How to recover money lost to instant loan app fraud

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

You can recover money lost to instant loan app fraud, but only by moving on four tracks at once: freeze the account through 1930 and cybercrime.gov.in, dispute the debit with your bank under the RBI 2017 liability circular, file an FIR under section 66D of the IT Act 2000 read with section 318 of the BNS 2023, and pursue the app operator civilly. Speed decides most of it. Money that is still sitting in a mule account when the freeze lands is recoverable; money withdrawn in cash rarely is.

Recovery in instant loan app fraud is not one case. It is four separate processes running in parallel, each with its own forum, its own evidence standard and its own clock. Victims who treat it as a single police complaint usually lose the banking remedy because the bank dispute window closes while they wait for the police to act. Victims who treat it as a single bank dispute usually lose the criminal case because the transaction trail is never preserved for investigation.

The second thing to understand is that the loss is rarely a straightforward transfer. Instant loan apps take money in three ways: an upfront fee before disbursal, an auto-debit or mandate that keeps pulling after repayment, and extortion built on the contact list and gallery scraped at install. Each produces a different cause of action. The RBI 2017 circular on limitation of customer liability in unauthorised electronic banking transactions applies squarely to the second and only partly to the first.

Why loan app fraud behaves differently from ordinary cheating

In an ordinary cheating case, the victim hands over money and the accused disappears. In a loan app case the victim installs the app, grants permissions and often receives a genuine small disbursal, so the bank's first response is predictable: the customer authorised it. The fraud sits in what happened around the authorisation, not in the authorisation itself.

Fee-before-disbursal. The app approves a loan and asks for a processing fee, GST, insurance or a repayment verification deposit before releasing funds. The loan never arrives. This is cheating by personation using a computer resource, and the bank may say the payment was authorised by you.
Unauthorised mandate abuse. A genuine small loan is disbursed, and an auto-debit mandate or e-mandate is registered with far higher limits than disclosed, or repeatedly presented after repayment. This is where the RBI liability framework does real work.
Extortion after scraping. The app takes contacts, photos and SMS data at install and later threatens to send morphed images to contacts unless more money is paid. The loss here is caused by criminal intimidation and extortion, not by the loan at all.

Many cases combine all three. The money paid to stop extortion is often the largest amount and the least likely to be refunded, because it looks voluntary.

What the law says

The criminal side rests on a few provisions. Section 66D of the Information Technology Act 2000 punishes cheating by personation using a computer resource or communication device, with up to three years and a fine up to one lakh rupees. Section 66C covers identity theft where the app used another person's credentials, and section 66 covers computer-related offences generally. Section 66E applies where private images were captured or transmitted.

On the penal side, section 318 of the Bharatiya Nyaya Sanhita 2023 is the cheating provision. Section 318(4), cheating and dishonestly inducing delivery of property, carries up to seven years and a fine. Section 316 covers criminal breach of trust where money was entrusted and dishonestly misappropriated. Section 336 covers forgery and section 340 covers using a forged document, which is what a fabricated sanction letter or a fake RBI registration certificate amounts to. Section 351 covers criminal intimidation and section 308 covers extortion, both of which fit the recovery-demand phase. Section 356 covers defamation where the threat is to publish defamatory material.

Two more statutes matter. The Bharatiya Sakshya Adhiniyam 2023, section 63, governs how electronic records are proved in court and requires a certificate in the prescribed form when the record is produced by a device or process outside the court.

On the regulatory side, the RBI circular of 6 July 2017 on customer protection and limitation of liability in unauthorised electronic banking transactions sets the zero and limited liability framework. The RBI digital lending directions of 2022 govern who may lend, how the loan must be disbursed, and what data may be collected. An app that disburses to a personal account, collects contacts, or hides its lender identity is in breach of those directions, and that breach is independent of the criminal case.

For procedure, section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 governs the FIR. Where the police refuse to register it, section 175(3) allows you to approach the magistrate with a complaint. Section 35 governs arrest and section 187 governs remand and custody.

