If a loan app is harassing you or your contacts, don't pay money demanded under threat. Screenshot everything, revoke the app's contacts and storage permissions, and uninstall it. Report it at cybercrime.gov.in or call 1930. If the app works for an RBI-regulated lender, complain to its grievance officer, then the RBI Ombudsman at cms.rbi.org.in.
RBI's rules are on your side. Apps lending for regulated banks and NBFCs must not read your contact list, call logs or media, and lenders and their agents must not harass your family, friends or referees.
You are not alone, and this is not your shame. If you feel overwhelmed, the government's free Tele-MANAS helpline, 14416, is open 24x7.
Loan app harassment usually follows a pattern: a quick loan, a repayment demand far bigger than you agreed to, then calls to everyone in your phone, and sometimes threats to send edited, obscene photos of you. It is frightening, and it is designed to be. This guide sets out what to do, in order, and every rule it quotes comes from the RBI's own directions, the government's press releases or the official portals. It is general information, not legal advice.
First, what the lender is and isn't allowed to do
In November 2025 the RBI reorganised its digital lending rules into lender-specific directions. For NBFCs they sit in the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025 and the Responsible Business Conduct Directions, 2025. The same digital lending text appears in the credit facilities directions for co-operative banks and all-India financial institutions. Among other things:
- No reading your phone. The lender must ensure its app and its service provider's app desist from accessing file and media, contact list, call logs and telephony functions. A one-time access to camera, microphone or location is allowed only for onboarding or KYC, with your explicit consent.
- No harassing the people around you. An NBFC and its agents must not use intimidation or harassment, including acts meant to humiliate publicly or intrude upon the privacy of your family, referees and friends, inappropriate messages on mobile or social media, threatening or anonymous calls, or calling you before 8 a.m. or after 7 p.m. to recover a loan.
- You're told who the recovery agent is. Before an agent contacts you, the lender must send you the agent's details by email or SMS.
- A named grievance officer. The lender and its service provider must designate nodal grievance redressal officers, and show their contact details on their websites, in the app and in your Key Fact Statement.
- Consent you can take back. You must be able to revoke consent already given and, if required, make the lender or its service provider delete / forget the data.
Google Play's policy separately bars personal loan apps from reading contacts and photos, and in India only apps on the RBI's list of digital lending apps may submit personal loan apps for review. An app that still grabbed your contacts is either breaking these rules or was never a regulated lender's app at all.
What to do, step by step
Save the evidence before anything disappears
Screenshot every threatening message, including the sender's number or profile and the time. Save call logs, voice notes, the app's name and developer as shown in the app store, the loan amount you actually received, every payment you made, and any UPI ID or bank account they tell you to pay into. Messages get deleted and apps vanish from stores. Your screenshots are what a police or bank complaint rests on.
Don't pay money demanded under threat
If someone threatens to send morphed photos or defame you unless you pay, treat it as extortion, not a repayment. Don't argue, bargain or send new documents. Keep the demand as evidence and report it. If you do owe a genuine loan to a regulated lender, deal with that lender in writing, through its official channels.
Cut the app's access to your phone
Open your phone's settings, find the app and switch off its contacts, storage or photos, SMS, phone and location permissions. Then uninstall it. Revoking permissions stops further collection, but it can't pull back what the app already copied, so keep going with the steps below.
Send your contacts one calm message
You don't have to explain your finances. Something short works: "If anyone messages you about me or asks for money in my name, please don't reply, pay or open links. Screenshot it and send it to me." It takes the power out of the threat, and your contacts become a source of evidence instead of an audience.
Report it to the cyber crime portal or 1930
The Ministry of Home Affairs runs the National Cyber Crime Reporting Portal (cybercrime.gov.in) and the National Cybercrime Helpline 1930. The government names both as the place to report cyber incidents, including fake and illegal loan apps. The portal has separate routes for financial fraud and other cyber crime, a Women/Children Related Crime section with an option to register anonymously, and a Report Suspect option for numbers and apps. Keep your acknowledgement number. You can also go to your local police station with the same evidence.
