Loan App Harassment: How Illegal Lending Apps Operate

Loan app harassment starts with a loan so small and so instant that the terms barely register. A few thousand rupees, credited in minutes, repayable in a week. The app asked for permission to read your contacts and your photos during installation, and you tapped "allow" because every app does. That tap is the entire business model. What follows, when the week ends, is not debt collection. It is extortion with your own address book as the weapon.

This explainer sets out how illegal lending apps operate, what the law actually permits a lender to do, and the order of steps that makes the calls stop. It is written for the borrower and for the relatives and colleagues who are suddenly receiving messages about someone they know.

How loan app harassment is engineered

The loan is the bait

The apps are advertised on Instagram, YouTube and through SMS as instant personal loans with no documents. The amount is small. A processing fee is deducted up front, so a ₹5,000 loan may credit ₹3,500 with the full ₹5,000 due in seven days. The effective interest is enormous, but the gang does not need the interest. It needs the permissions.

The permissions are the weapon

During installation the app requests access to contacts, photos, location and sometimes SMS. The contact list permission uploads every number in your phone to the operator's server. The photo permission harvests your selfies and family pictures. Under the RBI digital lending guidelines issued on 2 September 2022, a regulated lender's app may not access a borrower's contacts, call logs, files or telephony functions at all. An app that asks is telling you what it is.

The harassment is the revenue

On the due date, or a day before, the recovery agent calls begin. First from one number, then a dozen. Abuse, threats of police cases, threats to visit your home. Then messages go to your contacts: your mother, your boss, your college group, saying you are a fraud and a defaulter. Then the morphed photos, your face edited onto obscene images, sent to the same list with a note. Each stage is designed to extract a payment to "stop it", and each payment is followed by a new, larger balance.

Many operations also push you to take a loan from a second app in the same network to pay the first, so the debt multiplies across apps that are, in fact, one business.

What the law says a lender can and cannot do

Lending in India is regulated. A loan must come from a bank or an NBFC registered with the Reserve Bank, or from an app acting as a lending service provider for one, and the regulated lender's name must appear in the app and in the key fact statement you must be shown before disbursal. Money must flow directly between the regulated lender's account and yours, with no pass-through accounts. A lender may remind you, and may use recovery agents who identify themselves and follow the RBI's fair practices code: no calls at odd hours, no threats, no contact with third parties about your loan.

What the apps do is a set of criminal offences committed against you. Threats of injury or of harm to reputation to extract money are extortion under section 308 of the Bharatiya Nyaya Sanhita, 2023, and criminal intimidation under section 351. Sending morphed obscene images is covered by section 67 of the IT Act, and section 66E where private images are involved. Messages to your contacts calling you a fraud are defamation under BNS section 356. Where the target is a woman, section 79 of the BNS and section 67A of the IT Act may also apply. Our guide to the BNS sections used in cyber crime explains each one.

The RBI's position is on its site and in its Sachet portal, which exists for complaints about unregulated entities; the RBI page on this site explains what the regulator can and cannot do for an individual borrower.

What to do, in order

The reporting menus for WhatsApp, Instagram and Facebook, where the harassment often spills over, are in our platform reporting guide. For women facing morphed images, the National Commission for Women also takes complaints; see NCW and NCPCR online redressal.

The settlement agent, and other second-round tricks

After a few days of silence from you, the tone sometimes changes. A "senior manager" or "legal department" calls offering a one-time settlement at a discount, with a payment link. Or a "cyber police officer" calls saying a case has been registered against you and can be closed for a fee. Or, if you have reported, someone claiming to be from a "loan app grievance cell" or a "recovery firm" offers to get your money back and your data deleted for a charge. All three are the same operation. No genuine recovery or settlement process starts with an unsolicited call and a link.

If a regulated NBFC was genuinely behind the app, settle the actual principal through a bank transfer to the lender's named account and keep the receipt and a closure letter. Do not pay anything to an individual's UPI ID.

Protecting the next person

The apps are removed from stores and re-listed under new names constantly, so warnings by name date quickly. Three rules last. Install a loan app only after confirming the regulated lender it names on the RBI's list. Refuse any lending app that asks for contacts or photos; a legal one is not allowed to. And treat a loan that arrives in minutes with no key fact statement as a trap rather than a convenience. The category, with its links to job and romance frauds run by the same networks, is on the job, loan and romance scams page.

If the calls have reached your workplace or family and you want someone else to handle the reports, the police visit and the correspondence, our loan app harassment service does it for a fixed fee agreed in advance. Helplines for immediate distress are listed on our helplines page.