You are checking your credit score for a home loan, or a recovery agent calls and asks why the EMI bounced, and that is how you discover it. There is a personal loan in your name that you never applied for. Or a credit card you never received. Or a "pre-approved" digital loan from an app you have not even downloaded. The amount is sometimes small, sometimes terrifying. Either way, the moment your CIBIL drops because of someone else's crime, the unfairness can feel like a punch in the stomach.
Take a breath. The Indian legal system is, in this one corner, surprisingly clear: you are not the borrower in a contract you never agreed to, and the bank cannot quietly transfer the consequences of its own bad KYC onto your shoulders. The trick is to act in writing, on time, and on the right doors. This article walks you through how.
What This Article Will Answer
- How does a fraudster manage to take a loan in someone else's name in the first place?
- What is the legal basis for saying "this loan is not mine"?
- Which sections of the IPC and IT Act will protect you and punish the impostor?
- What is the bank legally required to do once you raise a fraud dispute?
- How exactly do you get the bad entry off your CIBIL and stop the recovery calls?
How a Stranger Takes a Loan in Your Name
The mechanics matter, because the way the fraud was done decides which sections fit best.
The most common route is a document-based fraud. The fraudster gets hold of a copy of your Aadhaar, PAN and a passport-size photograph — leaked from a property dealer, a hostel manager, an old job application, or a hacked database. The photograph is replaced with the impostor's. The signature is approximated. A walk-in branch or a bank's "doorstep KYC" agent processes the file. The disbursal goes to a bank account opened on the same forged identity, and the EMI clock starts ticking on you.
The second route is a digital onboarding fraud. Your Aadhaar number, PAN and phone are fed into an app. An OTP is intercepted (sometimes through a SIM swap, sometimes through a malicious "PDF reader" you were tricked into installing). A digital signature is generated. The loan is sanctioned end to end without anyone meeting you.
The third route is the "trusted insider". A relative, a tax consultant, or someone at a small finance branch uses photocopies you handed them for an unrelated reason — a property registration, a school admission — to take a loan on the side. These cases hurt the most, but legally they are still cheating and personation, with the added wrinkle of breach of trust under Section 405/406 IPC.
In every case, the common thread is the same: somebody pretended to be you, and obtained money on the strength of that pretence. That single sentence is the key to everything that follows.
Why You Are Not Legally Liable
The instinct of the panicked victim is to pay one or two EMIs to "stop the damage". Do not. Doing so undercuts your most important defence: you never gave consent.
A loan is a contract. Under Indian contract law, a contract requires the free consent of the parties to it. The Indian Contract Act commentary explains that consent obtained by coercion, undue influence, fraud, misrepresentation or mistake is not free consent, and the resulting contract is voidable at the option of the wronged party. Where the supposed party never consented at all — because someone else impersonated them — there is something even simpler: there is no contract, full stop. There was never any meeting of minds between you and the bank.
This is why the loan officer's threats of "recovery action" are largely empty. The bank cannot recover from you what you never agreed to repay. The bank's contract is, in legal reality, with the impostor. The bank's mistake was in believing the impostor was you. RBI's customer protection circulars and the Banking Ombudsman framework all reflect this same principle: KYC is the bank's responsibility, and a customer is not made to pay for the bank's failure to verify.
What you need to do, in plain terms, is convert this legal reality into paper. The bank will not unilaterally decide it was wrong. You have to tell it so, in writing, and force the issue.
The Sections That Catch the Real Fraudster
Even though your fight feels like it is with the bank, the criminal law is mostly aimed at the impostor. The FIR you file becomes the spine of every other complaint.
Section 419 IPC punishes "cheating by personation". When the impostor pretends to be you to obtain the loan, this is the most exact section. Section 420 IPC covers the broader cheating — the dishonest inducement that causes the bank to part with the loan amount.
Where forged signatures and forged documents are used, the forgery chapter takes over. Section 463 defines forgery. Section 464 deals with the making of a false document. Section 467 punishes forgery of a "valuable security" — and a loan agreement, with its repayment obligation, very much qualifies as a valuable security. The IPC commentary on Section 471 and 467 makes the point bluntly: where documents are forged and fabricated to be "used as genuine to make fraudulent and illegal claims", the offence is made out and a criminal case can stand even where a civil suit has also been filed.
Section 471 IPC punishes the use of a forged document as if it were genuine. The impostor who walks into the bank with a forged Aadhaar and a forged signature, the agent who knowingly processes the file, and the recovery person who later tries to use the forged agreement against you — they all fall within Section 471's net.
