Loan App Harassment in India 2026: Your Rights & Complaint Playbook

Your rights, the new RBI recovery rules, and the exact complaint playbook that works

---

If you are in distress right now: You are not alone, and this is survivable. Debt is a civil matter — you cannot be arrested for an unpaid personal loan, and no agent has the authority to threaten you. Free, confidential mental health support is available in India through Tele-MANAS: 14416 (24×7, multiple languages) and KIRAN: 1800-599-0019. Please talk to someone before you make any decision about money.

---

On 30 March 2026, the Indian Cybercrime Coordination Centre (I4C), under the Ministry of Home Affairs, sent Google a notice giving it 36 hours to pull six loan applications from the Play Store.

The allegations in that notice describe an entire business model. The apps advertised instant approval and low interest to Android users looking for quick cash. On installation, they allegedly harvested Aadhaar details, financial records, contacts, photographs and camera access. Then, once repayment slipped, that harvested data allegedly became the collection tool.

Six apps. But those six were not the problem — they were a sample.

By December 2025, the Ministry of Electronics and Information Technology told the Lok Sabha it had blocked 87 illegal loan apps under Section 69A of the IT Act. That sits on top of the Ministry of Corporate Affairs probe into 665 Chinese-linked lending apps, and the 94 loan apps blocked back in 2023 for money laundering and improper data handling. Google has separately said it removed thousands of unethical lending apps from the Play Store in India.

And still, in March 2026, six more were live and running ads on the same platform.

If a recovery agent is currently calling your family, morphing your photographs, or threatening you with arrest — this guide is the operational manual. Read the box above first. Then read Part 6, which is the part you can act on in the next sixty minutes.

---

Quick Answers

Question	Answer
Can I be arrested for not repaying a personal loan?	No. Unsecured loan default is a civil matter. Anyone threatening arrest is lying.
Can agents call my family, boss or friends?	Under RBI's Fair Practices Code they cannot use them to pressure you, and the 2026 draft recovery directions propose barring contact with relatives, friends and colleagues outright.
What time can agents legally call me?	8:00 AM to 7:00 PM only. Nothing outside that window.
Are morphed photos a crime?	Yes — under the IT Act and Bharatiya Nyaya Sanhita. Report immediately to 1930 / cybercrime.gov.in and file an FIR.
Do I still owe the money?	If the lender is a registered bank/NBFC, yes — the debt survives even if the collection was illegal. The two issues are separate.
Where do I complain?	cybercrime.gov.in / 1930 for threats and data misuse → lender's grievance officer → cms.rbi.org.in after 30 days → sachet.rbi.org.in for unregulated apps.

---

Part 1: How Big Is This Problem, Actually?

Numbers, not vibes.

RBI Ombudsman data. The Annual Report of the Ombudsman Scheme for 2024-25 recorded 13.34 lakh complaints under RB-IOS, up 13.55% on the previous year, which itself had jumped nearly 33%. Of the complaints reaching the 24 Offices of the RBI Ombudsman, loans and advances was the single largest category at 29.25%, ahead of credit cards. NBFCs accounted for 43,864 complaints (14.8%), and 87% of all complaints came from individual retail customers. Grievance volumes in Indian retail credit are not plateauing — they are compounding.

State-level cybercrime data. The Telangana Cyber Security Bureau has described instant loan app fraud as one of the state's fastest-growing cybercrime threats, with complaints rising sharply through 2025 — blackmail, public shaming and threats following app access to phone data. Investigators note the victims are disproportionately students, homemakers and low-income users looking for small, urgent sums.

Enforcement data. MeitY's 87 blocked apps, the MCA's 665-app probe, the 2023 tranche of 94 apps, and I4C's March 2026 takedown notice all point the same direction: this is an adversarial ecosystem where operators disappear and reappear under new names, distribute cloned APKs via Telegram and WhatsApp, and buy social media ads to reach the financially desperate.

The human cost. In Kerala, the death of a first-year dental student earlier this year renewed national scrutiny of digital loan apps after police registered a case against a lending app over alleged intimidation and harassment. It is not an isolated tragedy. This is precisely why the escalation steps in Part 6 exist, and why they should be used early rather than after months of silent suffering.

