Harassed by a loan app? How to check a lender first, and where to complain in India

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Check any lending app against RBI's directory before you borrow. If recovery agents are threatening you or your contacts, do not pay unknown UPI IDs. Keep the evidence and report on 1930, cybercrime.gov.in, Sachet and to the police.

01 / Before you borrow: check the app against RBI's list

Many lending apps claim a link to a bank or NBFC (non-banking financial company) that they do not have. Since 1 July 2025, RBI has run a public directory of Digital Lending Apps (DLAs) so you can check that claim, according to a Finance Ministry reply to the Rajya Sabha in July 2026. Open rbi.org.in and use the link labelled "DLA's deployed by Regulated Entities".

Under RBI's rules, a lender must report the following for each app it uses:

• The app's name and owner: the lender itself, or the lending service provider (LSP) running it.
• The app store it is on, and a direct link to it.
• The name, email and phone number of its grievance redressal officer.
• The lender's own website.

Match the exact app name, developer and store link. If the app is not listed, or the lender named inside it is not the one in the directory, do not borrow. RBI says the list is built from what lenders submit, without RBI's intervention. A listing shows a lender has reported the app; it does not make the loan good value.

02 / What a legitimate digital loan must give you

RBI's Digital Lending Directions of 8 May 2025 apply to banks, co-operative banks, NBFCs and all-India financial institutions. They require, among other things:

• A Key Fact Statement (KFS) that sets out the loan's cost, including the annual percentage rate (APR), which is the all-in yearly cost.
• Direct money flows. The loan goes into your own bank account and you repay straight into the lender's account, never through an app company's or third party's account. Fees owed to the app company are paid by the lender, not you.
• A cooling-off period of at least one day. During it you can exit the loan without penalty by repaying the principal and the proportionate APR.
• Limited phone access. Apps must not access your files and media, contact list or call logs. One-time camera, microphone or location access is allowed for KYC only, with your consent.
• Named recovery agents. If you default, you must be told by email or SMS who the recovery agent is before they contact you.

03 / Signs of an illegal loan app

• It asks for your contacts, photo gallery or SMS. A regulated lender's app is not allowed to read your contacts or files.
• You are offered a small amount, but much less than the approved amount reaches your account after "processing" deductions, or the fees are not explained in a KFS.
• You are told to repay within days rather than months, at a cost you cannot work out.
• No bank or NBFC is named, or the named lender's directory entry lists a different app.
• Repayment goes to a personal UPI ID or someone else's account rather than the lender's.

In December 2020, RBI warned about unauthorised apps charging excessive interest and hidden fees, using high-handed recovery methods and misusing borrowers' phone data, and told people never to share KYC documents with unverified apps.

04 / If recovery agents are harassing you

• Do not pay "settlement" money to unknown UPI IDs or accounts. Nothing guarantees that paying ends the demands.
• Keep the evidence first. Take screenshots of threats, call logs, the UPI IDs and phone numbers used, the app's store page, and your loan and payment records. Do not delete the chats.
• Revoke and remove. In your phone's settings, take away the app's permissions for contacts, photos and SMS, then uninstall it.
• Warn your contacts. Tell family and colleagues that anyone contacting them about a loan or sending edited images is running a scam, and ask them not to reply or pay.
• Threats or morphed images: go to your local police station or cyber cell and ask for an FIR, taking your screenshots with you.

05 / Where to complain

• 1930 and cybercrime.gov.in: the Home Ministry's helpline and National Cybercrime Reporting Portal accept reports about fake or illegal loan apps. Call 1930 straight away if money has been extorted from you. Our UPI fraud guide lists the details to have ready.
• Sachet (sachet.rbi.org.in): RBI's portal for online complaints about unauthorised entities. RBI has told the public to report unauthorised lending apps and the bank accounts linked to them there.
• Google Play: on the app's page, open the menu, choose "Flag as inappropriate", pick a reason and submit.
• Against a regulated lender: complain to the lender's grievance officer first. If it rejects your complaint, you are unhappy with the reply, or it does not answer within 30 days, complain on cms.rbi.org.in or call 14448. Under the Integrated Ombudsman Scheme, 2026, in force since 1 July 2026, you then have 90 days to file.

06 / What the government has done, and support for you

The Ministry of Electronics and Information Technology (MeitY) has blocked 87 illegal lending apps under Section 69A of the Information Technology Act, 2000, the Finance Ministry told the Rajya Sabha on 21 July 2026. It said the Indian Cyber Crime Coordination Centre (I4C) is analysing digital lending apps, and that sectoral regulators can now issue blocking directions under the IT Rules notified on 22 October 2025. Blocking an app does not by itself stop harassment that has already started.

If harassment is affecting your sleep, work or safety, call Tele-MANAS on 14416 (or 1-800-891-4416). It is the Health Ministry's free, 24x7 mental health helpline, available in 20 languages.

This guide is general information, not legal advice. For a specific dispute, speak to a lawyer.

07 / Your checklist

• Before borrowing, find the app in RBI's DLA directory and match the lender, developer and store link.
• Insist on a Key Fact Statement, and repay only into the lender's own account.
• Refuse any app that wants your contacts, gallery or SMS.
• Never pay extra under threat to an unknown UPI ID.
• Revoke permissions, uninstall the app and warn your contacts.
• Report on 1930 or cybercrime.gov.in, and file a police complaint for threats or morphed images.
• Report the app on Sachet and Google Play; escalate complaints about regulated lenders to cms.rbi.org.in.
• If you are struggling, call Tele-MANAS on 14416.