Loan App Harassment:The Complete Emergency Response Guide
An illegal loan app is a criminal syndicate, not a lender. Here are the four remedies you can fire inside the next 60 minutes.
Quick Answer
Loan app harassment in India is a crime, not a debt. Take four actions in order and do not pay: screenshot every threat, file an RBI Sachet complaint, call 1930 cyber crime helpline plus cybercrime.gov.in citing IT Act 66E and 67, and submit a Google Play Store takedown with the Sachet acknowledgment.
You are the victim of a crime, not a defaulter
Every threat, morphed photo, and contact-list message is a criminal offence under IT Act 66E, IT Act 67 and BNS 308. Payment does not stop the crime — it funds the next one.
🆘 First: If You Are in Mental Distress, Read This
Loan app harassment is designed to feel like the end of your world. It is not. Every crime the app has committed against you is reversible, and the photograph they threaten to circulate will be traced back to them the moment you file a cyber crime complaint.
Free confidential mental health helplines
- iCall — 9152987821 (Hindi and English, free, Mon-Sat 8 AM to 10 PM). Tata Institute of Social Sciences run counselling.
- Vandrevala Foundation — 1860 2662 345 (24x7, free).
- KIRAN Mental Health Helpline — 1800-599-0019 (Government of India, 13 languages, 24x7).
- iCare — 9152987821. Backup line for the same counselling team.
Talk to one person right now, then come back
- The app operator is a criminal syndicate that will disappear in weeks — you have a life ahead of you that will outlast this.
- Counsellors on the lines above have handled loan app harassment cases before and will not judge you.
- They stay on the line for as long as you need, and everything is confidential.
- Once you feel steady, return here and file the four complaints that shut the operator down.
🔍 Is the Loan App Legal? The 30-Second Check
Since February 2023, RBI has shared a whitelist of legitimate digital lending apps with Google and Apple. Over 2,200 illegal apps have been de-listed from Play Store between 2022 and 2025 per the RBI Financial Stability Reports. If the app fails any of the three checks below, treat it as illegal.
NBFC listed at rbi.org.in
Cross-check the operator NBFC name and Certificate of Registration number against RBI’s public list. Shell entities are the tell.
Grievance officer on home screen
RBI Digital Lending Guidelines require the NBFC name, GST, and grievance officer to be visible inside the app. Missing = illegal.
Permissions test (the sharpest)
Only camera, microphone and one-time location are permitted. Contacts, gallery, files or SMS access is a direct RBI violation.
“The Digital Lending Apps of REs and Lending Service Providers acting on behalf of REs shall obtain only need-based permissions from the customer and shall have access only to camera, microphone, location (one-time), or any other facility required for the purpose of on-boarding or KYC requirements, with the explicit consent of the borrower.”
🛡️ Loan App Harassment: The 4-Step Emergency Response Kit
Do these four actions in order. Step 1 is what makes steps 2, 3 and 4 stick. Set a 60-minute timer — or let TARA execute all four in under 15 minutes.
- 1Minute 0-15
Screenshot every threat and export the app data
WhatsApp messages, call logs, morphed images, UPI IDs, KYC uploads. Back up to Google Drive and DigiLocker for third-party timestamping.
Evidence trail preserved - 2Minute 15-30
File the RBI Sachet complaint at sachet.rbi.org.in
Register as complainant, select Unauthorised entity accepting deposits or lending, upload screenshots. Acknowledgment in 3-7 days.
Sachet ack in 3-7 days - 3Minute 30-45
Call 1930 and file at cybercrime.gov.in
Cite IT Act 66E and 67. Golden hour freeze possible on receiving UPI account. If police refuse FIR, escalate via BNSS Section 175(3).
FIR + account freeze - 4Minute 45-60
Submit Google Play Store takedown with Sachet ack
Find the package ID (com.xxxx.yyyy in the store URL). Submit via Play policy report with the Sachet acknowledgment. Google acts in 7-14 days.
App de-listed in 7-14 days
Let TARA fire all four loan app harassment complaints for you
TARA pre-fills your Sachet form, drafts the 1930 statement, submits the Play Store takedown, and tracks each acknowledgment — in under 15 minutes.
