Loan-App Fraud: Your Complaint Options Explained Simply

You downloaded an app promising quick cash — maybe Rs 5,000 or Rs 10,000 in ten minutes with no paperwork. You got the money. Then the nightmare began. Recovery agents started calling your family members. Someone sent messages to your office colleagues saying you are a loan defaulter. A morphed photograph appeared in a WhatsApp group with a caption designed to destroy your reputation. Or maybe you paid a "processing fee" to get the loan and the app just disappeared.

This is loan-app fraud. It is happening to thousands of people across India. Many victims feel ashamed or paralysed — they think that because they borrowed money, or because they shared their phone access, they have no legal standing. That is completely wrong. Indian law gives you specific rights against every one of these tactics. This guide explains which laws apply, which complaints to file, and in what order.

What Is Loan-App Fraud?

Loan-app fraud covers several different kinds of illegal conduct, often combined. Understanding which type of fraud you are dealing with helps you pick the right legal response.

Upfront fee fraud. The app charges you a processing fee, registration fee, or insurance amount before disbursing the loan. After you pay, the loan never comes and the app becomes unreachable. This is straightforward cheating — the fee was extracted on a false promise.

Inflated balance fraud. The app disburses a small amount — say Rs 3,000 — but the app screen shows you owe Rs 15,000 "including interest and charges." The repayment demand far exceeds anything you agreed to and any rate that is legal.

Contact harassment. The loan app asks for access to your phone contacts as a condition for the loan. When you are late on a payment — or sometimes even if you are not — the app's recovery team starts calling or messaging every person in your contact list, telling them you are a defaulter, a fraud, or worse. This is used as a tool of public humiliation to force repayment.

Photo extortion. The app accesses your phone's camera or photo gallery. If the borrower does not pay, the recovery team sends morphed or private photographs to the borrower's contacts, or threatens to do so unless money is paid immediately. This is extortion.

Fake regulatory impersonation. Recovery callers claim to be from the RBI, the police, or a court and threaten arrest, court summons, or criminal charges unless you pay immediately. These threats are fabricated — the RBI does not call individual borrowers and no police action can happen based on a loan default alone.

Each of these tactics is a separate criminal offence under Indian law.

How the Threats and Tricks Work

Loan-app fraudsters rely on two things: your fear and your ignorance of the law. Once you understand how they operate, their power over you weakens significantly.

These apps typically target people who need money urgently and cannot access formal banking. They design their apps to feel legitimate — logos that look official, language that sounds regulatory, and promises of instant approval. During the loan application, they request extensive app permissions: contacts, camera, microphone, location, photos. Most users grant these permissions because they need the money.

Once the permissions are granted, the fraudsters have a weapon. They know that the borrower's family, colleagues, and acquaintances do not know the full picture. They exploit this. A message to your boss saying "your employee is a loan defaulter and criminal" can cost you your job. A morphed photograph shared in a WhatsApp group can destroy relationships. These are not recovery tactics — they are tools of deliberate psychological terror designed to extract money.

The key legal fact you need to know: none of this is legal under Indian law. Your obligation to repay a legitimate debt does not give any lender — legitimate or fraudulent — the right to harass you, contact your family, threaten you with arrest, or share your photographs. Every single one of those acts is either a criminal offence or a civil wrong that you can pursue in court.

What Laws Apply to Loan-App Fraud?

Indian law addresses loan-app fraud through a combination of the Information Technology Act, 2000 (IT Act) and the Indian Penal Code (IPC). No single provision covers everything — but multiple provisions working together give you strong legal tools.

IT Act Section 66C — Identity Theft

Whoever, fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to rupees one lakh.

When a loan app misuses your Aadhaar number, PAN, phone number, or other personal identifier — beyond what you consented to — it commits identity theft under Section 66C. This applies when apps use your details to impersonate you on other platforms, create fake credit applications in your name, or sell your data to third parties.

IT Act Section 66D — Cheating by Personation

Whoever, by means of any communication device or computer resource cheats by personating, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.

When recovery agents pretend to be police officers, RBI officials, or court messengers to threaten you — and do so using phones or digital messages — they commit cheating by personation under Section 66D of the IT Act. The entire performance of impersonating a government authority to extract money is a criminal offence.

IT Act Section 66 — Computer-Related Offences

Section 66 of the IT Act says that if any person dishonestly or fraudulently does any act referred to in Section 43 — which covers unauthorised access to computer systems, downloading data without permission, or charging amounts to another person's account by manipulating a computer system — they face imprisonment up to three years or a fine up to Rs 5 lakh or both. When a loan app accesses your contacts and photos without genuine free consent (consent obtained under economic compulsion is legally questionable), it potentially triggers Section 43 and thereby Section 66.