Report the posts and accounts to the platform
If photos or messages are posted on WhatsApp, Instagram, Facebook or anywhere else, report the account and the content using the platform's own report option. The cyber crime portal also has a Report Abuse to Social Media link. Report first, block after, so the evidence isn't lost.
Is the app linked to a real, regulated lender?
This decides which complaint routes are open to you.
- Check RBI's directory. Since 1 July 2025 the RBI has published a directory of digital lending apps, linked from its homepage as DLA's deployed by Regulated Entities. The government says it aims to aid the customers in verifying the claim of a DLA's association with a RE (a regulated entity). Search it for the app's name and the lender named in your loan documents.
- Read the listing carefully. RBI's directions say lenders' submissions are published automatically and the Reserve Bank shall not verify / validate them, and that a listing must not be presented as RBI registration, authorisation or endorsement. A listing tells you which lender claims the app. It isn't a guarantee.
- Look at the lender's website. A regulated lender has to publish the apps and service providers it works with, its grievance mechanism, and links to RBI's complaint portal and the Sachet portal. If the app names no bank or NBFC, or the lender's site doesn't list the app, treat it as unregulated.
Where to complain, and in what order
Threats, extortion, morphed photos: police and cyber crime
These are criminal matters whoever the lender is. Use cybercrime.gov.in or 1930, or your local police station.
A regulated lender: its grievance officer in writing
Write to the nodal grievance redressal officer named in the app, on the lender's website or in your Key Fact Statement. Describe the harassment, attach your screenshots, and ask the lender to stop contacting your contacts, to confirm what data its app took, and to delete what it has no need to keep. Keep a copy with the date.
No reply in 30 days: the RBI Ombudsman
If the lender rejects your complaint, you're unhappy with the reply, or you hear nothing within 30 days, RBI's directions let you complain on the Complaint Management System at cms.rbi.org.in, or by post to the Centralised Receipt and Processing Centre, Reserve Bank of India, Sector 17, Chandigarh. The RBI contact centre on 14448 can help with the process.
An unregulated app: Sachet as well
In its public cautions about unauthorised lending apps, the RBI has asked people to report such apps, and the bank accounts linked to them, to law enforcement or through the Sachet portal (sachet.rbi.org.in). The government says MeitY has blocked 87 illegal loan apps so far under section 69A of the IT Act, so reports do reach the people who can act.
If you feel overwhelmed, talk to someone today. Loan app threats are built to make you feel trapped. They are a crime, and they are reported every day. Tele-MANAS, the Ministry of Health's national mental health helpline, is free, 24x7 and available in many languages on 14416 or 1-800-891-4416. If you're in immediate danger, call 112.
After it stops: your data
A loan app may have copied your contacts, photos, KYC documents and selfie. Once the immediate danger is dealt with, ask for that data to go.
- Regulated lenders, today. RBI's directions already require an option to revoke consent and make the lender or its service provider delete the data. Put it in your written complaint. The lender may still keep records the law requires, such as loan and KYC records, so ask what it keeps and why.
- Under the DPDP Act. Section 12 of the DPDP Act 2023 gives you a right to erasure. The DPDP Rules 2025 bring the Act in over eighteen months, and that right becomes enforceable in May 2027. Until then a DPDP request is a dated request on the record, not a legal deadline. Our free DPDP notice generator drafts one that you send from your own email.
- If your credit report is wrong. A loan you never took, or a repaid app loan still showing unpaid, is fixed through the credit bureaus. See how to fix an error in your credit report.
Where Saaph fits, and where it doesn't. Saaph can't stop a loan app, file a police complaint or deal with a lender for you. It's a communication facilitator, not your lawyer or representative. If you're going to court or a consumer commission, or you're being threatened with legal action, consult a lawyer. What Saaph can show you is how exposed your number and email already are, since leaked contact details are often how these apps and scammers find people.
