Loan App Harassment in India: What Is Illegal, and Exactly What to Do

Short answer: a lending app that threatens you, calls your contacts, or morphs your photographs is committing offences and breaking RBI’s Fair Practices Code at the same time. You do not have to choose between “pay it and make it stop” and “do nothing”. The sequence that works: establish who the regulated lender behind the app is, revoke the permissions, complain in writing to that lender’s grievance officer, then escalate to the RBI Ombudsman (free, up to ₹30 lakh plus ₹3 lakh for harassment). In parallel report the harassment on 1930 / cybercrime.gov.in and, if there is no regulated lender at all, on RBI’s Sachet portal. Recovery agents may not call you before 8 a.m. or after 7 p.m., and may not contact your family or employer about your debt.

General consumer information, not legal advice. If you are being threatened or feel unsafe, contact the police — 112 — first. Nothing here is a reason to delay that.

Find the regulated entity. Everything else follows from it.

Under RBI’s digital lending framework, an app is not the lender. It is a Lending Service Provider or a digital lending app operated on behalf of a Regulated Entity — a bank or an NBFC. The regulated entity must disclose its name to you up front, in the app and on its website, and RBI maintains the list of digital lending apps reported by regulated entities. So the first question is not “how do I make them stop” but “whose NBFC licence is this loan sitting on?” Look in:

• the Key Fact Statement and sanction letter you were sent (the lender must be named there);
• the app’s Play Store or App Store listing — policy requires the licensed lender to be named;
• your bank statement: the credit that disbursed the loan carries the lender’s name, and under the rules the disbursal must come from the regulated entity’s account directly to yours, never through an intermediary pool account;
• your credit report from CIBIL, Experian, Equifax or CRIF — free once a year from each — which names the lender that reported the account.

Two outcomes, and they lead to different doors:

What the rules actually give you

RBI’s digital lending framework, first issued in September 2022 and since consolidated into directions, gives every borrower these:

The contacts-access rule is the one that dismantles most harassment: an app that is calling your colleagues obtained that list in breach of the framework, and saying so in writing to the regulated entity converts a recovery dispute into a compliance problem for the lender.

Recovery conduct: the lines agents may not cross

RBI’s Fair Practices Code, which applies to the regulated entity and to anyone recovering on its behalf, prohibits:

• calls before 8 a.m. or after 7 p.m.;
• harassment, whether verbal or physical, anonymous calls, or persistently calling to harass;
• using abusive, threatening or humiliating language;
• discussing the debt with your family, friends, employer or contacts — the debt is between you and the lender;
• impersonating a police officer, a court, a lawyer or a government body.

Threats to circulate morphed images, to publish a “defaulter” poster to your contacts, or of arrest, are not merely code breaches. Depending on what is done they can amount to criminal intimidation, extortion, defamation, obscenity offences under the Information Technology Act, 2000, and — where a person is driven to self-harm — abetment of suicide. Those are police matters, and the police complaint should be filed regardless of the RBI track.

The order to do things in, today

1. Secure the phone. Revoke contacts, SMS, storage, camera, microphone and location permissions for the app in your phone settings. On Android, Settings → Apps → the app → Permissions. Do not uninstall yet — you need the screenshots.
2. Capture evidence before it disappears. Screenshot the loan summary, the KFS, the amount credited, the repayment schedule, every threatening message with its sender number and timestamp, and the app’s listed permissions. Export the call log. This is the whole case.
3. Warn your contacts in one line. “A loan-recovery app may message you about me. It is a known harassment tactic. Please ignore and do not reply.” This removes most of the leverage.
4. Keep paying what is genuinely due, through the traceable channel — the regulated entity’s account or its official app — and keep the receipts. Non-payment is a separate problem you do not want added to this one. Never pay into a personal UPI ID.
5. Write to the regulated entity’s grievance officer. One page: loan account number, app name, amount, what was charged that was not in the KFS, the contacts-access breach, the recovery calls with dates and times, and the relief you want — recovery calls stopped, unlawful charges reversed, data deleted, written confirmation.
6. At thirty days, file with the RBI Ombudsman at cms.rbi.org.in. Free, no lawyer. Claim the loss and the separate head of up to ₹3 lakh for time, expense and mental agony — harassment cases are exactly what that head is for.
7. In parallel: cybercrime.gov.in and 1930 for the threats; sachet.rbi.org.in if no regulated lender exists; report the app to Google Play or the App Store under their personal-loan policies; and a police complaint if there is any threat to you or your family.

What not to do

• Do not take a second loan to close the first. This is the mechanism by which a ₹5,000 loan becomes a ₹2 lakh problem, and the apps are frequently operated by related parties who refer you onward deliberately.
• Do not pay into a personal UPI ID or a phone number. It is untraceable, it is a breach of the disbursal-and-repayment rule, and it will not be credited against your loan.
• Do not send more KYC documents to an app that is already harassing you.
• Do not delete the messages, however much you want to. They are the evidence.
• Do not go silent. A written, dated, reasonable communication to the lender is what converts you from “absconding borrower” into a complainant with a record.

Frequently asked questions

Can a loan app legally call my contacts?

No. RBI’s digital lending framework bars lending apps from accessing your contacts, call logs, SMS and media gallery at all, and the Fair Practices Code separately prohibits discussing your debt with your family, friends or employer. An app doing this has breached both, and that breach is the strongest point in a complaint to the regulated lender and to the RBI Ombudsman.

How do I find out which company is actually behind a loan app?

Check the Key Fact Statement and sanction letter, the app’s store listing, the credit entry in your bank statement showing who disbursed the money, and your credit report, which names the lender that reported the account. Under the framework the regulated entity — a bank or NBFC — must be disclosed to you upfront, and RBI maintains the list of digital lending apps reported by regulated entities.

What time can recovery agents call?

Between 8 a.m. and 7 p.m. only. Calls outside those hours, anonymous calls, repeated calls made to harass, abusive or threatening language, and any contact with your family or employer about the debt are all prohibited by RBI’s Fair Practices Code, which binds the lender and anyone recovering on its behalf.

Where do I complain about a loan app in India?

Start with the grievance officer of the regulated lender named in your loan documents, then escalate free to the RBI Ombudsman at cms.rbi.org.in after thirty days. If no regulated lender can be identified, the app is operating outside the system — report it on RBI’s Sachet portal and to the police. Report threats separately on cybercrime.gov.in or by calling 1930.

Do I still have to repay a loan from an illegal app?

Money actually received is generally repayable, but interest, penalties and fees that were never disclosed in the Key Fact Statement are not enforceable, and harassment is never a lawful means of collection. Pay the principal and the disclosed cost through a traceable channel, keep the receipts, and contest the rest in writing rather than under pressure.

Can I exit a digital loan right after taking it?

Yes, within the cooling-off or look-up period stated in your Key Fact Statement. You repay the principal plus the proportionate annual percentage rate for the days used, and no prepayment penalty may be charged. If a lender refuses an exit within that window, that refusal is itself a complaint to its grievance officer and then to the Ombudsman.