India's instant-credit boom has a dark twin: thousands of unregistered loan apps that lend small amounts fast, then extract many times the principal through hidden fees, impossible deadlines, and harassment — calling your contacts, morphing photos, threatening arrest. Knowing the rules legitimate lenders must follow is your best defence, because fakes break them immediately.
What every legal lending app must do (RBI Digital Lending Directions)
- Name the actual lender. Apps are often just fronts (LSPs); the money must come from an RBI-regulated bank or NBFC whose name appears in your agreement and the app's disclosures.
- Give you a Key Facts Statement (KFS) before disbursal, stating the all-inclusive annual cost (APR), all fees, and the recovery agent's details format.
- Disburse to your bank account directly — not via wallets or third parties — and collect repayments the same way.
- Offer a cooling-off period during which you can exit by repaying principal plus proportionate charges.
- Provide a grievance officer and escalate to the RBI Ombudsman if unresolved for 30 days.
- Not touch your phone data. Legal apps may need camera/mic for KYC, and location — but blanket access to your contacts, photos and call logs is prohibited.
Red flags that expose a fake in 60 seconds
- It demands contacts and gallery access to proceed. Instant disqualifier — that access exists to harass you later.
- No lender name anywhere. Search the app's pages for the NBFC/bank behind it. Can't find one? Walk away.
- Fees before disbursal. "Processing fee" or "GST" demanded via UPI before you receive the loan is the classic advance-fee scam.
- Sideloaded APK or a link from WhatsApp/SMS. Legitimate lenders distribute through official app stores.
- Absurd terms. Seven-day tenures, daily penalties, or an APR nobody will state plainly.
- No physical address, no grievance officer, no privacy policy — regulated entities must publish all three.
If you're already caught
Don't pay harassment-priority: an illegal lender's threats don't create a legal debt beyond what a court would enforce. Preserve evidence (screenshots, call recordings), block and report the numbers, complain on the National Cyber Crime portal (cybercrime.gov.in or 1930), and inform your local police. Do not hand over more money to "close the file" — that's the same scam's second act.
Find safe lenders →
Frequently asked questions
How do I check if a loan app is RBI approved?
RBI doesn't approve apps directly — it regulates the lender behind the app. Find the bank/NBFC named in the app's disclosures and verify it on RBI's published list of registered NBFCs at rbi.org.in. No named lender means illegal.
Can a loan app access my contacts legally?
No. Under RBI's digital lending rules, lending apps cannot take blanket access to your contact list, call logs or gallery. An app that requires contacts permission to give you a loan is breaking the rules — and will likely use it for harassment.
What should I do if a loan app is threatening me?
Preserve screenshots and recordings, block the numbers, report at cybercrime.gov.in or call 1930, and file a complaint with local police. If the lender is RBI-regulated, complain to its grievance officer and escalate to the RBI Ombudsman.
Do I have to repay an illegal loan app?
You're liable for what you actually borrowed under general law, but not for extortionate charges invented through threats. Take guidance from police/legal aid rather than negotiating with harassers, and never pay extra fees to 'settle'.
Solvifin is a loan-comparison and referral platform, not a lender. This guide is general information, not financial advice — final rates, eligibility and approval are always decided by the lender. RBI rules summarised here are simplified; refer to rbi.org.in for the authoritative text.