Find out where your number and email are already exposed
Saaph checks your email and phone number against known data breaches and online accounts, and keeps a registry of published privacy contacts for 280+ Indian companies, so you know who holds your details and where to write.
The check, the exposure report and self-serve DPDP emails are free, and you send those yourself. Pro (₹99 for 3 months or ₹390 for 1 year) is for when you'd rather Saaph send erasure requests for you. Family covers 4 profiles at ₹199 for 3 months or ₹790 for 1 year.
Run a free check →FAQ
What should I do if a loan app is harassing me?
Screenshot every message, call log and payment, then revoke the app's permissions and uninstall it. Report it at cybercrime.gov.in or on the 1930 helpline. If the app works for an RBI-regulated bank or NBFC, complain in writing to that lender's grievance officer, and to the RBI Ombudsman at cms.rbi.org.in if there is no reply within 30 days.
Loan app wale contacts ko call kar rahe hain, kya kare?
Sabse pehle har message aur call ka screenshot lijiye. App ki contacts aur storage permission band karke use uninstall kijiye. Apne contacts ko ek chhota sa message bhejiye ki koi aapke naam se paise maange to na de aur link na kholein. Phir cybercrime.gov.in par ya 1930 par complaint kijiye.
Can a loan app legally access my contacts and photos?
Not an app lending for an RBI-regulated lender. RBI's directions require such apps to desist from accessing file and media, contact list, call logs and telephony functions, and allow only one-time access to camera, microphone or location for onboarding or KYC, with your explicit consent. Google Play's policy also bars personal loan apps from reading contacts and photos.
A loan app is threatening to send morphed photos of me. What do I do?
Do not pay money demanded under threat, and do not argue with the sender. Save the messages, numbers and any UPI ID or bank account they ask you to pay into. Report it at cybercrime.gov.in, which has an anonymous option for crimes against women and children, or call 1930. If the images are posted, report the account and the post to the platform too.
How do I check if a loan app is RBI approved?
Open the list called DLA's deployed by Regulated Entities, linked from the RBI homepage, and search for the app and the lender named in it. RBI says it publishes lenders' own submissions without verifying them, and a listing is not an RBI registration or endorsement, so also check the lender's website and its grievance officer details.
Where do I complain about a loan app in India?
Report threats, extortion and fake apps at cybercrime.gov.in or on 1930, and at your local police station. For an app linked to a regulated bank or NBFC, write to the lender's nodal grievance redressal officer first, then to the RBI Ombudsman at cms.rbi.org.in if you get no reply in 30 days. RBI has also pointed people to its Sachet portal, sachet.rbi.org.in, to report unauthorised apps.
Do I still have to repay the loan if the app harassed me?
Harassment by a lender or its agent is a separate wrong and does not by itself cancel a genuine loan from a regulated lender. Complain about the conduct, and ask the lender in writing for the exact amount due. If the app is not linked to any regulated lender, or the amounts demanded look extortionate, speak to a lawyer before you pay.
Can I make a loan app delete my data?
If the lender is RBI-regulated, yes, you can ask now. RBI's directions say borrowers must be able to revoke consent and, if required, make the lender or its service provider delete the data, subject to what it must keep by law. Section 12 of the DPDP Act 2023 adds a general right to erasure, but that becomes enforceable only in May 2027.
General information, last reviewed 17 September 2026. It is not legal or financial advice. RBI directions, portal names and helplines can change, so check the official pages linked above before you rely on them, and consult a lawyer about court action or your own case. Saaph.in is not affiliated with the Reserve Bank of India, the Ministry of Home Affairs, the Ministry of Health and Family Welfare or any lender, and does not handle loan complaints. Saaph is a communication facilitator, not your legal representative or agent. Saaph.in is operated by Ronin Works Private Limited, Hyderabad, Telangana. Grievance contact: data@saaph.in.