Loan app complaint: step-by-step process and legal guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

The first question in any loan app complaint is who the lender really is. A legitimate digital lending app is only a front end; behind it sits a bank or a non-banking financial company regulated by the Reserve Bank of India. If you can find that lender, you have a grievance remedy. If nobody stands behind the app — if the money came from an unknown account and the only contact is a mobile number — you are dealing with an illegal lending operation, and the remedy is a police complaint, not a regulatory one. Working out which one you have takes ten minutes and decides everything that follows.

How to tell a regulated app from an illegal one

• Look for the lender. The sanction letter, the key facts statement and the app's own screens should name the bank or non-banking financial company. An app that will not name its lender is telling you something.
• Check the RBI's public directory. The Reserve Bank maintains a public directory of digital lending apps deployed by regulated entities, so a customer can verify an app's claim of association with a lender. Inclusion in that list is based on what the lender reports and is not an endorsement, but absence from it is a warning.
• Read the key facts statement. Under the RBI's digital lending directions, a borrower must be given a key facts statement showing the all-inclusive cost of credit as an annual percentage rate, the recovery mechanism and the grievance redressal officer. No charge that is not in that statement can be charged to you.
• Watch the permissions. A lender has no business reading your contact list, call logs, photo gallery or files. The RBI's directions say apps must not access such phone resources, and may take only one-time access for a camera, microphone or location where it is genuinely needed for onboarding or KYC with your explicit consent.
• Watch the money route. Disbursal and repayment must move between the regulated entity and your own bank account, not through a pass-through or pool account belonging to the app or an intermediary.

The law that applies

For a regulated lender, the governing rules are the RBI's digital lending directions, which consolidate the earlier circulars and set out disclosure, data, recovery and grievance obligations. Those directions sit on top of the RBI's fair-practice requirements, including the rule that a lender may levy penal charges on default but may not compound them, and the requirement that the details of any recovery agent be communicated to the borrower before that agent contacts you. Where the app collects data, the DPDP Act 2023 adds a consent-and-purpose framework of its own, and the RBI's directions already require that consent to be need-based, logged, revocable and backed by a deletion right.

If the conduct crosses into crime, the criminal law takes over. Extortionate and abusive recovery is dealt with under s 351 of the BNS 2023 for criminal intimidation and s 352 for intentional insult, and if the app's people publish morphed photographs or private images of you, the IT Act 2000 offences apply — s 66E for violation of privacy, s 67 for publishing obscene material and s 67A for sexually explicit material — with s 356 of the BNS 2023 for defamation and POCSO 2012 where the victim is a child. Cheating by personation using a computer resource is s 66D of the IT Act, and identity theft is s 66C. If the app itself is a fraud that took a fee and disbursed nothing, the offence is cheating under s 318 of the BNS 2023 with the IT Act provisions layered on.

Step-by-step: making the complaint count

1. Stop engaging and stop paying. Do not pay a 'settlement' or 'recovery' charge to make harassment stop. If you owe a genuine loan to a regulated lender, repay the principal and lawful charges through the official channel; if you do not owe the loan at all, do not pay anything.
2. Preserve the evidence. Screenshot every message, save the call recordings, note the numbers that called you and your contacts, and keep the key facts statement, the sanction letter, the disbursal record and the repayment receipts. Do not delete the app before exporting your data and loan documents.
3. Complain to the app and the lender's grievance officer. The RBI's directions require a nodal grievance redressal officer for digital lending complaints, with contact details displayed on the app, the lender's website and the key facts statement. Send a written complaint and keep the acknowledgement.
4. Wait 30 days, then go to the RBI. If the lender rejects your complaint or does not reply within 30 days, you may lodge a complaint on the RBI's Complaint Management System under its integrated ombudsman scheme. State the deficiency precisely: unauthorised data access, a charge outside the key facts statement, abusive recovery, or a refusal to correct your records.
5. File the criminal complaint. Report on cybercrime.gov.in or on 1930, and give a written complaint at the jurisdictional police station so that an FIR is registered under s 173 of the BNSS 2023. Give the app's name, the developer details, the numbers, the accounts into which money moved and the harassment messages.
6. Use the defamation and privacy route where images are involved. Publishing morphed images or contacting your contacts with false allegations is a separate offence, and a takedown request to the platform, with the police complaint number, is the practical first step.
7. Escalate if the police do not act. Section 175(3) of the BNSS 2023 lets you ask the Magistrate to direct an investigation where the station declines to register the case.
8. Report the entity where it takes deposits. The RBI and banks operate a public portal for complaints against entities collecting money or deposits without authority, and an illegal lending app often belongs on that list as well.

