Instant loan app fraud: legal remedies and civil recovery
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law
Instant loan app fraud gives you three separate legal remedies, not one: a criminal complaint that punishes the operators, a regulatory claim that recovers money from your bank or the named lender, and a civil suit that produces a decree for the amount. Choosing only one leaves the other two on the table. The remedy that actually returns money fastest is almost always the regulatory one, not the FIR.
Most people who lose money to an instant loan app file a police complaint and stop there. That is understandable and it is also the slowest possible route. A criminal case punishes the accused if he is caught and convicted; it does not, by itself, put money back in your account. The remedy that produces money is a claim about who breached an obligation to you, and in these cases the breaching party is often identifiable, regulated and solvent.
This is why the correct advice is not to choose between criminal and civil action. It is to run three tracks in parallel: the criminal track for punishment and for the investigative powers it unlocks, the regulatory track for a refund and for sanctions against the lender, and the civil track for a decree and injunctions. Each track has a different respondent, a different evidentiary burden and a different timeline, and they do not conflict with each other.
Track one: the criminal complaint
The criminal track begins with an FIR. In a loan app case the offences are spread across two statutes because the deception is committed through a computer resource and the loss is caused by the deception.
Under the Information Technology Act 2000, section 66D covers cheating by personation using a computer resource or communication device, punishable with up to three years and a fine up to one lakh rupees. Section 66C covers identity theft, which applies where the app used Aadhaar, PAN or a photograph belonging to someone else. Section 66 covers computer-related offences where the app accessed a computer resource without authorisation, which is what happens when it scrapes contacts, gallery and SMS data beyond the permission actually needed. Section 72 covers breach of confidentiality and privacy by a person who has secured access under the Act.
Under the Bharatiya Nyaya Sanhita 2023, section 318 is the cheating provision. Section 318(4), cheating and dishonestly inducing delivery of property, carries up to seven years and a fine. Section 316 covers criminal breach of trust, which fits the processing fee collected and never accounted for. Section 336 covers forgery and section 340 covers using a forged document, which covers fabricated sanction letters, fake RBI registration certificates and invented lender agreements. Section 351 covers criminal intimidation and section 308 covers extortion, both central to the recovery-agent phase.
The procedural provisions matter as much as the offences. Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 requires the police to register an FIR for a cognizable offence. Section 175(3) allows you to file a complaint before the magistrate where the police decline. Section 35 governs arrest without warrant and section 187 governs remand. These are the provisions you cite when a station tries to send you away with a general diary entry instead of an FIR.
What the criminal track uniquely gives you is coercive power: bank account freezes, preservation orders to the app store and the telecom operator, device seizure, and the possibility of restitution of attached proceeds. It also produces the investigation record that your civil suit will later rely on.
Track two: the regulatory and banking claim
This is the track most victims never use and the one that most often produces money. Its legal foundation is the RBI circular of 6 July 2017 on customer protection and limitation of liability in unauthorised electronic banking transactions, together with the RBI digital lending directions of 2022.
The 2017 circular creates a graded liability structure. Where the fraud is caused by a third-party breach and the customer is not at fault, the customer has zero liability, provided the loss is reported within three working days of receiving communication from the bank. Where the customer's own negligence contributed, liability is capped and the cap depends on how quickly the report was made. Where the customer shared the PIN or OTP, the bank's liability is limited but not automatically zero. In every case, the bank must resolve the dispute within a defined period and must not leave the customer carrying an unresolved debit.
The digital lending directions of 2022 add a second layer. They require lending to be disbursed directly to the borrower's bank account, require the lender to be identified on the app, restrict the collection of contacts and gallery data, and make the regulated entity responsible for the conduct of its lending service providers. An app that takes an upfront fee to a personal UPI ID, hides its lender, or scrapes contacts is in breach of those directions. That breach gives you a complaint to the lender's grievance officer, then to the RBI ombudsman.
The regulatory track also covers data. If the app collected contacts, photos or SMS data without proper notice and consent, the Digital Personal Data Protection Act 2023 gives you a complaint before the Data Protection Board, separate from the money claim.
Track three: the civil suit
A civil suit is the only route that ends in a decree you can execute against assets. The causes of action are usually misrepresentation and fraud, breach of the loan agreement where terms were altered unilaterally, and unjust enrichment for amounts collected beyond what was contracted.
The suit can ask for recovery of the amount with interest, a declaration that the mandate or agreement is void, a permanent injunction restraining further auto-debits and recovery calls, and damages for the harassment. Where the amount is small, the suit belongs before the civil judge in the lowest pecuniary jurisdiction, and court fees follow the claim value under the relevant state statute. Where an injunction is needed urgently to stop an ongoing auto-debit or a campaign of calls, an interim application is filed with the plaint.
The practical difficulty is identification. A civil suit needs a named defendant with an address. Apps that operate through shell companies, foreign hosting and rented bank accounts are hard to sue. That is where the criminal investigation helps: once the beneficiary account is traced to a registered entity, the civil suit can be amended to name it.
