Home→📚 Personal Safety→Article
📚Personal Safety

How to report loan app harassment to RBI and Cyber Cell (BNS 308)

Read in
Englishहिन्दी
Jump to templates ↓

Getting harassed by recovery agents? Learn how to report illegal loan apps to the RBI and Cyber Cell under the BNS and RBI Digital Lending Guidelines.

HowToHelp Editorial
•
•
10 min read
#loan app harassment#RBI complaint loan app#recovery agent harassment#cybercrime.gov.in report#digital lending guidelines RBI#BNS extortion section#Sachet portal RBI#illegal loan app list india

The Hook

You needed ₹5,000 to cover a course fee or a minor emergency because your pocket money was delayed. You downloaded a random app—let’s call it 'QuickRupee'—that promised 'instant approval with zero paperwork.' You clicked 'Allow' on every permission pop-up because you were in a hurry. Now, you’re two days past the due date. A random WhatsApp number is sending you a morphed photo of yourself with 'CHOR' written across it, threatening to send it to your father and your college principal. You’ve already paid back ₹7,000, but they claim you still owe ₹10,000 in 'processing penalties.' This isn't a debt collection issue; it is a criminal racket, and the law is actually on your side.

What the law actually says

In India, lending money isn't a 'free-for-all.' To legally lend money via an app, a company must be a Regulated Entity (RE)—meaning they must be a Bank or a Non-Banking Financial Company (NBFC) registered with the Reserve Bank of India (RBI).

According to the RBI Digital Lending Guidelines (September 2022), every loan app must clearly disclose the name of the NBFC or Bank they are partnered with. If an app hides this info, it is likely illegal. Furthermore, the RBI Fair Practices Code strictly prohibits recovery agents from using uncivilised language, calling you before 8 AM or after 7 PM, or harassing your friends and family. Your contact list is your private data; accessing it to shame you is a violation of the Information Technology (IT) Rules, 2021.

When harassment turns into threats or morphed images, the Bharatiya Nyaya Sanhita (BNS), 2023 kicks in:

  • Section 308 (Extortion): If they are using threats to force you to pay 'penalties' that weren't in the contract.
  • Section 351(2) (Criminal Intimidation): For threatening to harm your reputation or person.
  • Section 79 (Insulting Modesty): Often used if they use morphed photos or gender-based slurs against women.
  • Section 66E of the IT Act: For violating your privacy by capturing or publishing private images without consent.

If the app is not registered with the RBI, they have no legal standing to collect money through the court system, which is why they resort to 'digital lynching.' Reporting them isn't just about stopping the calls; it’s about triggering a regulatory and criminal investigation into a predatory system.

Step-by-step playbook

  1. Secure your digital perimeter

    Before you fight back, stop the data leak.

    1. Revoke Permissions: Go to your phone Settings > Apps > [The Loan App] > Permissions. Turn off access to Contacts, Gallery, and Location. If you can, uninstall the app, but only after taking the screenshots mentioned in Step 2.
    2. Warn your contacts: Send a broadcast message or post a status: "My phone was hacked/compromised by a fraudulent loan app. If you receive any calls or morphed photos involving me, please block the number and do not engage. I am filing a police complaint."
    3. Do not pay more: Paying 'extension fees' is like feeding a shark; it will only come back for more. Stop all transfers immediately.

  2. Build your evidence locker

    Police and the RBI cannot act on 'he-said-she-said.' You need a folder of digital proof.

    • Screenshots: Capture the loan agreement (if any), the 'Sanction Letter' shown in the app, and the transaction history showing how much you received and how much you paid.
    • The Threats: Screenshot every WhatsApp chat, including the profile picture and phone number of the harasser. Record calls if they use abusive language.
    • The App Details: Go to the Google Play Store or Apple App Store and screenshot the app's 'Developer Info' and 'About' section. Note down the NBFC name if mentioned.

  3. Report to the Cyber Crime Portal

    Since most of these apps operate across state lines, the Cyber Crime reporting portal is your first official stop.

    1. Visit cybercrime.gov.in or call the national helpline 1930.
    2. Select 'Report Other Cyber Crime'.
    3. Upload your evidence. Specifically mention if they are using morphed photos (this fast-tracks the case).
    4. Keep the Acknowledgement Number safe. You will need this for the RBI complaint.