IPC Section 384 — Extortion

This is one of the most powerful provisions against loan-app harassment. Extortion under Section 384 of the IPC means putting a person in fear of injury — to that person, or to any person related to them — and thereby compelling them to deliver property. When a recovery agent threatens to share your morphed photograph, send defamatory messages to your employer, or contact your family members unless you pay, that is textbook extortion. Section 384 IPC carries imprisonment up to three years, and importantly, extortion is a non-bailable offence. This means if the police arrest the recovery agent, they cannot walk out on bail as a matter of right. This is a stronger deterrent than the IT Act provisions alone.

IPC Section 503 — Criminal Intimidation

Threatening to harm, defame, or cause injury to a person or their reputation to alarm them is criminal intimidation under Section 503 IPC. When a recovery caller threatens to "send photos to your family" or "get you arrested" to frighten you into paying, that is criminal intimidation. The offence under Section 506 IPC (punishment for criminal intimidation) carries imprisonment up to two years or a fine or both — and for threats of death or of causing grievous hurt, up to seven years.

IPC Section 420 — Cheating

When a loan app takes a processing fee and disappears, or shows a fraudulently inflated loan balance, or deceives you about the applicable interest rate, Section 420 IPC applies. Cheating that dishonestly induces the delivery of property carries imprisonment up to seven years and a fine. This is significantly more severe than most IT Act provisions.

When the App Accessed Your Photos or Contacts

The violation of privacy by loan apps is one of the most serious — and underreported — aspects of loan-app fraud. The IT Act has a specific provision for this.

Section 66E of the IT Act: Whoever intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person, shall be punished with imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with both.

The word "transmit" under Section 66E is defined to mean "to electronically send a visual image with the intent that it be viewed by a person or persons." When a loan-app recovery team sends morphed or private photographs of a borrower to their contacts — even if the image does not show private body parts but is shared without consent to humiliate the person — Section 66E potentially applies, especially when read with the broader right to privacy framework.

The Supreme Court of India, in the landmark judgment in the case of Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), unanimously held that the right to privacy is a fundamental right under Article 21 of the Constitution. Every Indian citizen has a constitutionally protected right to be free from invasions of their private information and personal data. Loan apps that weaponise private information violate this fundamental right — and this can form the basis of writ petitions in High Courts, beyond just criminal complaints.

Section 67 of the IT Act, which covers publishing or transmitting obscene material in the electronic form, is punishable on first conviction with imprisonment up to three years and a fine up to Rs 5 lakh. If the app shares explicit or morphed photographs designed to shame the borrower, Section 67 may also be attracted. If a loan app accesses your private information and uses it to threaten or publicly shame you, they may also have committed privacy violations that are independently actionable.

What About RBI Rules?

Not all loan-app fraud involves IT Act offences. Some involves violation of RBI regulations — and those violations give you a different set of complaint options.

The RBI's Master Directions on Digital Lending (2022) require that digital lenders be registered Non-Banking Finance Companies (NBFCs) or partner with registered NBFCs. A loan app that is not backed by a registered NBFC is operating illegally. The RBI has a Sachet portal (sachet.rbi.org.in) specifically for reporting unauthorised or illegal lending activities.

The RBI's regulations also require that lenders disclose the Annual Percentage Rate (APR) upfront before disbursing any loan, provide a Key Fact Statement (KFS) to the borrower before disbursing the loan, restrict loan recovery agents from calling borrowers before 8 AM or after 7 PM, and prohibit lenders from accessing borrowers' phone contacts, camera, or microphone except with specific, informed consent that can be revoked.

If the loan app is from a registered NBFC but is violating these conduct rules, you can file a complaint under the RBI's Integrated Ombudsman Scheme at bankingombudsman.rbi.org.in. The Ombudsman can direct the NBFC to compensate you and correct its conduct.

Which Complaint Should You File — and Where?

This is where most victims get confused. There are multiple complaint channels, and they serve different purposes. The right answer is: file in multiple places, because each channel does something different.

Cybercrime Portal (cybercrime.gov.in) or helpline 1930. This is your fastest option for freezing fraudulent accounts or stopping active harm. The 1930 helpline routes your complaint to a specialised cybercrime investigation unit. File here first if money has been taken fraudulently or if active harassment is happening. Filing a cybercrime complaint correctly is often the difference between getting quick relief and waiting months for a response.

Local police FIR. Go to your local police station and file an FIR. The FIR should mention IT Act Sections 66, 66C, 66D, and 66E as applicable, and IPC Sections 384, 503, 420, and 406 as applicable. Having an FIR copy is essential for every other step — the bank, credit bureau, and RBI will all ask for it.

