Illegal loan app recovery agents work by shame, not by law. They threaten to message your contacts, they morph your photograph into obscene images, and they call your employer. Almost none of it is legal, and knowing that changes what you do next.
This is a guide to what these operators can and cannot do, and where to report them.
What Is Actually Illegal Here
A lender may pursue a debt. What they may not do is much longer than most borrowers realise.
Contacting your phone contacts about your loan is not a recovery method, it is harassment and a privacy violation. Your friends and colleagues are not parties to your loan.
Threatening or abusive calls, calls at unreasonable hours, and repeated calls designed to intimidate are prohibited under RBI’s guidelines on recovery agent conduct.
Morphed images and defamatory messages are criminal offences, not aggressive collection.
Accessing your contacts and gallery is the mechanism behind all of it, and an app that demanded that access at install did so to enable this.
Reframing this matters: you may owe money and still be the victim of a crime. Those are separate questions and the second does not wait for the first.
How to Tell a Legal Lender From an Illegal One
A legitimate digital lender is an RBI-regulated NBFC or bank, or an app partnered with one, and it will say so clearly.
Check for these:
- A named RBI-registered NBFC or bank as the actual lender, stated in the app and in your loan agreement
- A written loan agreement with the full interest rate, tenure, fees and total repayment
- A registered office address and working grievance contact
- No demand for contacts, gallery or SMS access — no legitimate lender needs your address book
Warning signs of an illegal operator: money disbursed within minutes with no documentation, a processing fee deducted upfront leaving you less than you borrowed, a tenure of seven to fifteen days, and effective interest that works out to several hundred percent annualised.
You can verify whether an entity is a registered NBFC on the RBI website. If the app cannot name its lender, that is the answer.
What to Do While It Is Happening
- Stop paying the harassment, not the loan. Paying more to make calls stop does not make them stop; it confirms the method works. If the principal is genuinely owed to a legitimate lender, deal with that through the lender directly.
- Revoke the app’s permissions immediately — contacts, storage, SMS, phone — and then uninstall it. Removing access limits what they can do next.
- Record everything. Screenshot every message, log call times and numbers, save voicemails. This is your case.
- Tell your contacts first. This takes away the weapon. A short message explaining that a recovery operation may contact them with false claims removes almost all of the leverage, and people are generally far more understanding than borrowers expect.
- Do not engage with abuse. Do not argue, do not threaten back. Record and report.
Where to Report
cybercrime.gov.in for morphed images, defamation and threats — this is criminal, and the steps are in our guide to filing a cyber crime complaint online.
Your local police station for threats and extortion, with printouts.
RBI’s complaint portal if the lender is a regulated entity behaving improperly, after raising it with the lender’s own grievance officer first.
Sachet, RBI’s portal for reporting unregistered entities taking deposits or lending unlawfully.
Chakshu on Sanchar Saathi for the calls and messages themselves, so the numbers get blocked — see our Sanchar Saathi guide.
Google Play — report the app. Enforcement against these has been repeatedly tightened, and reports contribute.
Preventing the Next One
The permissions request at install is the single point where this is stoppable. An app asking for your contacts to give you a loan is telling you exactly what its business model is.
Review what your existing apps already hold using our Android privacy checkup, and revoke contact and storage access from anything financial that has it.
Be wary of loan offers arriving by SMS or WhatsApp — that is not how regulated lenders acquire customers. And check any app or site before engaging using the approach in our guide to checking whether a site is safe.
One Thing Worth Saying Plainly
This kind of harassment is deliberately engineered to make people feel isolated and ashamed, and it can be genuinely frightening — particularly the threat to contact family and colleagues. The pressure is manufactured, and it is applied precisely because it works on people who face it alone.
Tell someone. A family member, a friend, a colleague. The shame is the mechanism, and speaking to one person removes most of its force. If it is affecting you badly, that is worth taking as seriously as the financial side — support is available, and reaching out to someone you trust is a reasonable first step.
We cover Indian digital rights and safety at Techleez. This is general information about published rules and reporting routes, not legal advice.
Frequently Asked Questions
Can loan app agents legally call my contacts?
No. Contacting people in your address book about your loan is harassment and a privacy violation, not a lawful recovery method.
How do I know if a loan app is legal?
It must name an RBI-registered NBFC or bank as the lender, provide a written agreement with full terms, and it will not ask for contacts or gallery access.
Should I pay to make the harassment stop?
Paying to stop harassment confirms the method works. Deal with any genuine debt through the lender directly, and report the harassment separately.
Where do I report morphed images?
cybercrime.gov.in, and your local police station. Creating and circulating such images is a criminal offence.
Should I tell my contacts before the agents do?
Yes. It removes almost all of their leverage, and it is the single most effective step available to you.
Can I report the app itself?
Yes — to Google Play, to RBI’s Sachet portal for unregistered lenders, and through Chakshu for the calls and messages.
Fold Smith
Fold Smith is a technology journalist and the lead editor of The Techleez, an India-first publication that decodes technology, digital payments, streaming and online culture for everyday readers. From UPI and fintech explainers to OTT streaming guides, Android tips and online-safety checklists, he personally tests the apps, tools and services featured on the site before recommending them. His focus is practical, research-backed guidance that helps Indian readers make smarter digital decisions — spend less, stream better and stay safe online. When he is not writing, he is usually tracking NPCI circulars, first-day-first-show box office numbers, or the next big OTT premiere.
More from this author →