  4. The RBI 'Sachet' Signal

    If the app is unregistered or 'rogue,' the RBI has a specific portal for this called Sachet.

    1. Go to sachet.rbi.org.in.
    2. Click on 'Help across States' or 'Report an Entity'.
    3. Fill in the details of the app. Even if you don't know the company name, provide the app name and the link from the Play Store.
    4. This helps the RBI coordinate with law enforcement to ban these apps from the Indian ecosystem.

  5. Complaint to the Nodal Officer (For 'Legit' Apps)

    If the app is linked to a real NBFC (like DMI Finance, KrazyBee, etc.) but the recovery agents are being abusive:

    1. Find the Nodal Officer details on the app's website (this is mandatory under RBI rules).
    2. Email them with your loan ID, the screenshots of the harassment, and the 'Cyber Crime' acknowledgement number.
    3. Give them 30 days to resolve it. If they don't respond or you aren't satisfied, escalate to the RBI Ombudsman via the CMS Portal (cms.rbi.org.in).

  6. Filing a formal FIR

    If the harassment involves serious threats of violence or leaked photos, a digital complaint isn't enough. You need to know how to file an FIR (and what to do if police refuse).

    • Go to your local police station.
    • Ask to file an FIR under Section 173 of the BNSS (which replaced Section 154 of the CrPC).
    • Cite Section 308 (Extortion) and Section 351 (Criminal Intimidation) of the BNS.
    • If the officer refuses, mention that you will send the complaint to the Superintendent of Police (SP) via registered post under Section 173(4) of the BNSS.

    Dealing with this is incredibly stressful. If the constant pestering is affecting your mental health, do not isolate yourself. Reach out to Mental health helplines (iCall, Vandrevala, NIMHANS) to talk to someone who can help you stay grounded while you fight this legally.

    Browse all civic-action playbooks

Where it usually breaks

Even with the law on your side, the system has friction points. Here is how to navigate the most common roadblocks:

  1. The "Not Our Jurisdiction" Loop: Local police stations might try to redirect you to a "Cyber Cell" that is 20 kilometres away, or tell you to "just block the number."

    • The Workaround: Remind them that under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), they are required to register a Zero FIR regardless of where the crime took place. If they still refuse, use the National Cyber Crime Reporting Portal to file a formal complaint online. This generates a trackable acknowledgement number that the local police cannot ignore.

  2. The App Isn't on the RBI List: When you try to complain on the RBI Sachet portal, you might find the app’s name is missing from the dropdown menu because it’s an illegal, unregistered entity.

    • The Workaround: Do not stop. Use the "Help" or "Report Fraudulent Activity" section on Sachet specifically for unregistered entities. Mention clearly that the app is operating without a valid NBFC license. This triggers the RBI’s enforcement wing rather than just the consumer grievance cell.

  3. The "Hydra" Problem (New Numbers): You block one harasser, and three more message you from different +92 or +84 country codes.

    • The Workaround: Stop engaging entirely. Every time you reply, you confirm the number is "active," which increases its value in their database. Set your WhatsApp to "Silence Unknown Callers" (Settings > Privacy > Calls). Report the business accounts to WhatsApp directly by long-pressing a message and selecting "Report and Block."

  4. The NBFC Denies Responsibility: If the app is "legit" (partnered with an NBFC), the NBFC might claim the recovery agents are "third-party contractors" they don't control.

    • The Workaround: This is legally irrelevant. Under the RBI’s Outsourcing Guidelines, the Regulated Entity (the NBFC) is 100% responsible for the actions of its service providers. If they give you this excuse, escalate it to the RBI Ombudsman (cms.rbi.org.in), stating that the NBFC is violating the Fair Practices Code.

Templates & scripts

Copy, fill in the [highlighted] bits, and send.

A. The "Warning Shot" (Script for the Harasser)

If you pick up a call from a recovery agent, do not argue or plead. Use this script and then hang up:

"This call is being recorded for legal evidence. You are violating the RBI Fair Practices Code and Section 308 of the BNSS by using abusive language and threats. I have already filed a complaint on the National Cyber Crime Portal (Reference No: [Your Number]). Do not contact me or anyone in my contact list again. Any further contact will be treated as criminal intimidation and reported to the police."