The IT Act adds a second layer for digital fraud. Section 66C punishes identity theft — fraudulent use of someone's electronic signature, password or other unique identification feature. Aadhaar number, PAN, OTP, biometric, eSign — all of these are unique identifiers under 66C. Section 66D punishes cheating by personation using a computer resource, which catches the entire digital onboarding fraud end to end.
One technical note worth carrying with you: the Supreme Court in Annamalai v State of Karnataka, (2010) 8 SCC 524 emphasised that the two main ingredients of cheating are dishonest and fraudulent intention. In your case, the impostor's intention from the very first KYC document is to deceive the bank into parting with money in your name. That makes the case unambiguously criminal, not "civil in nature" as some police stations like to claim to avoid registering FIRs.
What the Bank Is Required to Do
Once you put the bank on written notice that the loan is fraudulent, several duties click in.
First, the bank must investigate. The RBI's Master Directions on KYC require banks to be able to identify the actual customer at the time of onboarding. If the bank cannot produce the original KYC, the wet-ink signed loan application, the photograph that matches you, and the disbursal account that belongs to you, its case collapses. You are entitled to demand copies of all of these documents. Refusal can be escalated to the Banking Ombudsman.
Second, the bank cannot continue collection action against you while it investigates a credible fraud complaint. Continued recovery calls, especially abusive ones, violate RBI's Fair Practices Code and can independently attract Sections 503 (criminal intimidation) and 504 (intentional insult) of the IPC.
Third, if the bank confirms the fraud, it has to (a) close the account as fraud, (b) report it as such to the credit bureau so the entry is removed from your CIBIL report, and (c) pursue the actual fraudster. None of these steps are optional.
Fourth, if the bank refuses or drags its feet, the RBI Banking Ombudsman is your forum. Filing on the RBI CMS portal is free, and the Ombudsman has the power to order both correction of the record and compensation for harassment. The Ombudsman's decision binds the bank. For a deeper read on banking disputes generally, our cluster on cheating and fraud covers related scenarios in detail.
Cleaning Up Your CIBIL Record
The credit-bureau side of this fight is often the most urgent for victims. A "settled", "default" or "written off" entry can block your home loan, your business loan, even a credit card, for years.
All four credit bureaus — TransUnion CIBIL, Experian, Equifax and CRIF High Mark — have online dispute portals. Raise a dispute on each one where the entry appears. Mark it as "fraud / not my account". Upload the FIR copy and the bank's acknowledgement of your fraud complaint. The bureau is required, under the Credit Information Companies (Regulation) Act 2005 and RBI rules, to investigate within thirty days.
If the lender confirms the fraud, the entry is deleted, not just marked "settled". This matters: a "settled" entry still drags your score, while a deleted fraud entry is treated as if it never existed.
If the lender does not respond or contests the dispute despite your FIR, you have two parallel forums. The first is the RBI Ombudsman, as discussed. The second is a writ petition or a civil suit for declaration that the loan is not yours, often filed alongside a prayer for direction to the bureau to delete the entry. Courts are increasingly comfortable granting such relief, especially when an FIR and a clean handwriting expert opinion are on record.
Speaking of which — under Section 45 of the Indian Evidence Act (now Section 39 of the Bharatiya Sakshya Adhiniyam), the opinion of a handwriting expert on a disputed signature is relevant. The Evidence Act commentary records that the handwriting of an unattested document must be proved, and one of the recognised modes is "by an expert". In a loan-in-my-name case, getting a handwriting expert report — sometimes through the Government Examiner of Questioned Documents, sometimes through a private FSL-empanelled expert — that the signature on the loan application does not match yours is among the most powerful pieces of evidence you can produce. It is hard for the bank or the bureau to argue with.
What Should I Actually Do Now?
- Pull your latest CIBIL, Experian, Equifax and CRIF reports today. Note the lender, account number, sanction date and current status of every entry that is not yours.
- Send a written fraud complaint to the bank or NBFC. By email and registered post. State clearly: I never applied for this loan, my KYC was misused, please mark the account as fraud, freeze recovery action and share copies of the application papers.
- File an FIR. Sections 419 (personation), 420 (cheating), 467 and 471 (forgery and use of forged document), Section 66C and 66D of the IT Act if there was a digital element. Use Zero FIR at any nearby police station if your local station refuses or you do not know where the impostor is.
- Open online disputes with all four credit bureaus. Attach the FIR. Mark the entry as fraud, not as a payment dispute. Track the thirty-day clock.
- If the bank stalls, file a complaint on the RBI CMS portal. Choose "Banking Ombudsman" and the closest grievance head. The Ombudsman process is free and the order is binding on the bank.