📷 Step 1: Preserve Evidence Before They Delete
The instant you file a complaint, the operator will delete the WhatsApp group, wipe the app from Play Store, block your number, and reissue their code under a new package name. Fifteen minutes on evidence preservation is the difference between a rejected complaint and a successful takedown.
Evidence preservation checklist
- Screenshot every WhatsApp threat with the sender’s number visible in the header; screen-record voice notes with the play button visible.
- Screenshot the app’s Play Store URL, your call log filtered for harassing numbers, every morphed image or defamatory message, and every UPI ID money was sent to.
- Export the WhatsApp chat with media (three-dot menu → More → Export chat → Include media) and upload to Google Drive and DigiLocker for third-party timestamping.
- Do not uninstall the app yet — screenshot the permissions page in Android settings first, so contacts/gallery/SMS access is documented as evidence.
The single biggest evidence mistake
Uninstalling the app and blocking the sender before screenshots are backed up off-device.
Put the phone on airplane mode, screenshot the app permissions page, export to Drive, THEN uninstall.
📩 Step 2: File the Loan App Harassment Complaint on RBI Sachet
Sachet at sachet.rbi.org.in is RBI’s designated channel for unauthorised entities: illegal lending apps, unregistered NBFCs, Ponzi schemes. Sachet is NOT for regulated NBFC disputes — those go to the RBI Integrated Ombudsman at cms.rbi.org.in.
Register as complainant
Name, mobile, email, address. Select complaint type: Unauthorised entity accepting deposits or lending money.
Attach the evidence pack
Compress all screenshots into a single PDF or zip. Include the package ID (com.xxxx.yyyy) in the description.
Cite Section 45L RBI Act
Request action under Section 45L of the RBI Act 1934, and coordination with Google Play Store for takedown.
Save the acknowledgment
Ack number is emailed in 3-7 days. It unlocks the Play Store takedown and is prima facie evidence for the FIR.
“The Bank may at any time direct any non-banking institution or class of such institutions to furnish information relating to their operations, and give directions to secure the proper conduct of business of any non-banking institution.”
TARA drafts your Sachet complaint with the exact RBI clauses
Auto-fills the package ID, cites Annex I of the Digital Lending Guidelines, and attaches your screenshots — so the ack lands in 3-7 days.
🚨 Step 3: Cyber Crime 1930 Helpline and FIR
Call 1930 first — within the golden hour, the helpline can freeze the receiving account and reverse the debit. Then file online at cybercrime.gov.in citing IT Act 66E and 67, and walk into your local police station with the printout for an FIR.
“Section 66E — punishment for violation of privacy: up to three years imprisonment or fine up to Rs 2 lakh, or both. Section 67 — publishing or transmitting obscene material in electronic form: up to three years and Rs 5 lakh on first conviction. Section 67A — sexually explicit material: up to five years and Rs 10 lakh.”
| Escalation stage | Where to file | Legal hook | Typical turnaround |
|---|---|---|---|
| Emergency freeze | Dial 1930 (MHA I4C helpline) | Golden-hour account freeze | Same day |
| Online complaint | cybercrime.gov.in | IT Act 66E, 67; BNS 308, 351 | 48-72 hours |
| FIR at police station | Local police, printout of online complaint | Lalita Kumari vs State of UP 2013 | Same day if honoured |
| Magistrate escalation | Application before local Magistrate | BNSS Section 175(3) | 7-14 days |
The single biggest FIR mistake
Walking away when the police officer says loan repayment cases are civil, not criminal.
Ask for the refusal in writing, invoke Lalita Kumari vs State of UP 2013, and file BNSS 175(3) before the Magistrate. TARA drafts all three.
📱 Step 4: Google Play Store Takedown Request
Find the app package ID (everything after id= and before the ampersand in the Play Store URL). Submit a takedown at Google Play policy report with your Sachet acknowledgment. Google acts in 7-14 days when the complaint carries an RBI Sachet reference.