---

Part 2: The Harassment Playbook — How It Actually Works

Understanding the sequence removes the fear. This is a script, not a personal vendetta.

Stage 1 — The permission harvest. The app asks for contacts, gallery, storage, SMS, location and camera access "to verify your identity." None of that is needed to underwrite a loan. Your bank statement and bureau record do that. The permissions exist for Stage 4.

Stage 2 — The deliberately impossible loan. ₹5,000 disbursed, ₹7,000 due in seven days. Many illegal apps deduct such large upfront "fees" that repayment was never realistic. Default is the product, not the accident.

Stage 3 — The polite reminder. Two days of normal-sounding messages. This establishes that they have your number and you are responsive.

Stage 4 — The contact list. Calls and WhatsApp messages to your mother, your manager, your college group, your landlord. The message is engineered for maximum humiliation: that you are a fraud, a thief, an absconder.

Stage 5 — The image. Your profile photograph, morphed. Sometimes obscene, sometimes a fake "wanted" poster, sometimes a fabricated police notice. Circulated to the contacts harvested in Stage 1.

Stage 6 — The fake authority. Calls claiming to be from police, CBI, or RBI. Sometimes a video call with a man in uniform in front of a fake police backdrop, telling you that you are under "digital arrest" and must pay to close the case. There is no such thing as digital arrest. It does not exist in Indian law.

Stage 7 — The escalating amount. The demand grows every week. It has stopped being about the loan; it is now extortion.

The single most important thing to understand: at Stage 4, they have already used their strongest weapon. They have nothing left. Everything after that is repetition designed to make you pay before you think.

---

Part 3: What the Law Already Prohibits

Recovery agents in India operate under real constraints, and most borrowers have never been told what they are.

Under the RBI's Fair Practices Code and existing recovery instructions, agents cannot:

• Contact you before 8:00 AM or after 7:00 PM
• Use abusive, threatening or intimidating language
• Use your relatives, employer or colleagues as a pressure tactic
• Publicly shame you — society noticeboards, workplace scenes, WhatsApp groups, social media
• Impersonate police, courts, RBI or any government authority
• Threaten arrest, criminal prosecution or "digital arrest" for an unsecured personal loan
• Operate without an authorisation letter, identity card and recovery notice

Under the RBI (Digital Lending) Directions, 2025, lenders and their app partners cannot:

• Access your contact list, photo gallery, SMS inbox or call logs — this is explicitly outside permissible data collection
• Share your data with third parties without explicit, purpose-specific consent
• Store your data outside India (if processed abroad, it must be deleted from foreign servers and brought back within 24 hours)
• Use dark patterns or misleading interface design
• Take repayment into any account other than the regulated lender's

Under the Fair Lending Practice rules on penal charges (effective April 2024):

• Penalties must be flat "penal charges," not penal interest added to your rate
• Penal charges cannot be capitalised — no interest can be charged on the penalty itself
• Charges must be reasonable, disclosed in advance, and communicated when levied

Criminal law that applies to the conduct in Part 2:

• Bharatiya Nyaya Sanhita, 2023 — criminal intimidation, extortion, cheating, and offences relating to obscene or sexually harassing communication
• Information Technology Act, 2000 — identity theft (66C), cheating by personation (66D), violation of privacy (66E), publishing obscene or sexually explicit material (67, 67A)
• Digital Personal Data Protection Act, 2023 — unlawful processing of personal data
• Consumer Protection Act, 2019 — deficiency in service and unfair trade practice

Morphing a photograph and circulating it is not "aggressive collections." It is a cognisable offence.

---

Part 4: What Is Changing in 2026 — The New Recovery Directions

This is the most significant borrower-protection development in Indian lending in years, and it is worth watching closely.

Following an announcement in the Union Budget and the RBI Governor's monetary policy statement, the RBI released draft Amendment Directions on the Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents on 12 February 2026 (press release 2025-2026/2099), covering commercial banks, small finance banks, payments banks, RRBs, cooperative banks, AIFIs and NBFCs. A revised draft followed on 20 May 2026 for a second round of public consultation.