Step-by-step: what to do, in order

Stop the bleeding first. Do not uninstall the app before you have captured its screens. Uninstalling destroys the app's local cache, which is often the only record of the permission set and the disclosed terms. Turn off mobile data for that app or move the SIM to another handset while you preserve evidence.
Call 1930 within the first hours. The national cyber crime helpline raises a complaint on the Citizen Financial Cyber Fraud Reporting and Management System. Give the exact UPI IDs, the bank account numbers, the amounts, the timestamps and the app name. A complaint number is generated, and that number is what you will quote to the bank and to the police.
File on cybercrime.gov.in as well. The portal complaint creates the formal record. Upload screenshots of the loan sanction, the fee demand, the mandate registration, the disbursal and every recovery call. Keep the acknowledgement PDF.
Write to your bank the same day. Email the nodal officer and the branch, mark it an unauthorised electronic transaction dispute, quote the 1930 number, and demand a written acknowledgement under the RBI 2017 framework. Attach the statements and insist on email, not a phone call.
Freeze your own account credentials. Block the debit mandate from the UPI or bank app, revoke the auto-debit, and change the net banking and UPI PIN. If a mandate was registered without your knowledge, ask the bank in writing to cancel it and to confirm cancellation in writing.
Preserve the evidence set before it ages out. Screenshots of every screen in the app, call recordings, WhatsApp and SMS threads, the contact numbers used by the recovery agents, the UPI mandate reference, the bank statement, and the app store listing with its developer name. Note the download source.
Register the FIR. Go to the cyber crime police station or the local station with the 1930 acknowledgement, the portal complaint, a written complaint and the evidence set. Ask for the FIR copy and the section numbers endorsed on it. If the station declines, send the complaint in writing by registered post and then move under section 175(3) BNSS before the magistrate.
Write to the app store and to the lender named on the app. Google Play and the App Store both have developer misconduct channels. Where the app names an NBFC as the lender, write to that NBFC's grievance officer and to its nodal officer. The named lender is liable for the conduct of its lending service provider under the digital lending directions.
Complain to the data protection route. If contacts or gallery were scraped without proper notice and consent, file a complaint under the DPDP Act 2023. This is a separate remedy and does not replace the criminal case.
Escalate to the banking ombudsman. If the bank rejects the dispute or does not decide it within thirty days, approach the RBI Integrated Ombudsman Scheme. Keep the paper trail from steps 4 and 5; the ombudsman decides on the record you build.

Where to complain, and what each forum can actually do

Forum	What it can do	What it cannot do	Practical timing
1930 helpline and CFCFRMS	Raise the complaint, request a lien on the beneficiary account, start the money trail	Order a refund to you	Same day, ideally within hours
Your bank and its nodal officer	Reverse or hold the debit under the RBI 2017 liability framework, cancel mandates, provide statements	Prosecute anyone	Written dispute within three working days of the debit
Cyber crime police station	Register an FIR, investigate, arrest, attach proceeds, move for restitution	Quickly order a bank refund	FIR as soon as the trail is documented
RBI Integrated Ombudsman	Direct the bank to compensate where the bank failed its own obligations	Touch the criminal case	After thirty days or on rejection
Civil court	Decree for the amount, injunctions against recovery calls, damages	Impose criminal punishment	When the amount justifies the cost

Order matters less than overlap. The bank dispute must be in writing early, because the RBI framework grades liability by speed of reporting. The criminal complaint must be filed early, because mule accounts empty within hours. The civil claim can wait until the investigation shows a solvent defendant.

What decides whether you get money back

The first factor is where the money went and how fast the freeze landed. A complaint raised while funds are still in the first beneficiary account gives the bank and the investigator something to hold. A complaint a week later usually finds an emptied account.

The second factor is whether the debit was authorised. Under the RBI 2017 framework, where the fraud is a third-party breach and the customer is not at fault, liability is zero, provided the customer reports within three working days. Where the customer shared the PIN or OTP, or where the mandate was genuinely consented to with the limit disclosed, the bank's liability shrinks and the case becomes harder. The distinction is not moral, it is contractual and evidentiary, and it turns on what the app actually disclosed on screen.