RBI Sachet Portal (sachet.rbi.org.in). Use this specifically to report an unregistered or illegal loan app. The RBI can take regulatory action including shutting down the app and blacklisting it.

RBI Integrated Ombudsman (bankingombudsman.rbi.org.in). Use this if the loan app is from a registered NBFC but is violating RBI conduct rules — such as calling outside permitted hours or accessing your contacts.

IT Act Adjudicating Officer. Under Section 43 of the IT Act, you can file a claim for financial compensation before the Adjudicating Officer — for harm caused by the app's unauthorised access to your data. Compensation up to Rs 5 crore can be awarded. If not paid, it is recoverable as an arrear of land revenue under Section 64 of the IT Act. If you are not satisfied with the Adjudicating Officer's order, you can appeal to the Appellate Tribunal within 45 days under Section 57 of the IT Act; the Appellate Tribunal endeavours to resolve appeals within six months.

What Should I Actually Do Now?

1. Stop paying immediately — and document why. If the app is harassing you with threats, inflated demands, or contact spam, you are not dealing with a normal lending dispute. Do not make further payments under duress. Before stopping, write down the loan amount actually received, any amounts already paid, and the demands being made. This paper trail is evidence.
2. Screenshot everything before it disappears. Screenshot every threatening message, every SMS from the recovery team, every notification from the app. Screenshot the app itself showing the inflated balance. Download chat logs from WhatsApp if agents are contacting you there. Note all phone numbers that have called you. If photos were shared, screenshot those too — even if it is painful. Evidence disappears fast and is essential for every complaint you file.
3. Revoke all app permissions immediately. Go to your phone settings and revoke the loan app's access to contacts, camera, microphone, photos, and location. Uninstall the app after taking screenshots of it. This limits further data harvesting even if it does not undo the damage already done.
4. Call 1930 and file online at cybercrime.gov.in. Do this today if active harassment is happening. The cybercrime helpline can flag numbers and accounts used by the fraudsters.
5. File an FIR at your local police station. Cite IT Act Sections 66, 66C, 66D, 66E and IPC Sections 384, 503, 420 as applicable. If police refuse to register the FIR, send a written complaint to the Superintendent of Police by registered post. Keep a copy.
6. File on RBI Sachet if the app seems unregistered. Go to sachet.rbi.org.in and report the app. Check the RBI website to see if the app's parent company is a registered NBFC — this is public information.
7. Write to contacts who were harassed. If recovery agents contacted your family, colleagues, or friends, consider sending them a brief written message explaining what happened — that you were defrauded and the contacts were made illegally. This limits reputational damage and can also become evidence of the harm caused.
8. Consult a lawyer before talking to the police about debt. Loan-app fraud cases sometimes involve police who assume the borrower is the problem. A lawyer can ensure your complaint is structured correctly and that your own rights are protected in the process. If the fraudsters have already filed a false complaint against you, a lawyer can help you respond to that as well.

The Law Has Teeth — But Needs to Grow

The legal framework that exists today gives victims of loan-app fraud real tools. Extortion (IPC Section 384) is a non-bailable offence — meaning arrested fraudsters cannot walk out on bail by right. The combination of IT Act provisions and IPC cheating and extortion provisions can result in serious criminal prosecution. The RBI's 2022 guidelines, if enforced, should be eliminating illegal apps from app stores entirely.

That said, there are honest limitations. The IT Act provisions on identity theft (Section 66C) and cheating by personation (Section 66D) are bailable offences — the law needs to be strengthened here. The IT Act does not expressly address the territorial jurisdiction for cybercrime trials; courts have to fall back on CrPC Chapter XIII to determine this. And many police stations are still developing the expertise to investigate technology-enabled fraud effectively, which is why the national cybercrime portal is an important parallel filing channel.

The right to privacy guaranteed by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) means that as courts develop this jurisprudence further, victims of data misuse by loan apps may have even stronger remedies available. High Courts across India have granted urgent orders in loan-app harassment cases when approached with well-documented complaints.

At Pinaka Legal, we have supported clients navigating the exact situation you may be in right now — frantic messages from recovery agents, fear about what has been shared with family, uncertainty about what comes next. If you are in that situation, reach out to us. We can help you file the right complaints in the right order and get you the legal protection you deserve.

Frequently Asked Questions

Is it a crime for a loan app to message my family and colleagues about my loan?

Yes. Sending messages to third parties about a borrower's loan — especially with the intent to humiliate or coerce repayment — constitutes extortion under Section 384 of the IPC if combined with threats, and criminal intimidation under Section 503 IPC. The RBI also prohibits recovery agents from contacting family members or employers as a routine collection tactic. This conduct should be reported to the police (FIR), the cybercrime helpline (1930), and the RBI Sachet portal.

