Stop loan app harassment by not paying extra under threat, saving every abusive call and message, revoking the app's permissions, and reporting on cybercrime.gov.in or 1930. If the lender is RBI-regulated, complain to it and then the RBI Ombudsman; if it is unregulated, report it on RBI's Sachet portal and to police.
Key takeaways
- RBI rules bar regulated lenders' apps from accessing your contact list for recovery.
- Recovery agents may not threaten, abuse or shame you, or call at unreasonable hours.
- Many harassing apps are unregulated; any money lent may still need a lawful settlement.
- Morphed photos sent to contacts are crimes under the IT Act and BNS.
- Complain on 1930, cybercrime.gov.in, Sachet and the RBI CMS as relevant.
What is loan app harassment?
Loan app harassment usually follows a pattern: a quick small loan with huge hidden fees, a short repayment period, then threats when you cannot pay. Common tactics include calls to your relatives and colleagues, WhatsApp groups created with your contacts, messages calling you a thief, and morphed nude photos of you sent to people in your phone.
Much of this comes from illegal, unregulated apps that are not banks or RBI-registered NBFCs, but harassment by agents of regulated lenders also happens. Both are unlawful. This is different from general online fraud, which is covered in our guide on how to report cyber fraud.
What should you do right now to stop the harassment?
- Don't panic-pay amounts demanded through new links or personal UPI IDs. Payments to individuals are often not credited to any loan.
- Save evidence: screenshots of messages, call recordings you have made, caller numbers, the app name and developer, loan agreement, sanction SMS, and every payment receipt.
- Revoke permissions for contacts, photos and storage in phone settings, then uninstall the app after saving its details.
- Warn your contacts briefly that a fraudulent lender may send fake messages or morphed images, and ask them not to engage or forward.
- Report the crime on cybercrime.gov.in or call 1930, and file a police complaint if threats are serious. Call 112 if you feel physically unsafe.
- Report suspicious numbers through Chakshu on Sanchar Saathi.
- Check whether the lender is regulated and file the matching complaint (see below).
If morphed images have been circulated, also use the takedown steps in our guide on deepfake and morphed photo abuse. If you are feeling overwhelmed or unsafe, please reach out to someone you trust or the Tele-MANAS helpline 14416.
What do RBI's digital lending rules say?
RBI's digital lending framework, first issued in September 2022 and consolidated into the Reserve Bank of India (Digital Lending) Directions, 2025 (issued 8 May 2025), applies to banks, NBFCs and other regulated entities and the apps they use. Key protections include:
- Loans must be disbursed to and repaid from the borrower's account directly, without a third party's pass-through account.
- A Key Fact Statement must disclose the all-inclusive cost (annual percentage rate) before you sign.
- Apps must not access your file and media, contact list, call logs or telephony functions; only limited one-time access such as camera, microphone or location for onboarding, with explicit consent.
- A cooling-off period lets you exit the loan early by repaying principal and proportionate cost.
- Lenders must have a grievance officer; if your complaint is not resolved within 30 days, you can approach the RBI Ombudsman.
- The lender is responsible for its lending service providers and recovery agents.
Under the 2025 Directions, regulated entities must report their digital lending apps, and RBI publishes the list on its website under Citizen's Corner ("DLAs deployed by Regulated Entities"), which helps you check whether an app is linked to a regulated lender.
What can recovery agents legally do, and what can't they?
| Allowed (for a regulated lender) | Not allowed |
|---|---|
| Remind you of dues by call, SMS or letter | Abusive language, threats of violence or arrest |
| Call only between 8 am and 7 pm (existing RBI instructions; RBI's new uniform recovery conduct rules, effective 1 January 2027, keep this window) | Repeated calls late at night or early morning |
| Visit your home or office with identity proof and the lender's authorisation | Visits to humiliate you before neighbours or employer |
| Discuss dues with you privately | Calling your relatives, friends or colleagues to shame you |
| Issue a legal notice or start lawful recovery proceedings | Sending morphed photos or calling you a criminal on social media |
| Offer a settlement or restructuring in writing | Taking money in cash or to personal UPI IDs without receipts |
So yes, an authorised agent of a regulated lender can come to your home, but must behave lawfully and identify themselves. Ask for their ID card and authorisation letter, and note their names.
How do you check if a loan app is registered with RBI?
- Find the lender's name in the app, loan agreement or sanction SMS (the app brand is often different from the lender).
- Check whether that lender is a bank or an NBFC listed on rbi.org.in, and look for the app in RBI's published list of digital lending apps of regulated entities.
- Check the company on the MCA portal: a recently formed company with no RBI registration is a warning sign.
- Be wary if the app has no physical address, no grievance officer, no Key Fact Statement or asks for contact access.
The government has blocked many illegal loan apps under the IT Act, and app stores have removed others, but new ones appear frequently, so a blocked list alone is not reliable. For a broader approach to checking companies, see how to verify a company in India.
Where should you complain about a loan app?
| Problem | Where to complain |
|---|---|
| Threats, abuse, morphed photos, messages to contacts | cybercrime.gov.in, 1930, local police |
| Regulated bank or NBFC breaching rules | The lender's grievance officer first, then RBI's Complaint Management System (cms.rbi.org.in) under the Integrated Ombudsman Scheme |
| Unregulated or unknown lender taking deposits or lending | RBI Sachet portal (sachet.rbi.org.in) and police |
| Fraudulent calls and SMS | Chakshu on Sanchar Saathi |
| App still on a store | Report it through the app store's reporting option |
Keep the complaint numbers and mention them in later complaints. If your bank account was frozen due to transactions linked to such an app, see what to do when your bank account is frozen by cyber crime.
Do you still have to repay the loan?
Harassment does not cancel a genuine debt to a regulated lender, but it gives you strong grounds to complain and seek a fair settlement. Repay principal and lawful charges through the official channel and get written confirmation of closure. For illegal apps, the legal position on repayment can be complex: take advice, and do not keep paying escalating "penalties" demanded under threat. Never take a new loan app loan to repay another; this is how many people get trapped.
If you need help documenting the harassment or verifying who is behind an app or recovery agency, a verified investigator on Hire Your Detective can assist your lawyer lawfully. Find a detective near you.
How can you avoid illegal loan apps in future?
Prevention matters because illegal apps target people in urgent need. Before borrowing digitally:
- Prefer loans from your own bank or a well-known NBFC, and confirm the lender's name in the app matches RBI's list.
- Refuse any app that asks for access to contacts, photos or call logs.
- Read the Key Fact Statement; if there is none, or fees are deducted upfront from a tiny loan, walk away.
- Avoid apps promoted only through social media ads, Telegram channels or SMS links.
- Never share OTPs, Aadhaar or PAN images with an unverified app; misuse is covered in our guide on PAN and Aadhaar misuse.
If you are already in several loans, speak to your bank about consolidation or to a registered financial counsellor rather than borrowing more.
Bottom line
Loan app harassment is illegal whether the lender is regulated or not. Save evidence, cut the app's access, warn your contacts, and report on 1930 or cybercrime.gov.in. Use the lender's grievance officer and RBI CMS for regulated lenders, and Sachet for unregulated ones.
Sources & official links
This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.