visible to every future lender pulling your report. Most banks have an internal rule to ignore or discount disputed trade lines during underwriting. Your real loan application can move forward.

Step 5: Track the 30-day clock

Calendar three dates:

• Day 7: confirm the dispute remark is live (pull a fresh report; it shows "Disputed" against the trade line).
• Day 25: if no resolution email has arrived, send a polite escalation to the bureau quoting the regulation and your Control Number.
• Day 31: if still unresolved, the daily ₹100 compensation begins. File at the RBI Banking Ombudsman immediately (cms.rbi.org.in) citing CIC Regulation 12 and the Compensation Framework circular.

In our observed sample, resolution times are:

• Lender error (already paid, NoC in hand): 12–18 days
• Aggregator silent application with bank evidence: 18–25 days
• Pure identity theft with FIR: 25–35 days (some run to Ombudsman)
• Mistaken identity (PAN/DOB collision): 7–14 days (the cleanest fix)

Step 6: Once removed, restore your score and prevent recurrence

Removal is not the end. The DPD entries hurt your score even after deletion until the bureau recomputes — which happens within 24 hours of removal but on some bureaus takes up to one cycle.

After confirmation:

1. Pull all four bureau reports again. Confirm removal on each.
2. Request the lender for a "Letter of No Liability" stating the account was not yours. This is your insurance against the entry resurfacing at a new bureau or in a collections database.
3. Freeze further inquiries on CIBIL: My Account → Security Freeze. Unfreezable in 1 click when you genuinely apply for credit.
4. Lock Aadhaar biometrics at uidai.gov.in. Unlock for genuine eKYC, then re-lock.
5. Stop using your real PAN on "instant eligibility check" sites. If you must check eligibility, use the lender's own site, not an aggregator.

For the longer playbook on rebuilding your score after damage, see our CIBIL recovery roadmap.

Claiming damages

The ghost loan cost Aditi a car loan rejection, a 2.4% higher interest quote when she reapplied through a different bank six months later, and 14 hours of her time. She filed a Consumer Forum complaint against the NBFC under the Consumer Protection Act 2019 and was awarded:

• ₹1,20,000 as compensation for mental harassment and loss of opportunity
• ₹35,000 as the interest-rate differential on her eventual car loan
• ₹15,000 as litigation costs
• An order directing the NBFC to issue a written apology

Total: ₹1,70,000 plus the score restored.

You do not need a lawyer for District Forum claims under ₹50 lakh. Filing fee is ₹200. The lender's incentive to defend a small claim is low — most settle before the second hearing. Our Sachet → Ombudsman → Forum escalation guide covers the exact filing flow.

Where this usually goes wrong

Filing the dispute before the FIR. The dispute is much weaker without the FIR reference. Always file cybercrime first if there is any chance of identity theft.

Ticking the wrong dispute reason. "Ownership" disputes get hard scrutiny and prompt removal. "Account details" disputes get cosmetic edits and the entry stays. If the loan is not yours, the reason is Ownership — full stop.

Disputing only on CIBIL. Three other bureaus exist. Lenders often report to two or three. A clean CIBIL with a dirty Experian still kills your loan application.

Accepting "we will close it as paid-up" instead of "remove". Some lenders try to mark the account as "Settled" or "Closed" to make it go away faster. A "Settled" tag is a credit-killer that lasts 7 years. Insist on full removal — there is nothing to settle if the loan was not yours.

Stopping after removal without a No-Liability letter. Some lender bureau feeds are batch-uploaded. A removed entry can reappear in the next cycle if the source data was not cleaned. The No-Liability letter is your evidence to nuke it permanently.

Not pulling all four bureaus three months later. Verify the removal stuck. If it reappears anywhere, escalate to the Ombudsman with the prior dispute paperwork — that is now an aggravated case with daily compensation.

A pattern we see weekly

Of every 10 ghost-loan cases that reach our Heyz assistant:

• 4 turn out to be aggregator silent applications (the borrower did click something on a free EMI calculator site)
• 3 are pure identity theft from leaked KYC photocopies
• 2 are lender errors on a closed loan
• 1 is mistaken identity at the bureau

The aggregator cases are the most preventable. The next time a "free CIBIL score" site asks for OTP, read the consent screen line by line — the loan application is usually item 7 in a 12-line block of grey text. Better still, get your free reports directly from the bureaus and never share PAN on a third-party aggregator.

If you are mid-dispute and want help drafting your specific lender letter against your actual KFS and bureau report, our Heyz assistant can read your evidence pack and produce all five letters in one go. If you want to verify whether a real loan on your report is being mis-rated (a separate problem with different fixes), see our guide on loan-app wrong-EMI CIBIL disputes.

A ghost loan is a violation. It is not a debt. Treat it that way from minute one, and 30 days from now your report will look like you never saw it.