A fake loan app is built to catch you when you are in a hurry. It offers quick cash and few questions, then the costs and pressure begin. RBI has warned the public about unauthorised lending apps, citing complaints of high interest, hidden charges, aggressive recovery and misuse of the data on borrowers’ phones.
Stop and run the checks below before you install an app, not after.
Ten warning signs
Any one of these is a reason to pause. Several together are a reason to walk away.
- It asks for contacts, gallery or call logs. RBI’s rules say apps should not access these phone resources.
- It wants money first. A “processing fee”, “insurance” or “GST” to be paid before any loan arrives is a classic pattern.
- It won’t name the lender. Platforms acting for banks and NBFCs are expected to disclose the partner bank or NBFC upfront.
- There is no Key Facts Statement. RBI requires one before a digital loan is signed, with an APR and repayment schedule.
- Money doesn’t move directly. RBI’s rules say disbursal should go to your own bank account, and repayments should go straight to the lender’s account. A personal UPI ID is a red flag.
- Approval is promised to everyone. “No documents, no credit check, guaranteed” is a sales line, not an assessment.
- There is no grievance officer. RBI’s rules require these details to be displayed prominently on the app and website.
- The rush is relentless. Countdown timers and repeated calls are designed to stop you from reading the terms.
- A smaller sum arrives than you agreed to, or a loan appears that you never applied for.
- There are threats. Any abuse, or threats involving your family or photos, should end the discussion.
A five-minute verification
Step 1: Find the regulated lender. Look in the app and its terms for the full legal name of the bank or NBFC. “Partner bank” isn’t enough.
Step 2: Check the RBI directory. RBI publishes a list of digital lending apps deployed by regulated entities, on its website under Citizen’s Corner. Treat it as one check and not as a guarantee, because RBI says the list reflects what lenders report, without further validation. An app that’s missing isn’t automatically fake, but you should treat that as a warning sign until you have an explanation.
Step 3: Check the lender’s registration. RBI’s website has a list of registered NBFCs, along with a list of those whose registration has been cancelled.
Step 4: Check the lender’s own website. Regulated lenders are expected to list their digital lending apps. Open the site by typing the address yourself, not through a link sent to you, and confirm that the app is named there.
Step 5: Read the permissions before you tap “allow”. A loan app shouldn’t need your contacts or gallery. Fraudsters can also copy the names and logos of real lenders, so a familiar logo proves nothing.
For more on what a genuine offer looks like in rupees, see our guide to the true cost of a personal loan. Also, note that RBI’s rules give borrowers of genuine digital loans a cooling-off period of at least one day to exit without a penalty, on the terms the lender sets out.
If you have already been caught
Don’t blame yourself, and don’t pay more to make it stop. Fraudsters can keep demanding more, and paying doesn’t reliably end it. We can’t promise that lost money will come back, but early reporting may help. Work through these in order.
| Situation | What to do first | Where to go next |
|---|---|---|
| Money has left your account | Call 1930, the national cyber crime helpline, as soon as possible | Report at cybercrime.gov.in, and tell your bank straight away |
| Threats, abusive calls, morphed photos | Save screenshots, call logs and payment records | cybercrime.gov.in and your local police |
| An unregulated app or entity | Note its name, links and any linked bank account details | Report to law enforcement and the Sachet portal, sachet.rbi.org.in |
| A loan from a regulated lender, wrongly handled | Complain to its grievance officer | After 30 days without a reply, or if you are unhappy with it, the Ombudsman at cms.rbi.org.in, if covered |
Protect yourself afterwards
- Block access. Revoke the app’s permissions and uninstall it only after you have saved the evidence.
- Secure your accounts. Change your passwords and UPI PIN, and ask your bank to block a card if it has been exposed.
- Never share an OTP, PIN, or card details. Not with “recovery agents”, or anyone saying they’re from a bank, the police, or the helpline.
- Warn your contacts. If the app has had your contact list, a short message from you can take the sting out of a threat.
- Watch your credit report. Look for loans you never took. Get your free credit report and dispute any errors. If you think your bank or card details were used, read what to do about card fraud as well.
Avoid the second trap
Don’t take a second app loan to repay the first. It can turn one bad loan into many, and the debt can become very hard to leave. If you need money urgently, try your own bank or an established lender first, and talk to family or a trusted adviser before you go further. A loan from a regulated lender still has to be affordable, but you’ll have a clear document and a formal complaint route.
Details such as the directory’s location can change, so check the current position on rbi.org.in.
Bottom line
A genuine lender can tell you who it is, what the loan costs and how to complain. A fake app dodges those questions and wants your data or money first. Verify before you install, never pay upfront, and if things go wrong, go to 1930 and cybercrime.gov.in rather than paying off a blackmailer.
Frequently asked questions
How do I check if a loan app is approved by RBI?
RBI doesn't approve individual apps. It publishes a directory of digital lending apps reported by regulated lenders, under Citizen's Corner on its website. The list is based on what lenders submit, without further validation by RBI, so also check the lender's name and its own website.
Do I have to repay a loan from a fake app?
We can't give legal advice on a specific case. Don't pay extra sums under threat, save all the evidence, and report it to 1930 and cybercrime.gov.in, or to the police. If you need help deciding about the money you received, ask a lawyer.
An app is threatening to send my photos to my contacts. What should I do?
Don't pay in response to threats and don't delete the evidence. Take screenshots, tell someone you trust, report it at cybercrime.gov.in and to your local police, and contact the police immediately if you feel you are in danger. Warn your contacts if you can.
Can a genuine lending app read my contact list?
RBI's digital lending rules say apps should not access phone resources such as contact lists, files, media and call logs, apart from limited one-time access for KYC with your consent. An app that insists on your contacts to give you a loan is a strong warning sign.
