Illegal Loan Apps: How They Trap You and How to Fight Back (RBI Rules Explained)

"Instant loan in 5 minutes. No documents. No CIBIL check." It sounds like help when you urgently need money for a hospital bill, school fees or rent. But behind many of these ads are illegal loan apps that are not connected to any bank or RBI-regulated company. Thousands of people have been trapped by them, and some have been harassed so badly that families were shamed in front of relatives and colleagues.

As a banker, I want to explain in simple words how these apps trap people, how you can check whether a loan app is genuine in two minutes, and what to do, step by step, if you are already being harassed.

What is an illegal (unauthorised) loan app?

In India, only banks and companies regulated by the Reserve Bank of India (RBI), such as registered NBFCs, can lend money as a business. A genuine loan app always works for one of these lenders, and the lender's name must be shown in the app.

An illegal loan app is one that lends money without any RBI-regulated lender behind it, or falsely claims to be linked to one. Many are run by organised gangs, sometimes from abroad, and they change names often. Their aim is not to lend; it is to extract as much money as possible using fear.

How people get trapped: the 7 stages

Almost every case follows the same pattern. Knowing it helps you stop early.

1. The lure. Ads on social media, YouTube, SMS and WhatsApp promise instant money with "no documents, no CIBIL, low interest". The app may look professional, with fake 5-star reviews.
2. The permissions grab. During sign-up, the app asks for access to your contacts, photos, gallery, SMS and location. Most people tap "Allow" without reading. This is the real trap.
3. The short-changed loan. You apply for ₹10,000 but receive only ₹6,000–7,000. The rest is cut as "processing fee", "GST" or "service charge".
4. The impossible deadline. Repayment of the full ₹10,000 (or more) is due in just 7 days. Annualised, that cost can run to several hundred percent a year.
5. The debt trap. When you cannot repay, the app or its agents suggest another app to "roll over" the loan. Soon you owe five or six apps.
6. The harassment. Abusive calls start, often early morning and late night. They message your contacts calling you a "fraud" or "thief", and threaten to send morphed (edited) obscene photos of you to your family.
7. The extortion. Even after you pay, the demands continue with new "late fees" and "penalties". Paying under threat usually leads to more threats, not freedom.

How to check if a loan app is RBI registered (2-minute check)

Since 1 July 2025, RBI publishes a directory of Digital Lending Apps (DLAs) on its website. It lists the apps used by RBI-regulated lenders (banks, NBFCs and others), so you can check an app's claimed link with a lender before you borrow.

1. Open the app's page in the Play Store / App Store and note the lender's name (the bank or NBFC that actually gives the loan). A genuine app must show it.
2. Go to rbi.org.in and open the Digital Lending Apps (DLAs) directory. Search for the app name and check that the lender matches.
3. To confirm the lender itself, search its name on RBI's Sachet portal or the list of NBFCs on RBI's website.
4. If the app or the lender is not listed, do not install it, and do not share any details.

Warning signs of a fake instant loan app

• No lender (bank / NBFC) name in the app, or a name you cannot find on RBI's list.
• Asks for access to your contacts, photos, gallery or call logs.
• "No documents, no CIBIL check, loan in 5 minutes."
• Very short tenure (7 to 15 days) and money cut upfront as "fees".
• No Key Fact Statement (KFS) showing the total cost before you accept.
• Asks you to repay into a personal UPI ID or someone else's bank account.
• Sends download links through SMS or WhatsApp instead of an official app store.

Got a loan offer by SMS or WhatsApp? Paste it into the free Scam Message Checker to see the warning signs.

What RBI rules say a genuine loan app must do

RBI's rules on digital lending (now in the Reserve Bank of India (Digital Lending) Directions, 2025) give borrowers clear protections. If a loan app breaks these, that is a red flag:

• Money goes directly between you and the lender. The loan must come straight into your bank account, and repayments must go directly to the regulated lender, not to an agent's or third party's account.
• Key Fact Statement (KFS) before you sign. You must get a KFS showing the loan amount, the all-inclusive annual cost (APR), all fees and the repayment schedule. No charge that is not in the KFS can be taken.
• Cooling-off period. You can exit the loan within the cooling-off period by repaying the principal and the proportionate cost, without any penalty.
• Limited data access. Data collection must be need-based and with your explicit consent. Apps should not access your files, photos, contact list or call logs; one-time access to camera, microphone or location is allowed only for things like KYC, with your consent.
• Fair recovery. Lenders and their recovery agents must not threaten, abuse or shame borrowers, or pressure you through people in your contact list. You must be told in advance who the recovery agent is.
• Grievance officer and RBI Ombudsman. Every genuine app must show the details of a grievance officer. If your complaint is not resolved within 30 days, you can complain free to the RBI Ombudsman.