- Get a handwriting expert opinion if a forged signature is involved. Either through court-driven examination of questioned documents under Section 45 Evidence Act, or through a private examiner if you need it for the bureau dispute.
- Document every recovery call and visit. Date, time, name, what was said. These add up into a separate complaint of harassment under the IPC and RBI Fair Practices Code, and strengthen your credibility everywhere.
If the bank is large, the loan is large, or the recovery harassment has crossed into your home or workplace, this is where having a lawyer in your corner stops being optional. Pinaka Legal, based in Delhi, has helped clients clean up loan-fraud entries across both private and public sector banks — drafting bank notices, filing the FIR, running the bureau dispute, and where needed, taking the matter to the Ombudsman or the writ side of the High Court. The first conversation is free and confidential, and we will tell you frankly which of these tracks your case actually needs.
Frequently Asked Questions
A loan I never applied for is showing on my CIBIL. Am I liable to pay it?
No. If the loan was sanctioned on stolen or forged KYC, you are not the borrower in the eyes of law. The contract is void as far as you are concerned because there was never any consent from your side. The bank's recovery has to be against the actual fraudster. Your job is to formally dispute the entry, not to pay it off in panic.
Which sections of law actually apply to this kind of fraud?
The main IPC sections are 419 (cheating by personation), 420 (cheating), 467 (forgery of valuable security like a loan agreement), and 471 (using a forged document as genuine). Section 66C of the IT Act covers identity theft when Aadhaar, PAN or OTP was misused electronically. Section 66D applies if the impersonation was through phone, email or app.
The bank says I have to pay first and "sort it out later". Is that legal?
No. RBI's customer protection framework places the burden on the bank to prove that you authorised the loan. You should never deposit money to "pause" a loan you did not take. Pay nothing, but write to the bank in detail, give them the police FIR copy, and insist that the account be marked as fraud and frozen pending investigation.
How do I get the entry removed from my CIBIL or other credit bureau report?
Use the credit bureau's online dispute portal, attach the FIR and the bank's acknowledgement of the fraud complaint. The bureau is required to investigate and respond within thirty days. If the bank confirms the fraud, the entry must be deleted. If the bank fights, you can escalate to the RBI Banking Ombudsman, whose order is binding on the bank.
My Aadhaar and PAN are with several places. How will I prove it was misused?
You do not have to prove how it was leaked. You only have to prove that you were not the person who applied for or received the loan. The bank's own records — application IP address, mobile number, photograph, signature, where the money was disbursed — will usually show inconsistencies with your real details. The handwriting expert opinion under Section 45 of the Evidence Act seals the case if a forged signature is involved.
Can recovery agents harass me for an EMI on a loan I never took?
No. RBI's Fair Practices Code prohibits harassment and aggressive recovery. Once you have written to the bank that the loan is fraudulent, any continued recovery calls and visits are themselves complaint-worthy. Record the calls, keep visit dates and names, and add this to your bank complaint and the police FIR. Threats and abuse can attract Sections 503 and 504 IPC separately.
Should I take a loan from someone else to clear this loan and protect my CIBIL?
No. That is exactly what panicked victims do and exactly what the law does not require. Paying a fraudulent loan converts your strong defence into a weak refund claim. Hold your ground, write the dispute, file the FIR, and let the system correct itself. CIBIL hits caused by fraud get reversed once the bank confirms fraud, and your score recovers.
What if the loan is from a fly-by-night app, not a regulated bank?
Unregulated loan apps that disburse money to the wrong person and then harass the real account holder are a separate problem. The same IPC and IT Act sections apply, plus Section 67 IT Act if obscene messages were sent. Report the app on the cybercrime portal, complain to RBI's "Sachet" portal for unauthorised lenders, and ask Google Play and Apple to take down the app.
I gave my photo and Aadhaar to a friend who promised a "top-up loan". Now it is in my name. What now?
This is harder but not hopeless. The friend cheated you by inducing you to part with KYC under a false promise. File an FIR for cheating under Section 420 and personation under Section 419. The bank may still pursue you because you handed over the documents, but a clear FIR, paper trail and willingness to prosecute the friend strengthens your defence in any civil suit by the bank.
How long does it usually take to clear my name?
It depends on the bank and the bureau. With prompt complaints (FIR within a week, written dispute the same day, bureau dispute within thirty days), straightforward fraud cases get resolved in two to four months. Bureau correction is usually the fastest. Full criminal trial against the fraudster takes much longer, but you do not need to wait for the trial to clear your credit record.
For more articles on Indian law written for ordinary people, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.