B. The "Safe Space" Message (For your Friends/Family)

Copy and paste this to your WhatsApp Status and send it to your close family:

"URGENT: My phone data has been compromised by a fraudulent loan app. They are using morphed photos and fake legal threats to extort money. If you receive any messages or calls mentioning my name or showing edited photos, please BLOCK them immediately. I have already initiated legal action with the Cyber Cell. Do not click any links they send."

C. Formal Complaint to the NBFC Nodal Officer

If the app is linked to a real NBFC, find the Nodal Officer's email on the app's 'Contact Us' page and send this:

Subject: Formal Complaint: Harassment and Unethical Recovery Practices by [App Name]

Dear Nodal Officer, I am a borrower with Loan ID [Your ID]. I am writing to report that your recovery agents are using abusive language and threatening to leak my private data to my contacts, violating the RBI Digital Lending Guidelines (Sept 2022).

Please note that under the Fair Practices Code, your company is liable for the conduct of your agents. I demand an immediate stop to this harassment. If this continues for another 24 hours, I will escalate this matter to the RBI Ombudsman and file a criminal case for extortion under Section 308 of the BNSS.

Regards, [Your Name]

Frequently Asked Questions

1. Will this mess up my CIBIL score if I don't pay the "penalties"?

If the app is illegal (not linked to an RBI-registered NBFC), they cannot report to CIBIL or any credit bureau. They are ghosts in the financial system. If the app is legal, you should pay the *principal* amount and *legal interest*, but you can dispute the "hidden penalties" through the RBI Ombudsman. Your credit score cannot be legally lowered for refusing to pay extortionate, non-contractual charges.

2. Can these people actually come to my house?

Almost never. These scams usually operate out of "call centres" in distant cities or even neighbouring countries. Their only power is digital bullying. If someone does show up (which is rare for small loans), do not let them in. Call 112 immediately. Legitimate recovery agents must carry an ID card and an authorization letter from the bank/NBFC.

3. They have my Aadhaar and PAN. Can they take another loan in my name?

While they have your details, taking a fresh loan usually requires an OTP sent to your linked mobile number or a live KYC selfie. However, to be safe, check your credit report every month using free tools like Experian or CRIF. If you see an unauthorized loan, report it immediately as identity theft on the Cyber Crime portal.

4. What if I already paid the "penalty" and they are asking for more?

Stop. Now. Paying once proves you can be intimidated, which makes you a "high-value target." They will never stop until you stop paying and start reporting. The money you’ve already paid is likely gone, but reporting helps the police freeze the scammer's bank accounts to prevent further fraud.

5. Is it my fault for clicking "Allow" on the permissions?

No. While it's a lesson in digital hygiene, "allowing" a permission is not a legal waiver of your right to privacy or protection against extortion. No contract—digital or otherwise—can override the laws of the land (BNS and IT Act). You were misled by a predatory interface; the crime is theirs, not yours.

📮

One civic-action playbook a week

RTI templates, FIR scripts, real escalation ladders — the same kind of thing you just read. Sundays only. No spam.

We don't share your email. Unsubscribe any time.

Related Articles

📚 Personal Safety

How to report online harassment under IT Rules 2021 and BNS

Someone sharing your photos without consent? Learn how to use the IT Rules 2021 to force platforms like Instagram or X to take down harmful content within 24 hours.

📚 Personal Safety

How to ensure school bus safety using Supreme Court guidelines

Is your sibling's school bus a rickety death trap? Learn the mandatory Supreme Court safety rules and how to force your school to follow them.

📚 Personal Safety

How to use Childline 1098 and what happens after your call

Found a child in distress? Calling 1098 isn't just a report; it triggers a legal rescue chain. Here is exactly what happens from the moment you dial to the rescue.

📚 Personal Safety

How to file a dowry demand complaint under Section 4 of the Dowry Prohibition Act

Someone asking for "gifts" or "cash" for a wedding isn't just awkward—it's a crime. Here is how to legally report dowry demands under the Dowry Prohibition Act 1961.

How to report loan app harassment to RBI and Cyber Cell · HowToHelp