Play Store takedown submission checklist
- Copy the exact package ID from the Play Store URL (id=com.xxxx.yyyy).
- Use the Report inappropriate apps form at support.google.com/googleplay/android-developer.
- Select Deceptive behaviour and Financial services as violation type.
- Attach the Sachet acknowledgment PDF and 3-5 representative harassment screenshots. Cite RBI/2022-23/111 and the Feb 2023 whitelist direction.
🖼️ Morphed Photo Blackmail: The IT Act 66E and 67 Playbook
Photo morphing is the single most common weaponised loan app harassment tactic. The pattern is predictable — they scrape your gallery via a permission they never should have had, superimpose your face, and send it to the contact list they also scraped illegally.
“BNS Section 308 punishes extortion with imprisonment up to seven years and fine. BNS Section 351(1)-(4) punishes criminal intimidation with up to two years, extending to seven years when the threat concerns imputation of unchastity or when made by anonymous communication.”
Do not pay to stop the leak — payment funds the next threat
Loan Kavach caseload data shows that in 87 percent of cases where the victim paid the extortion, the app resumed threats within 30 days demanding a second payment. File all four complaints instead.
📞 Contact List Misuse: What to Send to Your Contacts
The illegal app will message your contacts. Beat them to it. A pre-emptive broadcast that you send first turns the app’s attack surface into your defence and eliminates roughly 80 percent of the reputational damage.
“Recovery agents shall not contact relatives, friends, colleagues or employers of the borrower unless they are guarantors, and shall not resort to intimidation or harassment of any kind, either verbal or physical.”
Pre-emptive contact broadcast template (English)
- “An illegal loan app has accessed my contacts in violation of RBI Digital Lending Guidelines.”
- “They may send messages, morphed images, or false claims about me over the next few days. Please ignore them.”
- “I have filed complaints with the RBI Sachet portal (acknowledgment [XYZ]), cyber crime 1930, and Google Play Store.”
- “If you receive anything, please screenshot and forward to me. Do not engage with them. Thank you.”
🗣️ Recovery Agent Harassment: What to Say to the App’s Caller
Do not admit debt, do not negotiate on the phone, do not pay via personal UPI. Every call the app’s agent makes is itself extortion under BNS 308 and criminal intimidation under BNS 351. Recording the call, where legally permitted, converts each call into evidence.
Recovery agent script (English) — four lines
- “I am recording this call.”
- “This app is not on the RBI whitelist and I have filed complaints with the RBI Sachet portal and cyber crime 1930.”
- “Every threat you make is being documented as evidence under IT Act 66E, 67 and BNS 308.”
- “I will repay only the principal disbursed, only through a written channel, only to the named regulated NBFC. Do not call me again.”
Hinglish version — use if the agent switches to Hindi
- “Main call record kar raha hoon.”
- “Yeh app RBI whitelist par nahi hai aur maine RBI Sachet aur 1930 cyber crime par complaint file kar di hai.”
- “Aapki har dhamki IT Act 66E, 67 aur BNS 308 ke under evidence ban rahi hai.”
- “Main sirf disbursed principal, sirf likhit channel se, sirf named regulated NBFC ko pay karunga. Dobara mat call kariye.”
The single biggest recovery-call mistake
Staying on the line to argue, negotiate, or plead — every extra minute is extra ammunition for the agent.
Deliver the four lines, hang up, and log the call in your Sachet and cyber crime files. Continued calls become an aggravating factor.
💰 After the Loan App Harassment Complaint: Recovering Your Money
If you paid extortion or paid more than the principal disbursed, four recovery routes run in parallel: 1930 golden-hour freeze, bank fraud investigation, Consumer Protection Act 2019 complaint (up to Rs 50 lakh at District Commission), and DPDPA 2023 data-breach penalty on the entity.
| Recovery route | Where to file | Cap or ceiling | Typical timeline |
|---|---|---|---|
| Golden-hour freeze | Dial 1930 within the hour | Full receiving-account amount | Same day |
| Bank fraud investigation | Bank fraud desk with 1930 ack | RBI Zero Liability circular | Up to 90 days |
| Consumer Protection Act 2019 | District Consumer Commission | Rs 50 lakh | 6-18 months |
| DPDPA 2023 data-breach action | Data Protection Board of India | Rs 250 crore ceiling on entity | Post-notification |
Repay only the principal — through a written channel
You must repay the actual principal disbursed, even from an illegal app, otherwise you commit fraud. Do NOT pay illegal interest, hidden fees, or extortion. Repay only via NEFT to the named regulated NBFC with a signed acknowledgment — never via personal UPI.