What the drafts propose:

Proposed rule	What it means for you
Agents must deal only with the borrower or guarantor	An outright bar on contacting relatives, friends, referees or colleagues — stronger than the current position
Contact only between 8:00 AM and 7:00 PM	Codified across every lender category
No calls or visits during bereavements, calamities, weddings or festivals	A genuinely new protection
Mandatory IIBF certification for recovery agents	Existing agents get one year to comply
Call recording and documentation of every recovery contact	Ends the "his word against mine" problem in disputes
Public disclosure of empanelled recovery agencies on websites and apps	You can verify whether the caller is authorised
Board-approved recovery policy and full lender accountability	The bank or NBFC owns its agents' conduct; outsourcing is not a defence
Restrictions on device-disabling technology	Lenders may not remotely restrict a phone except where the loan financed that specific device, with the condition disclosed in the agreement and essential and emergency services preserved
Incentive structures must not reward aggressive recovery	Attacks the root cause: commission models that pay for pressure

Important caveat for readers: as of the latest available information, these remain draft Amendment Directions. The February draft proposed a 1 July 2026 effective date; the revised May draft indicates 1 October 2026. Until final directions are notified, the existing RBI circulars and Responsible Business Conduct directions continue to apply. Check the RBI website for the current status before relying on any specific clause.

Either way, the direction of travel is unmistakable, and the existing rules already prohibit almost everything an abusive app does.

---

Part 5: First, Establish Which Situation You Are In

Your strategy depends entirely on this. Spend five minutes here.

Situation A — A regulated lender, badly behaved. The app names a bank or NBFC, appears in the RBI's Digital Lending Apps directory, and gave you a Key Fact Statement. The loan is legitimate; the collection conduct is not. → Your route is the grievance officer, then the RBI Ombudsman. You still owe the money, and you should engage on repayment while separately pursuing the misconduct.

Situation B — An unregulated app. No named bank or NBFC, not in the RBI directory, no KFS, demanded fees before disbursal, installed via an APK link from WhatsApp or Telegram. → Your route is criminal, not regulatory. Cyber cell, FIR, Sachet. The RBI Ombudsman has no jurisdiction over an entity RBI does not regulate.

Situation C — You never took a loan at all. You are being threatened over a loan you never applied for, or your contact was scraped from someone else's phone. → Pure extortion. Cybercrime portal and FIR immediately. You owe nothing and should pay nothing.

How to check: open rbi.org.in → Citizen's Corner → the directory of Digital Lending Apps deployed by regulated entities, and search the app name character by character. Fraudulent apps deliberately mimic legitimate brand spellings. Cross-check the named NBFC on the RBI's list of entities holding a valid Certificate of Registration.

---

Part 6: The Playbook — Exactly What to Do, in Order

In the next 60 minutes

1. Stop paying anything extra. Every rupee paid outside the contracted amount confirms that pressure works and guarantees escalation. If the lender is regulated, pay only the contracted dues through the official channel.
2. Screenshot everything. Call logs with timestamps, every WhatsApp and SMS thread, morphed images, group messages sent to your contacts, agent names and numbers. Back it up to cloud storage and a second device. Evidence decides these cases; memory does not.
3. Do not delete the app before capturing evidence. Screenshot the permissions screen, the loan summary, the lender name (or its absence), and the in-app chat. Then uninstall — and revoke every permission first.
4. Protect your bank account. Call your bank and revoke any e-mandate or UPI AutoPay registered against the app. Do not share OTPs with anyone claiming to be from the lender.
5. Warn your contacts before they are called. One short message to family, close friends and your manager: "An unregistered loan app is misusing my contact list. If you receive calls or images about me, they are fraudulent. I have filed a cybercrime complaint. Please do not respond or pay anything." This single step removes almost all of the humiliation leverage.

Within 24 hours

6. File on the National Cyber Crime Reporting Portal — cybercrime.gov.in. Choose the financial fraud / loan app category. Upload your evidence bundle. For active financial loss, call 1930 immediately — the earlier the report, the better the chance of freezing transferred funds.
7. Write to the lender's Grievance Redressal Officer (if the lender is regulated). Name and contact are in your KFS and on the app. State the loan account number, the specific conduct, the dates, and that you will escalate to the RBI Ombudsman. This email starts a 30-day clock — the escalation route will not accept your complaint without it.

