Loan App Harassment and Where to Report

• Borrowers and Contacts: Victims of abusive recovery calls, threats, obscene messages, or public shaming, including family members, friends, and employers contacted by recovery agents.
• Regulated Lenders (Banks & NBFCs): Institutions held strictly vicariously liable for the unlawful acts of their outsourced Lending Service Providers (LSPs) and collection agents.
• Illegal and Unregulated Lending Apps: Rogue offshore or domestic syndicates operating without an RBI licence, engaging in extortion and data theft.
• Criminal Conduct Covered: Extortion, blackmail using morphed photographs, criminal intimidation, intentional insult to provoke breach of the peace, defamation, and digital voyeurism.

             [Harassment or Coercive Threats Occur]
                                │
        ┌───────────────────────┴───────────────────────┐
        ▼                                               ▼
[Regulated Bank / NBFC Involved]             [Illegal / Unregulated App]
        │                                               │
 1. Document evidence (recordings,               1. Do NOT transfer ransom money
    screenshots, call logs, notices)             2. File report at cybercrime.gov.in
 2. Lodge complaint with Bank/NBFC                  or dial 1930
    Grievance Redressal Officer                  3. Inform family/contacts that 
 3. If unresolved after 30 days,                    phone data was stolen
    escalate to RBI Ombudsman (cms.rbi.org.in)   4. File complaint on Sachet portal
 4. Report to local Cyber Crime Police              (sachet.rbi.org.in)

Step 1: Secure and Preserve All Evidence

Never delete chat histories, call recordings, SMS messages, or UPI payment receipts.

• Take high-resolution screenshots of WhatsApp chats, threatening text messages, and caller phone numbers.
• Record all incoming recovery calls where abusive language, threats, or extortion demands are made.
• Note the exact timestamps, transaction IDs, and virtual payment addresses (VPAs) through which funds are demanded.

Step 2: Immediate Notice to Your Contact List

If an unauthorized app has accessed your contact book and is threatening to distribute morphed images or defamatory messages:

• Send a standard advisory message to your contacts: "My mobile device has been targeted by a fraudulent cyber syndicate. If you receive any unsolicited messages, forged legal notices, or manipulated photographs mentioning my name, please block the number, report the sender on WhatsApp, and do not entertain them."
• Proactively alerting contacts neutralises the leverage and blackmail power exploited by digital extortionists.

Step 3: Register a Formal Cybercrime Police Complaint

• Dial 1930 immediately to report financial extortion, unauthorized digital transfers, or morphing.
• Log on to cybercrime.gov.in and register a complaint under the category "Crime Against Women/Children" (if morphed or sexually explicit imagery is involved) or "Financial Cyber Fraud".
• Attach the screenshots, audio files, payment receipts, and app store links. Keep the National Cyber Crime Acknowledgement Number for formal police follow-up.

Step 4: Redressal via RBI Ombudsman (for Regulated Lenders)

If the harassing entity represents an RBI-regulated bank or NBFC:

• Send a formal complaint via email to the Principal Nodal Officer of the bank or NBFC.
• If no response is received within 30 days, or if the response is unsatisfactory, lodge a dispute on the RBI CMS portal (cms.rbi.org.in) under the Reserve Bank - Integrated Ombudsman Scheme, 2021.

1. Paying Extortion Demands Under Panic

When rogue recovery agents threaten to circulate morphed images, borrowers frequently pay small amounts (e.g. ₹5,000 or ₹10,000) hoping the extortion will end. In reality, payment confirms vulnerability; extortion syndicates escalate demands, demanding ₹50,000 to ₹1,00,000 within hours. Paying ransom never stops harassment.

2. Isolation and Psychological Distress

Victims often suffer severe anxiety, shame, and isolation, hiding the harassment from spouses or parents. Rogue operators exploit this shame to drive victims to extreme distress. Immediate communication with trusted family members and professional counsellors via Tele-MANAS (14416) is essential to counter this psychological pressure.