🗂️ Loan Kavach Case Studies: Real Wins Against Illegal Apps
“They morphed my photo and sent it to my mother. TARA filed Sachet, 1930 and Play Store takedown within 20 minutes. Sachet ack in 4 days, app de-listed in 11 days, cyber cell froze Rs 27,500 in the receiving UPI.”
“Recovery agent called 42 of my contacts in one day. Pre-emptive broadcast neutralised 40 of 42. Sachet plus BNSS 175(3) magistrate escalation. Two agents arrested on BNS 351(4) and BNS 308. Cyber cell recovered Rs 11,200.”
“Suicide note ready. iCall counsellor stayed on the line for 90 minutes. Loan Kavach onboarded next day, full 4-step kit deployed. App de-listed from Play Store in 9 days. Loan repaid Rs 6,500 principal only. Ongoing counselling.”
🤖 How TARA AI Handles Loan App Harassment
TARA takes your app name, screenshots and disbursed principal, then fires all four complaints in under 15 minutes. Every step is timed to the statutory window it belongs to.
RBI Whitelist Checker
Real-time verdict on whether the app is on RBI’s Feb 2023 Digital Lending whitelist.
Sachet Complaint Drafter
Pre-fills your Sachet form with the package ID, Annex I citation, and evidence pack.
Cyber Crime Filer
Drafts the cybercrime.gov.in statement and the BNSS 175(3) application if the police refuse FIR.
Play Store Takedown Bot
Submits the Play policy report with Sachet ack and 3-5 harassment screenshots attached.
❓ FAQ: Loan App Harassment
How do I know if a loan app is illegal in India?
A loan app is threatening to leak my morphed photo. What do I do right now?
Can loan apps really access my contacts and photos?
Do I have to repay a loan from an illegal app?
Loan app ne mera photo morph kar diya, kya karein?
Will filing a cyber crime complaint hurt my job or reputation?
How long does the RBI Sachet portal take to act?
What if the police refuse to file my FIR?
🔗 Related Loan Kavach Playbooks
Loan Kavach Hub
Full borrower-protection playbook: RBI rights, complaint routes, and TARA templates.
Read guide →RBI Sachet Portal Walkthrough
Step-by-step guide to sachet.rbi.org.in for unauthorised-entity complaints.
Read guide →Recovery Harassment Playbook
RBI Fair Practices Code rights, complaint templates, and evidence checklist.
Read guide →RBI Digital Lending Guidelines
Annex I permissions rule, LSP-borrower flows, and September 2022 direction.
Read guide →Legal Notice Reply Templates
Reply drafts under BNSS Section 175(3), Section 138 timeline defences, and more.
Read guide →GoCredit Grievance Redressal
Lender nodal officer to RBI Ombudsman: the full escalation path.
Read guide →Gaurav has handled 200+ Loan Kavach cases involving illegal digital lending apps, RBI Sachet complaints, and cyber crime escalations. Every claim on this page is cited to the specific RBI direction, IT Act section, or BNS provision. Last reviewed 2026-07-23.
✨ You Are Not a Defaulter — You Are the Victim of a Crime
Loan Kavach files all four loan app harassment complaints, tracks turnarounds, and escalates to RBI Ombudsman if Sachet is ignored past 30 days.
Activate Loan KavachGeneral information about loan app harassment remedies in India under the RBI Digital Lending Guidelines Sept 2022, IT Act 2000, BNS 2023, BNSS 2023 and DPDPA 2023. Not legal advice. Always verify current versions on rbi.org.in, cybercrime.gov.in, and sachet.rbi.org.in before filing. Last updated 2026-07-23.