The third factor is documentation. A dispute supported by screenshots and a written trail is decided differently from a verbal complaint. The fourth is whether a lender or NBFC can be identified. An app with no named lender and no grievance officer is built to be untraceable, and that absence is itself a breach you can put to the regulator.

The fifth is the amount. Small losses usually go through the bank and the ombudsman. Larger losses justify a civil suit and a sustained criminal follow-up. The sixth is whether the extortion element is pursued separately. Threats to publish morphed images are a distinct offence and often the only lever that produces a quick stop.

Mistakes that cost people their recovery

Paying the recovery fee to make the harassment stop. It never stops, and each payment is a fresh voluntary transaction that weakens the bank dispute.
Deleting the app, the call log and the chat threads before capturing them. This is the single most common self-inflicted loss in these cases.
Complaining only to the app's in-built support or to a number supplied inside the app. That channel belongs to the accused.
Waiting for the police to recover the money before disputing the debit. The bank clock runs independently and does not pause.
Filing one vague complaint for several transactions without listing each amount and reference separately. Investigators work from reference numbers.

If your account was used as a mule, the position reverses. A freeze after another victim's complaint is not resolved at the bank counter; it needs a written representation to the investigating officer and, where the freeze continues without basis, an application to the court. Our criminal defence team handles that side of these matters, and the cyber crime lawyer in Kolkata page sets out how the investigation is normally structured.

When to involve a lawyer

Most small loan app losses can be handled by the victim directly through 1930, the bank and the portal. A lawyer becomes useful at four points: when the bank rejects the dispute on the ground that the transaction was authorised; when the police refuse to register the FIR; when extortion calls continue after the complaint and need a court order or a targeted application; and when the amount is large enough that a civil suit or an application for restitution of attached proceeds is worth the cost. If you are the account holder whose account was frozen as a mule, engage a lawyer early, because the freeze will not lift on its own and the investigating officer needs a documented reason to release it.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back from an instant loan app fraud in India?

Sometimes. Money is recoverable when 1930 and your bank act quickly enough that funds are still held in the beneficiary account. Once withdrawn in cash, recovery depends on the investigation locating the operators. The RBI 2017 liability framework can also produce a refund from your own bank where the debit was unauthorised and you reported within three working days.

Is reporting to 1930 enough to recover loan app fraud money?

No. 1930 raises the complaint and starts a money trail, but it cannot order a refund. You must separately dispute the debit in writing with your bank under the RBI 2017 circular, file a police complaint or FIR, and escalate to the banking ombudsman if the bank refuses. Each route has its own evidence standard and its own deadline.

Which sections apply to instant loan app fraud?

Section 66D of the IT Act 2000 covers cheating by personation using a computer resource. Section 318(4) of the BNS 2023 covers cheating and dishonestly inducing delivery of property. Section 316 BNS covers criminal breach of trust, and sections 336 and 340 BNS cover forgery and use of a forged document such as a fake sanction letter or registration certificate.

How long does a loan app fraud investigation take?

There is no fixed period. Freezing a beneficiary account is fast, often within days of the complaint. Tracing layered transfers through mule accounts takes longer. Charge-sheeting depends on whether the operators can be identified and located, and cases where the app is hosted abroad and the developers are untraceable can run for years without a charge sheet.

Can the bank refuse to refund an authorised loan app payment?

The bank can argue that you authorised the payment. Your answer is that consent was obtained by deception about a material fact, and that the RBI 2017 framework covers third-party breach where the customer is not at fault. Its strength depends on what the app disclosed on screen and whether you reported within three working days.

What should I do if the loan app is threatening to send my photos to contacts?

Do not pay. Report the threats immediately to 1930 and to the cyber crime police station, preserve the call recordings and chat screenshots, and ask the investigating officer to seek takedown and number-blocking orders. Criminal intimidation under section 351 BNS and extortion under section 308 BNS apply, and the numbers used to threaten you are usually the strongest lead available.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact