Skip to content
Stay safe

Jobs, loans and investments

Loan app harassment: what to do about threats and morphed photos

Under RBI rules, a regulated lender's app must not read your contacts, call logs or photos, and RBI publishes a list of apps run by the lenders it regulates. If an app is calling your contacts or threatening to share morphed photos of you, stop dealing with its agents, save the evidence, and report it at cybercrime.gov.in or to your local police. Tell close family and friends early that any picture they receive is fake.
A hand dropping a coin into a yellow piggy bank beside rupee notes, coins and a calculator
Photo: F1Digitals on Pixabay

Before you borrow from a loan app

Tap each one as you check it.

How illegal loan apps trap people

RBI has warned since 2020 about unauthorised lending apps that promise quick, easy loans, then charge very high interest and hidden fees, use harsh recovery methods and misuse the data on borrowers' phones.

In one Enforcement Directorate case from 2024, borrowers were charged 20 to 30% “processing fees”, given 7 to 15 days to repay, and the apps required access to their photos and contact lists. That access is what makes the threats possible.

In January 2024, the Indian Cyber Crime Coordination Centre said illegal lending apps were the second most common tool used by scammers, and that 595 such apps had been blocked. The IT ministry told Parliament in December 2025 that it had blocked 87 illegal lending apps under the IT Act.

What the threats look like

Example. Names and numbers are made up.
Under RBI rules, a regulated lender must tell you the details of any recovery agent before that agent contacts you.

Signs of an illegal loan app

  • Asks for your contacts, photos or call logs
  • Does not name the bank or NBFC lending the money
  • Sends the loan from, or takes repayment to, a personal UPI ID
  • Cuts a large fee before you receive the money
  • Threatens to message your contacts

What RBI requires of a regulated lender

  • No access to your contacts, call logs, files or media
  • Names the regulated lender up front
  • Loan paid and repaid through the lender's own bank account
  • A Key Fact Statement with the full cost before you sign
  • A cooling-off period to exit by repaying the principal and proportionate cost

To check an app, look for it on RBI's website under Citizen's Corner, in the list of digital lending apps deployed by regulated entities. RBI notes that the list is based on what lenders report and is not separately checked by RBI, so also confirm the app is listed on the bank's or NBFC's own website.

If you are being harassed now

  1. Do not give in to threats, and stop talking to the agents.
  2. Screenshot every message, call log, number and any morphed image, with dates.
  3. Message close family and friends that you are being targeted by a fake loan app and that any image they get is fake.
  4. Report the app and the numbers at cybercrime.gov.in, which has a separate option for crimes against women, or at your nearest police station.
  5. Report unregulated lending apps on RBI's Sachet portal.

If it already happened

  1. Save the evidence first, then uninstall the app and remove any permissions it still has in your phone's settings.
  2. Report the harassment at cybercrime.gov.in or to your local police, and keep the acknowledgement number.
  3. If the lender is a bank or NBFC regulated by RBI, complain to it in writing; if it does not reply within 30 days or you are unhappy with the reply, complain to the RBI Ombudsman at cms.rbi.org.in.
  4. If the threats include intimate or sexual images, read sextortion: what to do.
  5. If you shared your Aadhaar or PAN with the app, read is it safe to share Aadhaar.
  • Call 1930The national cyber fraud helpline. Call within hours if money left your account.
  • cybercrime.gov.inFile a complaint online and keep the acknowledgement number.
  • Chakshu on Sanchar SaathiReport a fraud call, SMS or WhatsApp number.

Questions

How do I know if a loan app is RBI approved?
RBI does not approve individual apps. It lists the apps that regulated banks and NBFCs report on its website under Citizen's Corner; check the app there and on the lender's own website.
Can a loan app legally access my contacts?
Not if the lender is regulated by RBI. RBI's digital lending rules say lenders' apps must not access your contact list, call logs, files or media.
Where do I complain about loan app harassment?
Report threats and morphed images at cybercrime.gov.in or to the police. Report an unregulated app on RBI's Sachet portal, and a regulated lender to the RBI Ombudsman if it does not resolve your complaint.
Should I tell my contacts?
Yes, if you can. A short message saying a fake loan app is targeting you and that any image they receive is fake takes the power out of the threat.

Realr does not check lenders or loan apps, but a verified Realr profile gives people one link that shows the real you, separate from anything a stranger sends about you.

See how it works

Sources

Checked against the sources above on 17 October 2026. By Manav Sharma, Marketing Team, Realr. This is general guidance, not legal advice.

Ask them to prove who they are, before you pay or meet.

Try Realr, free