Loan app harassment what it is and how it works

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

Most people download a loan app because they need a small amount quickly and a bank is too slow. The app asks for permissions that look routine: contacts, storage, camera, location. The loan is disbursed in minutes. What the borrower does not see is that the app has already copied the contact list, the photo gallery and the device identifiers. When the repayment date arrives, the harassment begins, and it does not stop at the borrower.

This is the core of the fraud: the loan is bait, and the data is the real asset. The app is often not a registered lender. It may be a shell operating from outside India with an Indian collection agent, or a licensed entity fronting for an unlicensed one. Understanding the sequence matters, because each stage leaves a different piece of evidence and attracts a different section of law.

What loan app harassment actually is

Loan app harassment is the use of illegally harvested personal data to coerce repayment, and to extract more money than was ever lent. The coercion takes predictable forms. The collection agent calls the borrower's parents, spouse, employer and colleagues, tells them the borrower is a thief, and sends a morphed or obscene image to the family. The agent threatens to send the contact list to the borrower's workplace. The demand grows beyond the principal and the stated interest, and every refusal produces more calls.

The illegality is in two layers. The first layer is the data collection. An app that reads the entire contact list and gallery to sanction a small loan has taken far more data than the loan requires. The second layer is the coercion. Threatening to injure a person's reputation to obtain money is extortion, and it is a criminal offence whether or not the underlying loan exists.

Stage one: the download and the permission grab

The app is usually promoted through an advertisement on a social platform or a message from an acquaintance. It is not on the official app store, or it is on the store briefly before removal. At install, it requests access to contacts, SMS, storage, camera and location. The permission screen is designed to be clicked through, and the loan cannot proceed without granting it.

Once granted, the app uploads the contact list to a server. The contact list is the leverage. It converts a single borrower into a network of people who can be shamed into paying. The same upload may include the SMS inbox, which contains bank alerts and one-time passwords, and the gallery, which contains identity documents and personal photographs.

This stage is where the Data Protection framework applies. The Digital Personal Data Protection Act, 2023 requires consent that is free, specific, informed and unambiguous, and limits collection to what is necessary for the stated purpose. Reading an entire contact list to assess a loan is difficult to justify as necessary. An app that collects without a clear notice and consent breaks the Act.

Stage two: the loan, the fee and the trap

The loan is small, often a few thousand rupees. The app deducts a processing fee before disbursing, so the borrower receives less than the sanctioned amount but owes the full sum. The repayment period is short, sometimes seven days. When the borrower cannot repay on time, the app offers a second loan to clear the first. That is the trap: the second loan carries another fee, and the debt grows while the borrower receives almost nothing in hand.

The offer is also a false representation about the cost of credit. Presenting a loan without disclosing the effective annual rate, the fees and the consequences of default can amount to cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023. Where the app collects money through a computer resource on a false promise, section 66D of the Information Technology Act, 2000 also applies.

Stage three: the contact blast

On the due date, or a day before it, the collection agent starts calling the borrower's contacts. The calls are not random. The app has the contact list and often the call logs, so the agent knows who the borrower speaks to most. The message is always the same: pay now or the photographs go to everyone.

This is extortion under section 308 of the BNS, 2023, which covers intentionally putting a person in fear of injury in order to dishonestly induce delivery of property. It is also criminal intimidation under section 351 of the BNS where the threat is to reputation or person. Where the agent publishes or transmits a morphed image, section 67 of the IT Act, 2000 applies, and section 67B applies where the material involves a child. If the borrower is a woman and the threat is to modesty, the BNS provisions on insult to modesty and stalking are also relevant.

Many victims do not realise that the publication itself is a separate offence from the demand for money. Sending an obscene or morphed image to a family member is not a civil collection practice; it is a criminal act that the police can act on independently.

Stage four: the data market

The data collected at sign-up has value beyond the individual loan. Contact lists, identity documents and financial details are sold or reused to target the borrower's contacts with new loan offers. This is why a person who never downloaded a loan app starts receiving calls from unknown numbers offering instant credit. The borrower's data has become a lead list.

Under the DPDP Act, 2023, a data fiduciary must erase personal data once the purpose is served and must not retain it beyond necessity. An app that keeps the contact list after the loan is closed, or shares it with marketers, breaches that obligation. The Act also gives the data principal rights to correction and erasure, though enforcing them against an app with no Indian presence is difficult in practice.

Why the app is hard to trace

The developer name on the app is often a company registered in a jurisdiction with light disclosure. The server sits outside India. The collection agents work from a call centre and use numbers that change weekly. The payment is collected into accounts opened in the names of individuals who may be mule account holders. Each layer is designed to break the trail between the borrower and the person who actually controls the operation.

That does not make the case hopeless. The trail exists at three points: the app store listing and the developer account, the payment gateway that processed the disbursement and the repayment, and the bank accounts that received the money. A complaint that identifies these three points gives the cyber cell something to work with. A complaint that says only that an unknown app is harassing the borrower gives them very little.

What the fraud relies on

The first dependency is shame. The operation assumes the borrower will pay anything to stop the family from seeing the photographs. The moment the borrower tells the family what is happening, the leverage weakens. The second dependency is ignorance of the law. Victims believe that because they took the loan, the collection method is a legitimate recovery. It is not; extortion is extortion regardless of the debt.

The third dependency is silence. A single complaint to the app's own customer care achieves nothing. A complaint to the cyber cell, the RBI and the app store creates a record across three regulators. The fourth dependency is the absence of records. A borrower who deletes the app after the first threatening call destroys the permission history and the chat trail.

What not to do

• Do not pay the inflated amount to stop the calls. Payment confirms that the threats work and often produces a new demand.
• Do not delete the app before capturing the permission list, the loan agreement and the collection chats.
• Do not send a fresh photograph or an identity document to the collection agent to prove who you are.
• Do not borrow from a second app to repay the first. That is the trap the operation is built around.
• Do not stay silent out of shame. Telling your contacts that your data was stolen removes the blackmail value.

When to involve a lawyer

The first calls should be to 1930 and the cybercrime portal. A lawyer becomes necessary when the police treat the matter as a loan dispute, when a morphed image has already been circulated, or when the borrower is a woman or a minor and the threats engage additional provisions. A cyber crime lawyer in Kolkata can draft the complaint so that it names the offences and the evidence rather than describing a debt, apply to the magistrate under section 175(3) of the BNSS, 2023 if the police do not register a case, and seek takedown of the images. Where an accused is arrested in a connected extortion case, the bail stage is where the strength of the complaint record is tested.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Instant loan app fraud: what it is and how it runs
• Trading app scam: what it is and how the fraud runs
• Work From Home Scam: What It Is and How It Runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs
• Net banking fraud: what it is and how it works

Cyber crime lawyer in your city · Bank account freeze help · Contact