Within 48 hours

8. File an FIR at your local cyber police station if there have been threats, morphed images, impersonation of police, or contact with your family. Take printed evidence. If the station is reluctant, cite the IT Act and BNS provisions in Part 3, and remember you may escalate to the Superintendent of Police.
9. File on sachet.rbi.org.in if the app is unregulated. Complaints there route to the State Level Coordination Committee, which includes RBI, state police and the economic offences wing.

After 30 days

10. File with the RBI Ombudsman at cms.rbi.org.in (helpline 14448) if the regulated lender has not resolved your complaint satisfactorily. It is free, needs no lawyer, and the Ombudsman can award compensation for actual loss and separately for harassment, time and expense. Critical filing detail: file against the NBFC or bank's registered Certificate of Registration name, not the app's brand name. Complaints filed against a brand that is not a regulated entity get returned as non-maintainable.
11. Consider a Consumer Commission complaint under the Consumer Protection Act, 2019 for excess or undisclosed charges. Limitation is two years from the cause of action.

Throughout

12. Never borrow from a new app to repay an old one. This is the single most common way a ₹10,000 problem becomes a ₹1,00,000 one.
13. Keep a written incident log — date, time, number, what was said. It takes two minutes a day and it is what turns a complaint into an award.

---

Part 7: A Complaint Email That Actually Works

Weak complaints get form replies. Use this structure.

Subject: Formal Grievance | Loan A/c [number] | Violation of Fair Practices Code and RBI Digital Lending Directions, 2025 | Escalation Notice

To the Principal Nodal Officer / Grievance Redressal Officer, [Registered name of the NBFC or Bank]

I am a borrower under loan account [number], disbursed on [date] through the [app name] platform.

I wish to place on record the following conduct by your recovery representatives:

1. On [date] at [time], calls were received at [time outside 8 AM–7 PM window] — in violation of RBI's instructions on recovery agent conduct.
2. On [date], your representative contacted [relationship — my mother / my employer] on number [xxxx] and disclosed my loan details — a violation of borrower confidentiality and the Fair Practices Code.
3. On [date], [describe threat / abusive language / morphed image], recorded in the attached evidence.
4. My contact list appears to have been accessed and used for recovery, contrary to the data-access restrictions under the RBI (Digital Lending) Directions, 2025.

Evidence is attached: call logs, screenshots and message records ([n] files).

I request: (a) immediate cessation of all contact with third parties; (b) a written explanation and the name of the recovery agency engaged; (c) a written response within 30 days.

Please note that in the absence of a satisfactory resolution within 30 days, I will escalate this matter to the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme via cms.rbi.org.in, and I have separately filed complaint reference [CRN] on the National Cyber Crime Reporting Portal.

[Name] | [Phone] | [Email] | [Date]

Copy yourself on the email so the timestamp is preserved independently in your own inbox.

---

Part 8: Five Mistakes That Make It Worse

1. Paying "one final settlement" to an unregulated app. There is no final settlement. Payment proves you can be moved, and the demand resets higher.

2. Deleting everything in panic. Uninstalling the app and clearing WhatsApp destroys the evidence your complaint depends on. Capture first, delete second.

3. Going silent with a legitimate lender. If the lender is regulated, silence converts a manageable delay into a default, a bureau downgrade and legal notice. Engage in writing, ask for restructuring, and pursue the misconduct on a separate track.

4. Assuming your contacts will believe them. They usually don't — especially if you warned them first. The threat's power is almost entirely anticipatory.

5. Believing "digital arrest." No police force, no court and no regulator in India conducts arrests over video call or demands payment to close a case. Anyone saying otherwise is committing a crime while you listen.

---

Part 9: The Uncomfortable Question — Do You Still Owe the Money?

Two separate issues, and conflating them costs people badly.

