Loan app harassment: legal remedies and recovery options

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

Loan app harassment sits at the meeting point of two bodies of law, and that is why victims often feel that nothing is moving. The criminal law is concerned with punishing conduct — the threatening calls, the morphed photographs sent to your contacts, the fake legal notices. The civil law is concerned with your money and your right to be left alone. A single complaint rarely delivers both. Understanding which remedy does which is the whole of "legal remedies" here, and it is the difference between a case that ends in a caution and one that ends in a decree.

Begin with the correct characterisation. An unlicensed lender that harasses a borrower is not running a legitimate recovery process that has gone too far; it is committing a set of discrete offences, each with its own section, and each independently actionable. Naming those sections correctly at the first complaint shapes everything that follows — the jurisdiction, the seriousness with which the station treats the matter, and whether a Magistrate can later take cognisance.

What the law says

On the criminal side, BNS 2023 section 308 covers extortion — obtaining money by putting a person in fear of injury. Section 351 covers criminal intimidation, which is what a threat to your family, your job or your reputation amounts to. Section 318 covers cheating, including the aggravated form where property is dishonestly induced to be delivered; a fake "legal department" or forged recovery notice falls here. Section 316 (criminal breach of trust) is relevant where the app held your data or deposit and misused it. Where documents or notices are fabricated, section 336 (forgery) applies.

The Information Technology Act, 2000 supplies the digital offences. Section 66 punishes computer-related offences done dishonestly or fraudulently. Section 66C punishes identity theft — using another person's electronic signature, password or unique identification feature. Section 66D punishes cheating by personation using a computer resource, which squarely covers an operator pretending to be a recovery officer or a government authority. Section 66E punishes capturing or publishing the image of a private area without consent, which is the section that matters most where morphed pictures are circulated to shame a borrower into paying.

Procedure comes from the BNSS 2023. Section 173 requires that information disclosing a cognisable offence be recorded and a copy given free to the complainant. Section 175(3) allows an aggrieved person to move the Superintendent of Police if the station does not act. Section 187 allows a complaint to the Judicial Magistrate, who may direct investigation. Electronic evidence — chat records, call logs, app data — is governed by BSA 2023 section 63, which sets out how electronic records are proved, and your screenshots will need to be authenticated in that form.

On the civil side, the remedies are a suit for money had and received to recover amounts paid without consideration, a suit for damages for defamation and mental agony caused by the circulation of material, and an injunction restraining the operator from further use of your data or contact list. The IT Rules, 2021 add an administrative lever: platforms and app stores must maintain a grievance officer and act on valid complaints, so a takedown request is a genuine remedy, not merely a courtesy. Where personal data was harvested without consent, the DPDP Act, 2023 provides a further basis for complaint about the misuse of that data.

The criminal route, in order

1. Compile a dated chronology: every call, message, threat and debit, in one document.
2. Report on cybercrime.gov.in or the 1930 helpline to create a national record and trigger account-level action.
3. File an FIR under BNSS section 173, naming each section that fits the conduct, and collect the free copy.
4. If the station stalls, write to the Superintendent of Police under section 175(3).
5. If that fails, file a complaint before the Magistrate under section 187.

The civil route, in order

1. Serve a legal notice demanding the refund of sums paid without consideration and the cessation of further contact.
2. File a suit for recovery with interest, supported by bank statements and the app's ledger.
3. Seek interim injunction against further data use or circulation where material is being spread.
4. Quantify damages for defamation and distress where morphed or private material was shared.

Choosing the remedy

What decides the outcome

Courts and police weigh the pattern, not the single message. One angry call is weak; a documented series of threats, a demand that increases each day, and contact with third parties is a clear course of criminal conduct. Attribution is the second factor — you must connect the phone numbers, the payment handle and the app to a named entity, which is why you keep the app installed until you have exported its records. Proportionality matters too: a court is far more willing to act where the harassment targeted a minor, an elderly person, or was accompanied by the spread of private material. Finally, the parallel bank dispute often resolves fastest, because the RBI 2017 framework places the burden of investigation on the bank once you have reported promptly.

In practice, the fastest monetary relief usually comes from the bank dispute, while the criminal complaint is what stops the harassment for good.