Can I file an FIR against a loan app even if I did actually borrow money?

Yes, absolutely. Your obligation to repay a legitimate debt does not give any lender — or their agents — the right to threaten you, contact your family, share your photographs, or impersonate police or RBI officials. The FIR is about their conduct, not your debt. These are separate legal matters. Many loan-app fraud FIRs involve borrowers who did receive the money but are being criminally harassed about repayment.

Loan app fraud complaint India — where do I file first?

File in three places simultaneously: First, call 1930 or file at cybercrime.gov.in — this is the fastest way to flag fraudulent numbers and accounts. Second, file an FIR at your local police station citing IT Act Sections 66, 66C, 66D, 66E and IPC Sections 384, 503, 420 as applicable. Third, file on the RBI Sachet portal (sachet.rbi.org.in) if the app seems to be operating without RBI registration. Get a copy of every complaint you file.

What if the loan app used morphed photographs to threaten me?

This is one of the most serious forms of loan-app harassment. Transmitting or threatening to transmit morphed photographs is extortion under IPC Section 384 — a non-bailable offence. It may also attract IT Act Section 66E (violation of privacy by transmitting images) and Section 67 (publishing obscene material in electronic form). File an FIR immediately, call 1930, and preserve every piece of evidence including screenshots of the threats. A lawyer can also help you get an urgent court order stopping further sharing.

The recovery agent is pretending to be from RBI or police. Is that illegal?

Yes. Pretending to be an RBI official or police officer — using a phone or messaging app — is cheating by personation under Section 66D of the IT Act, punishable with up to three years imprisonment. It may also amount to impersonation of a public servant under IPC Section 170. The RBI has repeatedly clarified that it does not call individual borrowers about loan defaults. Any such call is fraudulent. Report the number to 1930 and mention this specific conduct in your FIR.

I paid a processing fee to a loan app and the loan never came. Can I recover my money?

Yes, this is cheating under IPC Section 420. The collection of a processing fee on a false promise to disburse a loan is a criminal offence. File an FIR. Under Section 43 of the IT Act, you can also file a claim before the Adjudicating Officer for compensation for the harm caused by the fraudulent computer-enabled transaction. If the app used a legitimate payment gateway, the cybercrime portal may be able to help trace and freeze funds.

Can loan apps legally access my contacts and photos?

Only with specific, informed, revocable consent — and even then, only for the purpose disclosed. The RBI's 2022 Master Directions on Digital Lending prohibit lenders from accessing borrowers' phone contacts, camera, or microphone without specific consent. If you granted consent under economic compulsion (because you needed the money), or if consent was buried in terms no one reads, that consent may be legally questionable. Revoke all permissions in your phone settings immediately and report the app's conduct at the RBI Sachet portal.

Will the police help with loan app fraud or will they side with the lender?

It depends on the police station. Some cybercrime units are well-equipped and proactive. Others may treat it as a debt recovery dispute. Always file at cybercrime.gov.in or call 1930 in addition to the local police, as this routes your complaint to specialised units. If the local police refuse to register an FIR, send a written complaint by registered post to the Superintendent of Police, or approach a Judicial Magistrate directly under Section 200 of the Code of Criminal Procedure.

My loan app is charging 500% annual interest. Is that even legal?

No legitimate lending rate can be called legal in isolation — interest rates for NBFCs are governed by RBI guidelines. The RBI requires that the Annual Percentage Rate (APR) be disclosed upfront in the Key Fact Statement before disbursement. If the APR was not disclosed, or if the rate being charged is far above what was disclosed, that is a violation of RBI Master Directions. File a complaint at the RBI Integrated Ombudsman Scheme (bankingombudsman.rbi.org.in) if the lender is a registered NBFC, or at Sachet (sachet.rbi.org.in) if the lender is unregistered.

What is Section 66E and does it apply to my loan app situation?

Section 66E of the IT Act punishes whoever intentionally captures, publishes, or transmits the image of a private area of any person without their consent, under circumstances violating their privacy. It carries imprisonment up to three years or a fine of Rs 2 lakh or both. In the loan-app context, if the app accesses private photographs and shares them or threatens to share them to coerce payment, Section 66E potentially applies — particularly read alongside the Supreme Court's recognition of privacy as a fundamental right under Article 21. File an FIR specifically mentioning Section 66E along with IPC Section 384 (extortion).

Written by the Pinaka Legal Editorial Team. For queries, call +91 8595704798 or email info@pinakalegal.com.