If the lender is an RBI-regulated bank or NBFC: yes, the debt stands. Illegal collection conduct does not void a valid loan contract. It gives you grounds for a complaint, compensation and regulatory action — but not a waiver. Your best position is to pay the contracted dues through official channels while pursuing the misconduct in parallel. Ask for restructuring in writing; regulated lenders have real flexibility, especially before default.

If the app is unregulated: the position is materially different. An entity lending without RBI registration is operating outside the regulatory framework, and demands built on extortion, morphed images and impersonation are criminal acts, not enforceable contractual claims. Practically speaking: file the criminal complaints, stop paying, and take legal advice on your specific facts before making any settlement. Do not let an app that has already broken the law convince you it has legal recourse against you.

Either way, document everything and pay only through traceable, official channels — never to a personal UPI ID, wallet or agent's account.

---

Part 10: How Not to End Up Here Again

• Verify every app in the RBI DLA directory before installing. Four minutes.
• Only install from official app stores. Never from an APK link on WhatsApp or Telegram.
• Deny contacts, gallery, SMS and call log permissions. A legitimate lender does not need your personal life to price a loan.
• Insist on the Key Fact Statement with the all-inclusive APR before accepting. No KFS, no loan.
• Remember the cooling-off period — at least one day, principal plus pro-rata interest and a disclosed one-time processing fee.
• Be alert to social media ads promising "instant approval, no documents." Investigators consistently find fraudulent apps rely heavily on exactly this channel.
• Build a small emergency buffer, and check cheaper options first — employer salary advance, gold loan, credit card EMI conversion, a bank personal loan — before a 30-day app loan.

Read next: the hidden cost of instant loan apps · our shorter recovery-agent rights guide · check what your loan really costs with the true APR tool

---

Frequently Asked Questions

Can a loan app get me arrested for not repaying?

No. Default on an unsecured personal loan is a civil matter, not a criminal offence. A lender's remedy is a civil recovery suit, bureau reporting, and lawful collection. Anyone threatening arrest, "digital arrest," or immediate police action is either lying or committing an offence.

Is it legal for a recovery agent to call my family or employer?

Using your family, employer or colleagues to pressure or shame you is prohibited under the RBI's Fair Practices Code, and the draft 2026 recovery directions propose barring contact with relatives, friends, referees and colleagues altogether. Disclosing your loan details to a third party is separately a breach of borrower confidentiality.

What are the legal calling hours for loan recovery in India?

Between 8:00 AM and 7:00 PM. Calls outside that window are a documented violation. The 2026 draft directions additionally propose barring calls and visits during bereavements, calamities, weddings and festivals.

A loan app morphed my photo and sent it to my contacts. What do I do?

Treat it as a criminal matter, immediately. Screenshot everything, file on cybercrime.gov.in (or call 1930), and file an FIR at your cyber police station. Relevant provisions include the IT Act sections on identity theft, personation, privacy violation and obscene material, alongside the Bharatiya Nyaya Sanhita provisions on criminal intimidation and extortion. Also warn your contacts pre-emptively — it neutralises most of the intended damage.

How do I know whether my loan app is legal?

Check three things: it names a specific bank or NBFC; it appears in the RBI's Digital Lending Apps directory on rbi.org.in under Citizen's Corner; and that NBFC holds a valid Certificate of Registration on RBI's list. All three must match, with exact spellings. If any fails, treat it as unregulated.

Where exactly do I complain about a loan app?

Threats, morphed images, data misuse or fake police calls → cybercrime.gov.in or 1930, plus an FIR. Misconduct by a regulated lender → grievance officer, then cms.rbi.org.in (helpline 14448) after 30 days. Unregulated apps → sachet.rbi.org.in. Excess charges → Consumer Commission under the Consumer Protection Act, 2019.

The app is not RBI-registered. Do I still have to repay?

Illegal lending operations do not enjoy the enforcement rights of regulated lenders, and demands backed by extortion and morphed images are criminal conduct rather than enforceable claims. File your criminal complaints first, stop paying, and take legal advice on your specific facts before any settlement.

Will complaining hurt my CIBIL score?

No. Filing a grievance or a cybercrime complaint has no effect on your credit score. Missed payments to a regulated lender do — which is exactly why you should keep repayment and misconduct on two separate tracks.