What not to do

• Do not drop the criminal complaint because a refund is promised; get the promise in writing if you rely on it.
• Do not delete the app or the chat threads before exporting the records.
• Do not accept a "no-dues certificate" from the operator itself as proof that you owe nothing.
• Do not begin a civil suit before fixing the identity of the defendant, or you will sue a shell.

The two routes are complementary rather than alternative. For the defence of a genuine borrower facing a counter-complaint, see criminal defence; for matters arising within West Bengal and its courts, including the Calcutta High Court, see the West Bengal cyber law page.

Where the criminal and civil routes overlap

It is a common misconception that a victim must choose one route or the other. Indian law allows both to run in parallel, and each strengthens the other in ways that are easy to miss. The FIR fixes the date on which you first complained, which is exactly the evidence a bank needs when it grades your liability under the RBI 2017 circular. The bank statement, in turn, gives the criminal case a clean, indisputable record of what was taken, which is stronger than a complainant's recollection.

The overlap also creates a tactical reality. A civil suit for recovery has a definite value and a definite defendant, while a criminal case carries the risk of an investigation that cannot trace the operator. Where an app has no identifiable Indian entity, the civil route may face the practical difficulty that there is no one to sue; the criminal route, by contrast, can proceed against the payment handlers and the individuals behind the collection calls, whose identities the bank and the police can obtain. That is why the answer to "which route" is usually "whichever can be executed on the facts you can prove" rather than "whichever is legally stronger".

There is one caution. Statements made in one proceeding can be used in the other, so the two must be consistent. A civil plaint that describes the transaction as a genuine, if overpriced, loan sits awkwardly beside an FIR that describes the same transaction as extortion. Deciding the character of the transaction before either filing is drawn is therefore the most important early decision, and it is the one worth taking advice on.

A final point about sequencing. Where the operator is traceable and solvent, leading with the civil notice often produces a refund faster than waiting on an investigation. Where the operator is a moving target, the criminal complaint and the 1930 report are the only levers that reach the payment handlers, because the police can requisition records that a private litigant cannot. Read your own facts for that distinction before you decide, and do not assume that the louder remedy is the more effective one.

The remedies also differ in what they cost you in time. A bank dispute under the RBI framework is the least demanding and can produce a credit within weeks. An FIR requires your presence at the station and a follow-up if the investigation stalls. A civil suit requires pleadings, evidence and hearings across months. A sensible strategy therefore stacks them: start the bank dispute and the 1930 report immediately, file the FIR as the criminal base, and hold the civil suit in reserve for the money the other routes do not return.

What the operator will argue, and how to answer it

Expect three defences. The first is that the borrower consented to the terms, including the fee. The answer is the ledger itself: an undisclosed deduction is not a consented term, and a consent obtained at install without a clear disclosure is not informed consent under the DPDP Act 2023. The second is that the outstanding amount is a legitimate debt and the calls are ordinary recovery. The answer is the manner of recovery, which is what the criminal law addresses; a lawful debt does not authorise threats to a borrower's family. The third is that the app is a mere technology platform and the collection was done by an independent agency. The answer is the identity trail, because the permissions, the data and the payment routing all belong to the operator.

Each answer rests on a document rather than on argument, which is why the evidence folder assembled early matters more than the eloquence of the complaint. Anticipating these defences also tells you what to collect: the terms screen as it appeared at install, the ledger, the call recordings and the payment handles. A victim who has those four things has answered all three defences before they are raised.

When to involve a lawyer

Drafting a coherent complaint that names the right sections, and choosing between the criminal and civil routes, is where legal advice pays for itself. Once the FIR is refused or a counter-complaint is filed, the matter has moved beyond a self-help complaint and the timing of your next step becomes critical.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Instant loan app fraud: legal remedies and civil recovery
• Trading app scam: legal remedies, FIR and civil recovery
• Work from home scam legal remedies and recovery routes
• Mutual fund scam: legal remedies, complaint and recovery
• Job Scam Legal Remedies: Criminal Complaint and Recovery
• Investment scam legal remedies: criminal and civil

Cyber crime lawyer in your city · Bank account freeze help · Contact