Already being harassed? Do this, step by step

Step 1: Do not panic, and stop paying under threat

Fear is their only weapon. Paying extra "fees" under threat rarely stops the calls; it tells them you will pay again. If you borrowed from a genuine, RBI-regulated lender, repay only what is lawfully due as per your KFS and loan agreement, and ask for a receipt.

Step 2: Save every piece of evidence

• Screenshots of threatening messages, morphed photos and WhatsApp chats.
• Call recordings and a list of numbers that called you, with dates and times.
• The app name, its Play Store link and screenshots of the app.
• Your bank statement or UPI history showing money received and paid.

Step 3: Report the crime

• Call the national cyber crime helpline 1930, or file a complaint at cybercrime.gov.in (choose "Financial Fraud" or the relevant category, and attach your evidence).
• For threats, extortion or morphed photos, you can also go to your nearest police station or cyber cell and file an FIR. Threats, extortion and publishing obscene morphed images are crimes under the Bharatiya Nyaya Sanhita and the Information Technology Act.

Step 4: Complain to RBI

• Report the illegal app or lender on RBI's Sachet portal.
• If the app is linked to a genuine bank or NBFC, first complain to its grievance officer. If there is no reply in 30 days, complain free on cms.rbi.org.in or call 14448.

Step 5: Protect your phone and your contacts

• Go to Settings → Apps → [loan app] → Permissions and turn off contacts, photos, SMS and location. Then uninstall the app.
• Report the app in the Play Store ("Flag as inappropriate").
• Report fraud calls and messages on Sanchar Saathi (Chakshu).
• Send a short message to close family and friends before the fraudsters do: "A fake loan app is misusing my contacts. Please ignore any message about me and do not pay anyone."

Step 6: Take care of yourself

Being shamed in front of family is deeply distressing, and these gangs count on that. You have done nothing shameful by needing money. Talk to someone you trust. If you feel overwhelmed, call the free government mental health helpline Tele-MANAS: 14416 (24×7).

Safer ways to get money in an emergency

• Your own bank: ask about a personal loan, a loan against your FD (often at a low rate), or an overdraft.
• Gold loan from a bank or a regulated gold loan company.
• Salary advance from your employer, or a loan from your PF if eligible.
• Apps of your own bank or of lenders listed in RBI's directory.

Before any loan, check the EMI and total cost with the EMI calculator.

Frequently asked questions

Is it a crime if I do not repay an illegal loan app?

Not repaying a loan is generally a civil matter, not a crime, and no lender is allowed to threaten, abuse or shame you. If you borrowed from a genuine regulated lender, you should repay what is lawfully due. Illegal apps often demand far more than you borrowed; report them instead of paying under threat.

The app sent my morphed photo to my contacts. What should I do first?

Save screenshots, then report immediately on cybercrime.gov.in or call 1930, and file a complaint at your nearest police station or cyber cell. Tell your close contacts that it is fake. You can also report the content to the platform where it was posted so it can be taken down.

How do I know if a loan app is genuine?

Check that the app shows its lender's name, and that the app is listed in RBI's Digital Lending Apps directory on rbi.org.in. Genuine apps give you a Key Fact Statement before you accept and never ask for access to your contacts or photos.

Can a loan app call my family and friends?

They should not. Under RBI's rules, lenders and their recovery agents cannot harass or shame borrowers, and apps should not access your contact list in the first place. If an app is messaging your contacts, report it on cybercrime.gov.in or call 1930.

Where do I complain about a loan app?

Call 1930 or use cybercrime.gov.in for harassment and fraud. Use RBI's Sachet portal for illegal lenders. For apps of genuine banks or NBFCs, complain to the lender first, then to the RBI Ombudsman at cms.rbi.org.in.

Sources

• Government and RBI strengthen measures against fraudulent loan apps (Ministry of Finance, PIB, 17 March 2026): RBI's DLA directory from 1 July 2025, MeitY blocking under Section 69A of the IT Act, I4C, 1930 and Sachet.
• Reserve Bank of India: Reserve Bank of India (Digital Lending) Directions, 2025 and the Digital Lending Apps directory.
• RBI Sachet portal, National Cyber Crime Reporting Portal and RBI Complaint Management System.