3. Destruction of Evidentiary Trails

Victims often panic, uninstall the application, delete WhatsApp conversations, and throw away SIM cards before securing backups. This destroys the primary digital evidence required by state cybercrime cells and the police to trace bank accounts and IP addresses.

4. Police Refusal to Register an FIR

Local police stations occasionally attempt to turn away victims by classifying recovery harassment as a "civil debt dispute." When threats of violence, extortion, or morphed photographs exist, the conduct is strictly criminal under the Bharatiya Nyaya Sanhita and IT Act, and the police are legally bound to register a First Information Report (FIR).

Practical Self-Defense Checklist

• Block and Report: Use the built-in "Report and Block" feature on WhatsApp, Truecaller, and mobile telecom dialers.
• Turn On Truecaller Spam Protection: Enable advanced spam filtering to automatically silence calls from non-contacts or high-spam numbers.
• Revoke Device Permissions: Access your phone settings and revoke all storage, camera, microphone, and location permissions for all unfamiliar applications.
• Never Send Money via Personal UPI IDs: Do not transfer funds to random personal UPI IDs or dynamic QR codes sent over WhatsApp. Valid loan repayments must occur solely via official bank payment gateways.

Legal Escalation Steps

1. Submit Formal Cyber Complaint: File on cybercrime.gov.in and keep the acknowledgement slip.
2. Submit Sachet Complaint: If the lender is an illegal app without an RBI registration, submit details on sachet.rbi.org.in to trigger state-level Coordination Committee action.
3. File Section 156(3) Application: If the local police station refuses to register an FIR despite evidence of extortion or morphing, engage an advocate to file an application before the jurisdictional Judicial Magistrate under Section 156(3) of the Code of Criminal Procedure, 1973 (or Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita, 2023) to order an immediate police investigation.

What should I do if a loan app is threatening to send morphed photos to my contacts?

Do not send any money. Paying extortionists guarantees they will demand larger amounts. Immediately inform your close family and contacts that your device was targeted by a cyber fraud syndicate distributing fake images. File a complaint on cybercrime.gov.in or call 1930 immediately. Seek emotional support from the free national helpline Tele-MANAS (14416) if you are feeling overwhelmed.

Can recovery agents legally call my relatives, friends, or employer?

No. Under the RBI Digital Lending Directions (September 2022) and the Master Circular on Recovery Agents (August 2022), lenders and their agents are prohibited from contacting third parties who are not co-borrowers or legal guarantors. Calling your phone book contacts is a violation of banking regulations and amounts to criminal defamation and harassment.

What are the legal calling hours for debt recovery agents?

Under RBI directions issued on 12 August 2022, recovery agents can only contact borrowers between 08:00 AM and 07:00 PM. Calling early in the morning, late at night, or persistently throughout the day is strictly illegal.

Will the police take my complaint seriously, or will they call it a civil matter?

If there is harassment, abusive language, morphing of photos, or threats to reputation, the offence is criminal (extortion, criminal intimidation, and IT Act violations). Under the Supreme Court ruling in Lalita Kumari v. Govt of U.P., the police are legally required to register an FIR when a cognizable offence is disclosed.

Where can I report an illegal Chinese or offshore loan app?

Report unregulated and illegal loan apps on the RBI Sachet portal (sachet.rbi.org.in) and the National Cybercrime Reporting Portal (cybercrime.gov.in). These portals feed intelligence directly to state-level law enforcement, the Ministry of Electronics and Information Technology (MeitY), and the Indian Cyber Crime Coordination Centre (I4C) to block rogue domains and apps.

Can an RBI-regulated bank be punished if their outsourced recovery agent misbehaves?

Yes. The RBI holds banks and NBFCs vicariously liable for the actions of their collection agents. The RBI has repeatedly levied monetary penalties and barred financial institutions from deploying recovery agents in regions where abusive practices were documented.

• Legal vs Illegal Loan Apps
• How to Verify Regulated Lenders
• Data Permissions and Privacy
• Complaints and Redressal