What decides the outcome

For a regulated lender, the decisive question is documentary: did the lender do what the RBI's directions require? A key facts statement that was never given, a permission the app demanded without a legitimate purpose, a recovery call made before the agent's details were communicated, or a charge absent from the disclosure are all breaches the regulator can act on. The complaint wins when it names the rule, the date and the document.

For an illegal app, the decisive questions are identification and the money trail. Who owns the app, which bank accounts received your money, which phone numbers made the calls, and where the app is hosted. Indian cyber crime investigation can reach the accounts and the numbers; it struggles with an anonymous application hosted abroad and a lender that exists only on paper. That is why the first thing the police will ask for is not your story but your transaction records.

Courts and regulators also weigh your own conduct. If you borrowed knowingly through an unregistered app at a rate you never checked, the lender's breaches do not vanish, but your complaint becomes harder to press. If you were never given the disclosures at all, the failure is entirely the lender's, and the record shows it.

Mistakes that make things worse

• Paying the harassment demand. It funds the operation and proves nothing.
• Deleting the app before saving your documents. The loan agreement, the disbursal record and the key facts statement are the case.
• Complaining only in a phone call. Write, and keep the acknowledgement.
• Naming only the app and not the lender. The regulated entity is the party the RBI can act against.
• Treating a civil dispute as harassment. If you borrowed and did not repay, the lender's lawful recovery is lawful, however unpleasant; the complaint should target unlawful conduct only.
• Waiting for the harassment to end on its own. It rarely does, and the contacts who received the messages can be witnesses only if the messages are preserved.

Most of the work in these cases is done in the first week. Preserve everything, write to the grievance officer, and let the 30-day clock run while you file the police complaint in parallel, because the RBI route and the criminal route address different failures. A cyber crime lawyer in Kolkata can draft the grievance so it identifies the specific RBI obligations the lender breached, and prepare the police complaint so the IT Act and BNS offences fit the facts rather than being added as filler. Victims accused of something in return should take advice before answering, because a lender's counter-complaint is a common tactic, and the framework for that stage is discussed in our material on criminal defence.

What happens to complaints against unregistered apps

Complaints against apps with no regulated lender behind them follow a different and slower path. The police take the disbursal or collection account as the starting point and work outward: which account received the fee or the repayment, who opened it, which device and internet address were used, and which phone numbers were active around the same time. Payment aggregators and wallet providers hold records that can identify the merchant behind a collection account, and telecom operators hold subscriber data for the numbers that called you. What an investigation usually cannot reach is an application hosted abroad whose developer identity is fabricated. The recoverable part of such cases is therefore often the money still sitting in Indian accounts, while the rest becomes a prosecution that may end in a conviction with the victim's money still gone. Knowing that early helps a victim decide how much to invest in chasing an unregistered app and how much to put into protecting their data and reputation, which is often the more urgent harm.

There is also a reputational dimension that victims underestimate. Loan apps that cannot recover through lawful channels frequently report the borrower to a credit information company, or threaten to. If the entry is wrong, the borrower can dispute it in writing with the lender and, failing correction, complain to the credit information company and then to the RBI Ombudsman. Left unchallenged, a wrong entry can damage a credit record for years, long after the app itself has disappeared.

When to involve a lawyer

Bring in a lawyer if images have been circulated, if your contacts are being harassed, if the amount is large, if the lender has issued a legal notice or filed a recovery case, or if the police have registered a case against you rather than for you. Do not bring in a lawyer to negotiate with the app's recovery callers: negotiation with an illegal operation is not a legal strategy. The three steps that actually change outcomes are preserving evidence, complaining in writing to the party the regulator can reach, and registering the criminal complaint early enough for the money trail to be worth following.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Cyber crime revision: how to challenge an order in court
• RBI banking ombudsman fraud: step-by-step legal guide
• Consumer complaint bank fraud: step-by-step legal guide
• Loan app harassment what it is and how it works
• Loan app harassment: evidence to preserve in 48 hours
• Loan app harassment: legal remedies and recovery options

Cyber crime lawyer in your city · Bank account freeze help · Contact