How long does an RBI Ombudsman complaint take?

It varies, but the scheme is designed as a fast, free alternate grievance mechanism, and the Ombudsman offices report high disposal rates — around 93% in 2024-25. You must first have complained to the lender in writing and waited 30 days, and you must file within one year of the lender's reply.

Can I get compensation for harassment?

Yes. The Ombudsman can award compensation for actual and consequential loss, and separately for harassment, time and expense. Documented evidence — call logs, recordings, screenshots, your written incident log — is what determines the outcome.

Are all instant loan apps like this?

No, and it matters to say so. A large share of India's digital lending is originated by well-run, RBI-regulated NBFCs and banks with real compliance functions, and it has extended formal credit to crores of people banks would not serve. The abuse is concentrated in unregistered apps operating outside the framework — which is precisely why the four-minute verification check in Part 5 matters so much.

---

Final Word

The asymmetry in loan-app harassment is not really about money. It is about information. The operator knows the law does not permit any of this. The borrower usually doesn't. That gap is the entire business model.

Close the gap, and the pressure loses most of its force. Agents cannot call you at midnight. They cannot call your mother to shame you. They cannot morph your photograph. They cannot arrest you over a video call. And every one of those acts, documented, becomes evidence in a complaint that regulators are now actively processing — the RBI, MeitY, I4C and the state cyber bureaus are all moving on this in 2026, and your complaint is part of what tells them where to look next.

Screenshot everything. File in the right forum. Warn your contacts. And do not face it alone.

---

Sources & References

Regulatory documents

• Reserve Bank of India (Digital Lending) Directions, 2025 — issued 8 May 2025; DLA reporting effective 15 June 2025; multi-lender provisions effective 1 November 2025
• RBI Digital Lending Apps (DLA) directory — operational from 1 July 2025, rbi.org.in, Citizen's Corner
• Draft RBI (Responsible Business Conduct) Second Amendment Directions, 2026 — Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents; press release 2025-2026/2099 dated 12 February 2026; revised draft issued 20 May 2026 for second consultation
• Fair Lending Practice — Penal Charges in Loan Accounts, RBI (August 2023, effective April 2024)
• Reserve Bank – Integrated Ombudsman Scheme (RB-IOS)
• Digital Personal Data Protection Act, 2023; Information Technology Act, 2000; Bharatiya Nyaya Sanhita, 2023; Consumer Protection Act, 2019

Reports

• RBI, Annual Report of the Ombudsman Scheme 2024-25 — 13.34 lakh complaints (+13.55%); loans and advances the largest category at 29.25%; NBFCs 43,864 complaints (14.8%); individuals 87%; disposal rate 93.07%
• FACE (Fintech Association for Consumer Empowerment), Digital Personal Loans, Dec 2025 — digital NBFC sanctions and portfolio quality data
• Telangana Cyber Security Bureau — reporting on the rise in loan app fraud complaints through 2025
• Press Information Bureau — Government and RBI measures against fraudulent loan apps

News coverage

• The Week, 12 May 2026 — I4C notice directing Google to remove six loan apps within 36 hours (notice dated 30 March 2026)
• Business Today / Inc42 / Medianama, December 2025 — MeitY blocks 87 illegal loan apps under Section 69A; Lok Sabha reply by MoS Corporate Affairs
• Medianama, December 2025 — RBI Ombudsman FY25 complaint analysis; MCA probe into 665 Chinese loan apps
• Business Standard, July 2025 — how borrowers can verify apps against the RBI DLA directory
• Entrackr / National Herald / Taxmann, February–May 2026 — coverage of the draft recovery agent directions

References are as available at the time of writing. Draft regulations may have been finalised or amended since — verify current status on rbi.org.in before relying on any specific provision.

---

At SahiSujhav, we cover Indian consumer credit — NBFCs, fintech lending, and borrower rights — with independent analysis and practical, verifiable guidance.

Disclaimer: This article is for information and financial education. It does not constitute legal advice. For your specific situation, consult a qualified advocate, particularly before making any settlement or responding to a legal notice.

---