Complaints Against Digital Lenders and Illegal Loan Apps

This guide covers:

• Regulated Entities (REs) including commercial banks, small finance banks, and NBFCs executing credit through digital lending apps.
• Lending Service Providers (LSPs) and digital agents engaged by regulated lenders for marketing, customer acquisition, underwriting support, or loan recovery.
• Unregulated, illegal lending applications hosted on third-party app stores or APK distribution links that operate predatory extortion rackets.

Violations covered include:

• Harvesting mobile contacts, media galleries, call records, and device files.
• Funneling loan funds through unregulated intermediary or third-party pool accounts.
• Denying borrowers a Key Fact Statement or refusing to honor the mandatory cooling-off period.
• Abusive recovery, criminal intimidation, and sending obscene messages to contacts.

The Reserve Bank of India (Digital Lending) Directions establish strict guardrails governing all digital credit operations [1]:

• Direct Account-to-Account Transfers: All loan disbursements and repayments must flow strictly between the bank account of the borrower and the regulated entity, without passing through any pool account or third-party ledger of an LSP.
• Data Privacy and Permission Restrictions: Digital lending apps are strictly prohibited from accessing mobile phone resources such as contact lists, call logs, device storage, and media galleries. One-time access to camera, microphone, and location is permitted solely for onboarding and completing video-KYC with customer consent.
• Cooling-Off / Look-Up Period: Every borrower has an explicit statutory right to exit a digital loan without paying any prepayment penalty by paying the principal and proportionate APR within a cooling-off window (minimum three calendar days for loans having a tenure of seven days or more).
• Mandatory Nodal Grievance Redressal: Every RE and LSP must appoint a dedicated Nodal Grievance Redressal Officer whose contact details must be clearly displayed on the app and website. Complaints must be resolved within thirty calendar days.

For illegal, unlicensed loan apps, operations violate Sections 308 (extortion), 351 (criminal intimidation), and 356 (defamation) of the Bharatiya Nyaya Sanhita, 2023, along with Sections 66E (privacy violation), 67, and 67A (publishing sexually explicit material) of the Information Technology Act, 2000 [2], [3].

How you proceed depends on whether the digital lender is legally regulated or an illegal front:

• Pathway A: Regulated Digital Lenders. Open the app's details page and identify the underlying bank or NBFC. Regulated lenders must disclose this partnership clearly. If the app charged an undisclosed fee or violated recovery norms, send an email to the Nodal Grievance Officer of the partner NBFC. If unresolved after thirty days, file a complaint on cms.rbi.org.in. The Ombudsman can award compensation up to ₹20 lakh for financial loss and ₹1 lakh for mental harassment.
• Pathway B: Illegal / Unregulated Loan Apps. If the app does not name an RBI-registered NBFC, uses overseas APK links, or disburses money through personal UPI Virtual Payment Addresses (VPAs), it is an illegal syndicate. Do not negotiate or pay repeated extortion demands. Immediately report the entity to the state police cyber cell via cybercrime.gov.in and call 1930. Next, lodge an alert on the RBI Sachet portal (sachet.rbi.org.in) to trigger inter-agency blocking by the Ministry of Electronics and Information Technology (MeitY).

The most devastating mistake victims make is paying extortion demands in the hope that blackmailers will delete stolen data or stop calling contacts. Blackmailers treat every payment as proof of vulnerability, immediately demanding higher sums under new pretexts. Paying money never resolves illegal loan harassment.

A second mistake is uninstalling the application and deleting chat history before creating backups. To secure police action and account freezing, you need digital evidence. Always capture clear screenshots of WhatsApp threat messages, call logs, SMS threats, the APK package name, and the specific UPI transaction IDs used for transfers.

A third error is lodging complaints against the frontend brand name alone when dealing with a regulated entity. If an app named "QuickCash" commits a violation, check its sanction letter to identify the actual NBFC behind it. Always cite the registered name of the NBFC in your regulatory complaints.

Follow these numbered steps if faced with digital lending misconduct:

1. Secure Evidence: Take full screenshots of the app interface, sanction letter, Key Fact Statement, payment transaction receipts, WhatsApp threats, and call records. Note the UPI IDs and bank account numbers to which payments were sent.
2. Revoke Permissions: Open your phone's Settings > Applications, find the lending app, and manually revoke all permissions (camera, microphone, location, contacts). Uninstall the app if it is unlicensed.
3. Notify Contacts: If recovery agents threaten to defame you, send a standard broadcast message to family and friends: "My phone data has been compromised by an illegal cyber syndicate. Please ignore, report, and block any abusive messages or morphed images received from unknown numbers."
4. File on National Cybercrime Portal: If faced with extortion, black-marketing, or morphed images, visit cybercrime.gov.in or dial 1930 immediately. File an online complaint under the category "Report Cybercrime Related to Women/Children" or "Financial Fraud".
5. Report to RBI Sachet: Open sachet.rbi.org.in, click on "File a Complaint", and report the app as an unauthorized financial entity.
6. Escalate Regulated Lenders: If the lender is an RBI-registered NBFC, lodge an internal complaint with the Principal Nodal Officer, and on day 31, lodge a complaint on cms.rbi.org.in.

In K.S. Puttaswamy, the Supreme Court established that individuals possess an inalienable right to privacy over their personal data, mobile records, and identity documents [4]. Unauthorized harvesting of mobile contacts and private media by lending applications constitutes a direct constitutional violation that supports civil and criminal prosecution. In IAMAI v. RBI, the Court affirmed that the Reserve Bank holds plenary regulatory powers under the Banking Regulation Act, 1949 and the Payment and Settlement Systems Act, 2007 to issue binding mandates regulating electronic financial platforms and third-party digital facilitators [5].

Can a digital lending app access my gallery and contacts legally?

No. Under the RBI Digital Lending Directions, regulated lending apps are strictly prohibited from accessing mobile contacts, media galleries, call records, and local phone storage [1]. Any app demanding these permissions is either violating RBI directions or operating as an illegal platform.

What should I do if a loan app circulates morphed photos of me?

Dial 1930 immediately and file a complaint on cybercrime.gov.in under Section 67A of the IT Act and Section 356 BNS [2], [3]. Block the harassing numbers, inform your contacts about the cyber extortion, and do not pay any money.

How do I check if a loan app is registered with the RBI?

Check the app's website and terms to find the name of its partner Bank or NBFC. Cross-check the name on the official list of registered NBFCs and authorized digital lending apps published on the RBI website (rbi.org.in).

Can an illegal loan app take me to court or damage my CIBIL score?

No. Unregistered and illegal loan applications have no legal standing to file recovery suits. Because they are not connected to authorized Credit Information Companies, they cannot report defaults or damage your official credit score.

Does Tele-MANAS provide support for loan harassment stress?

Yes. If you or someone you know is experiencing severe distress or mental trauma from loan harassment, call the national tele-mental health helpline Tele-MANAS at 14416 or 1800-891-4416 for free, confidential round-the-clock psychological support.

• Digital and App Lending Overview
• Recovery and Harassment: What Agents May Not Do
• How to File on the RBI CMS Portal
• Criminal Intimidation and Police Complaints