Instant loan app harassing you or your contacts: what to do
Short answer
Do not pay the threats — report them. Under RBI’s Digital Lending Directions, 2025, a lending app must not access your contact list, photos and files or call logs, and the loan must come from a regulated lender straight into your bank account. Check the app on RBI’s list of digital lending apps; an app that is not there and is threatening you is the illegal kind the Government has been blocking. Keep the messages, call 1930, report on cybercrime.gov.in and complain on RBI’s Sachet portal.
Checked
· sources linked under each scam
The Scam Radar card below is Aegix’s live alert for this scam; its own source is a news report. The official sources — the Reserve Bank of India and the Ministry of Finance — are linked under the sections after it. If the threats make you feel unsafe, tell someone you trust and call 112 in an emergency.
Fake loan apps using real NBFC names, then harassment
An ad or message offers an instant loan with no security, easy approval and low interest, through an app that carries the name and logo of a real RBI-registered NBFC. Once installed it takes your contacts, photos and bank details, then the gang threatens you and messages your contacts to extort money.
⚙️ How it works
The app is the weapon: contacts and gallery access are all the gang needs to blackmail you. Kolkata Police warned on 6 November 2026 that many fake loan-app groups now copy the names, logos and details of real NBFCs registered with the RBI, so the app looks genuine. They push it through links in messages, social media and ads, especially in the festive season.
🚩 Red flags
A loan app asking for contacts, gallery or SMS access
A real NBFC's name or logo on an app you reached through an ad, an SMS or a social-media link
Loan tenure of 7-14 days with fees deducted upfront
Installed from a link or APK, not from Google Play
✅ What to do
Before installing, check the lender on the RBI's official list of registered NBFCs, and make sure the app is that lender's own app. A copied logo proves nothing.
Deny contacts, gallery and SMS permissions. A genuine lender does not need them.
If you are being harassed, do not pay extra. Keep the messages, call 1930 or report at cybercrime.gov.in, and complain on the RBI Sachet portal.
Use Aegix Scan to find apps that can read your SMS or contacts, and uninstall the ones you do not trust.
The Reserve Bank of India issued the Reserve Bank of India (Digital Lending) Directions, 2025 on 8 May 2025. They bind banks, NBFCs and other regulated lenders, the agents (lending service providers) they use, and their apps. Among other things, the app must not access your file and media, contact list, call logs or telephony functions; only one-time access to camera, microphone or location is allowed, for on-boarding or KYC, with your explicit consent. The loan is paid only into your own bank account and you repay the lender directly, not a third party’s account; the agent’s fees are paid by the lender, not collected from you. You get a Key Fact Statement before signing, and a cooling-off period of at least one day to exit by repaying the principal and the proportionate cost. If a recovery agent is assigned, the lender must send you the agent’s details by email or SMS before the agent contacts you.
🚩 Red flags
The app asks for your contacts, gallery, files or SMS access
Money arrives from a person’s account or a UPI ID, not from a named bank or NBFC
Repayment is demanded to a personal UPI ID or a different account each time
No Key Fact Statement, no lender name, no grievance officer in the app
Threats to message your contacts, or morphed photos, from numbers that keep changing
Where to complain, and what the Government is doing
The Ministry of Finance told the Rajya Sabha on 21 July 2026 that RBI’s directory of digital lending apps has been live since 1 July 2025 to help people verify an app’s claimed link to a regulated lender, and that the Ministry of Electronics and IT has blocked 87 illegal loan lending apps under section 69A of the IT Act. The Indian Cyber Crime Coordination Centre (I4C) is analysing digital lending apps. RBI says its list is based on what lenders submit, without further checks by RBI, so being on the list shows only that a regulated lender has declared the app as its own.
✅ What to do
Threats, extortion or morphed photos: call 1930 and file on cybercrime.gov.in, then tell your local police.
An unregistered entity lending or collecting money illegally: complain on RBI’s Sachet portal.
A loan from a regulated bank or NBFC: complain to its grievance officer first; if there is no reply in 30 days or you are not satisfied, use RBI’s Complaint Management System.
Warn the contacts the app may message, so they ignore it and do not pay.
Already paid, shared a code or your screen? Call your bank on the number printed on your card and block the card.
Then call 1930, India’s national cyber-fraud helpline, and report it on
cybercrime.gov.in the same day.
Questions people ask about this message
Can a loan app access my contacts and photos?
Not a regulated one. RBI’s Digital Lending Directions, 2025 say lending apps must desist from accessing file and media, contact list, call logs and telephony functions; only one-time access to camera, microphone or location for KYC is allowed, with your consent.
How do I know if a loan app is genuine?
Look it up on RBI’s list of digital lending apps (rbi.org.in, Citizen’s Corner). It lists the apps that RBI-regulated lenders have declared. An app with a lender’s name or logo but not on that lender’s list should not be trusted.
The loan app is messaging my contacts. What should I do?
Do not pay extra to make it stop. Save the messages and numbers, call 1930 and file a complaint on cybercrime.gov.in, tell your local police, and warn your contacts to ignore the messages. Then remove the app’s permissions and uninstall it.
Where do I complain about an illegal loan app?
Cyber harassment or extortion: 1930 and cybercrime.gov.in. An unregistered lender: RBI’s Sachet portal. A regulated bank or NBFC: its grievance officer, then RBI’s Complaint Management System if there is no reply within 30 days.
Can Aegix help with loan apps?
Aegix lists this scam in its Scam Radar, and Aegix Scan shows which installed apps can read your SMS or contacts so you can remove the ones you do not trust. Its Scam Checker reads any loan message or link you paste in; the free web scam checker works in your browser too.
Let the phone warn you next time
Aegix is an Android security app from CryoSim, free to install, no account. Its Scam Radar lists the scams spreading in India,
filtered to your state; Scam Checker reads any message or link you paste in; and scam-SMS warnings (Aegix Premium, first month
free for new users) flag a scam-looking SMS as it arrives. Aegix flags the message; it does not delete it.