How the three tracks fit together
| Track | Respondent | What it produces | What it needs | Rough sequence |
|---|---|---|---|---|
| Criminal | The operators, developers, mule account holders | Punishment, freezes, seizure, restitution of proceeds | FIR or magistrate complaint, electronic evidence with a BSA 2023 s 63 certificate | First, and immediately |
| Regulatory | Your bank, the named lender or NBFC, the data fiduciary | Refund or reversal, mandate cancellation, penalties on the lender | Written dispute within three working days, transaction records, RBI circular | Same week as the FIR, in writing |
| Civil | The identified company or individual | Decree for money, declaration, injunction, damages | A named defendant, documents, valuation and court fee | After the investigation identifies a defendant |
Running all three is not double recovery. The criminal court punishes; the civil decree compensates; the regulatory direction reverses an unauthorised debit. Where the bank refunds you under the 2017 framework, the civil claim is reduced by that amount, and the criminal case continues unaffected because it is about the offence, not about your loss.
What decides the outcome of each track
On the criminal track, the decisive questions are whether the operators can be identified and whether the electronic record can be proved. An FIR that names an app and a UPI ID but no person will struggle. The trail from the UPI ID to the beneficiary account to the KYC record is what converts an anonymous complaint into an investigation with a named accused. The BSA 2023 certificate under section 63 is what makes the screenshots and call records admissible when the matter reaches trial.
On the regulatory track, the decisive questions are timing and characterisation. A written dispute raised within three working days, describing the debit as unauthorised and citing the 2017 circular, is treated very differently from a phone complaint made a month later. Whether the transaction is characterised as authorised or unauthorised depends on what the app disclosed before the payment, not on what the victim understood. That is why the on-screen terms, the fee demand screen and the mandate limit screen are the most valuable documents you can preserve.
On the civil track, the decisive questions are the defendant's solvency and the quality of the documentary record. A decree against a struck-off company is worth the paper it is printed on. Before filing, it is worth checking the company's registration status and whether the named lender is a regulated entity with assets in India.
Mistakes that weaken all three tracks
- Filing only a police complaint. It leaves the bank dispute and the civil claim unused, and the bank dispute is the one with a fixed early deadline.
- Sending the bank dispute as a phone call. The RBI framework turns on written communication. A call centre log is not a dispute letter.
- Describing the transaction as a loan repayment. If your written complaint characterises the payment as repayment of a loan you took, you have conceded authorisation and lost the unauthorised-transaction argument.
- Suing before identifying a defendant. A suit against an unnamed app is dismissed at the threshold and costs you the limitation period.
- Assuming the criminal case will return the money. Restitution of attached proceeds is possible but discretionary, and it depends on assets being attached before they disappear.
- Ignoring the data protection claim. Scraped contacts and gallery images support a separate complaint and, where images were transmitted, section 66E of the IT Act 2000.
Where a lawyer changes the analysis
The choice between tracks is a cost decision as much as a legal one. A lawyer is useful when the amount justifies a civil suit, when the bank has rejected a dispute that should have succeeded under the 2017 circular, when the FIR has been refused and a section 175(3) BNSS complaint is needed, or when an injunction is required to stop auto-debits. The cyber crime legal services page sets out how these matters are handled, and civil litigation covers the suit side. There is no single remedy that fits every loss; there is only the combination that fits yours.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Can I file both a criminal case and a civil suit for loan app fraud?
Yes. The two proceed independently. The criminal case addresses punishment under the IT Act 2000 and BNS 2023. The civil suit seeks a decree for the money, a declaration that the mandate is void, and an injunction against further debits. A bank refund under the RBI 2017 framework reduces the civil claim but does not affect the criminal case.
Which remedy returns money fastest in instant loan app fraud?
The banking and regulatory route is usually fastest. A written dispute to your bank under the RBI 2017 circular, followed by escalation to the RBI ombudsman, can produce a reversal within weeks. A criminal case produces a freeze quickly but a refund only through restitution, which depends on assets being attached and the court ordering release.
Is an FIR necessary before suing a loan app company?
No. A civil suit does not require a prior FIR. An FIR helps identify the defendant, because the investigation traces the beneficiary account to a registered entity. Without that identification, a suit against an unnamed app is likely to be dismissed at the threshold for want of a proper defendant.
What can the RBI ombudsman do about a loan app fraud complaint?
The RBI Integrated Ombudsman can examine whether your bank followed the 2017 liability framework and the digital lending directions, and can direct compensation where it did not. It cannot punish the fraudsters or investigate the crime. It works on the written record you build with the bank, so the dispute letter and the acknowledgements matter more than the complaint narrative.
Can I claim damages for the harassment by loan app recovery agents?
Yes, in a civil suit. Damages can be claimed for mental agony, loss of reputation and the cost of dealing with the calls, alongside an injunction restraining further contact. Separately, the threats themselves are offences under section 351 BNS for criminal intimidation and section 308 BNS for extortion, and should be reported to the police.
Does the DPDP Act 2023 give a separate remedy for loan app data scraping?
Yes. If the app collected contacts, gallery or SMS data without valid notice and consent, you can complain to the Data Protection Board under the DPDP Act 2023. That remedy addresses the data breach and can attract penalties on the data fiduciary. It runs alongside the criminal case and the money claim and does not replace either.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact