Loan App Harassment in Hyderabad: What to Do and the Law
Instant loan apps can turn recovery into harassment: repeated abusive calls, messages to everyone in your contact list, morphed photos, and threats to shame you in front of family and colleagues. Some people are chased for loans they never applied for. This guide explains how the harassment usually works, what to do first in Hyderabad, how to check whether the lender is regulated, what the Reserve Bank of India’s rules say about recovery and your phone data, how to ask a platform to remove morphed images, and which laws apply.
How it works · What to do first · Is the lender regulated? · RBI rules on recovery and data · Complaining to the lender and the RBI · Morphed photos · The criminal law · Police complaint · Data protection law · The loan itself
How loan app harassment usually works
The Telangana Cyber Security Bureau describes “Loan Frauds” in these terms: people are sent a link to a loan application that claims to check their eligibility; they check but do not apply; their contacts and photo gallery are compromised; and they are then given loans they never asked for and harassed to repay within seven days. The Bureau warns that fake loan apps and unregistered lenders collect the contacts, location and photos on your phone, and warns that women’s photos can be converted into pornographic images and sent to family, friends and relatives.
In a written reply in the Rajya Sabha on 21 July 2026, the Ministry of Finance stated that the Ministry of Electronics and IT had by then blocked 87 illegal loan lending apps under section 69A of the Information Technology Act, 2000.
What to do first
- Keep the evidence. Take screenshots of the app, its name and developer, the loan screens, call logs, messages, threats, any morphed images, the numbers used, and every payment you made with its UPI or transaction reference. Ask the people in your contact list who received messages to send you screenshots. Keep these before you uninstall the app or block numbers.
- Report it. Call the national helpline 1930 or report on the National Cyber Crime Reporting Portal, cybercrime.gov.in. The Ministry of Finance has told Parliament that these were set up to report cyber incidents “including fake/illegal loan apps”.
- Contact Hyderabad police directly if you prefer. The Hyderabad City Cyber Crimes Police Station, Central Crime Station Building, Old Commissioner Office, Baseerbagh, lists “Loan Frauds” among the crimes it deals with and gives a 24/7 phone and WhatsApp number, 87126 66346. Its page asks people who have lost less than Rs 1 lakh in a cyber fraud to go to their local police station.
- Check whether the lender is regulated (see the next section). This decides which RBI rules and complaint routes apply.
- If morphed or intimate images have been posted, complain to the platform at the same time (see Morphed photos).
- Tell the people who matter. A short message to family and close colleagues that messages from the app are not from you, and that they should not engage with it, can limit the damage.
If the harassment is affecting your health or you are having thoughts of harming yourself, speak to someone you trust or a doctor today.
Is the lender regulated?
The RBI has said that lending to the public is legitimately done by banks, non-banking financial companies (NBFCs) registered with the RBI, and other entities regulated by State Governments under statutes such as the money lending laws of the States. It has advised the public to verify the antecedents of any firm lending online or through an app, never to share KYC documents with unverified apps, and to report such apps to law enforcement or through its Sachet portal (sachet.rbi.org.in) (RBI caution as relayed by the Press Information Bureau on 26 August 2021).
- RBI list of apps: the RBI website carries a directory, “DLA’s deployed by Regulated Entities”, which the Ministry of Finance says has been live since 1 July 2025. The RBI said when announcing it (press release of 8 May 2025) that the list is published “for the limited purpose of aiding the customers in verifying the claim of a DLA’s association with a RE”, on an “as is” basis and without further checks. Lenders report their apps themselves, and the RBI does not verify or validate the data. Appearing on the list is not RBI registration, authorisation or endorsement of the app.
- RBI list of NBFCs: the RBI publishes a list of NBFCs registered with it and a separate list of NBFCs whose registration has been cancelled.
- The lender’s own website: an NBFC must list on its website its digital lending apps, the lending service providers it uses and their apps, and its grievance contacts, and each app must link back to that website (Credit Facilities Directions, para 9(4) and (5)).
The RBI rules described below apply to most categories of RBI-registered NBFC. The NBFC must ensure that the apps and lending service providers it uses comply with the Credit Facilities Directions, and that a lending service provider acting as its recovery agent complies with the applicable Responsible Business Conduct Directions (Credit Facilities Directions, para 6(5) and (6)). They do not apply to a State-licensed money lender or to a lender that is not regulated at all, and the RBI Ombudsman Scheme does not cover services outside the RBI’s regulatory purview. The police complaint route applies either way.
What the RBI rules say about recovery and your phone data
The RBI’s Digital Lending Guidelines of 2022 and its Digital Lending Directions of May 2025 have both been withdrawn. For loans from an NBFC, the rules are now in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies: Credit Facilities) Directions, 2025, and in the Reserve Bank of India (Non-Banking Financial Companies: Responsible Business Conduct) Directions, 2025, both issued on 28 November 2025 and since updated. Banks have separate Directions of their own, which are not summarised here.
- Your contacts and photos: the NBFC must ensure that its app does not access phone resources “like file and media, contact list, call logs, telephony functions, etc.”. One-time access to the camera, microphone or location is allowed only for on-boarding or KYC, with your explicit consent. Data collection must be need-based and with prior, explicit consent (Credit Facilities Directions, para 13(1)).
- Sharing your data: your explicit consent is needed before personal information is shared with any third party, unless a law or regulation requires it. You must be given the option to refuse consent for specific data, to revoke consent, and, where required, to have the data deleted (para 13(2) and (4)).
- No harassment in recovery: an NBFC must ensure that neither it nor its agents resort to intimidation or harassment of any kind, verbal or physical, against any person in debt collection, “including acts intended to humiliate publicly or intrude upon the privacy of the debtors’ family members, referees and friends, sending inappropriate messages either on mobile or through social media, making threatening and/ or anonymous calls, persistently calling the borrower and/ or calling the borrower before 8:00 a.m. and after 7:00 p.m. for recovery of overdue loans, making false and misleading representations, etc.” (Responsible Business Conduct Directions, para 100). For microfinance loans, a separate list applies, including no calls before 9 a.m. or after 6 p.m. and no harassment of relatives, friends or co-workers (para 91).
- Recovery agents must be named first: when a recovery agent is assigned to a digital loan in default, or changed, the agent’s details must be sent to you by email or SMS before the agent contacts you (Credit Facilities Directions, para 9(6)).
- The lender answers for the app: an outsourcing arrangement does not reduce the NBFC’s obligations; it “shall remain fully responsible and liable for all acts and omissions” of the lending service provider (para 6(7)).
- Money flows: the loan must be paid into your bank account and repayments must go directly to the NBFC’s account, not to a pool account of a third party; the service provider’s fees are paid by the NBFC, not collected from you (para 10).
- Cooling-off period: you must be given an option to exit a digital loan during a cooling-off period of not less than one day by paying the principal and the proportionate annual percentage rate, without penalty; the NBFC may keep a reasonable one-time processing fee, which must be disclosed upfront in the Key Fact Statement (para 11).
- Key Fact Statement: the NBFC must give you a Key Fact Statement, and the signed loan documents must be sent automatically to your registered email or by SMS when the loan is executed (para 9(1) and (3)).
Complaining to the lender and to the RBI
- Lender’s grievance officer: the NBFC, and any lending service provider dealing with you, must have a nodal grievance redressal officer for digital lending complaints, with contact details on its website, in the app and in the Key Fact Statement (Credit Facilities Directions, para 12). Complain in writing or by another mode you can prove, and keep a copy: the Ombudsman Scheme accepts a complaint only if you first complained to the lender in that way (clause 10(1)(e)).
- RBI: if your complaint is rejected wholly or partly, you are not satisfied, or there is no reply within 30 days, you can complain on the RBI’s portal, cms.rbi.org.in, under the Reserve Bank Integrated Ombudsman Scheme “(as applicable)”, or by post to the Centralised Receipt and Processing Centre, 4th Floor, Reserve Bank of India, Sector 17, Central Vista, Chandigarh 160017 (para 12(4)).
- Which NBFCs the Ombudsman covers: the Reserve Bank Integrated Ombudsman Scheme, 2026 has applied since 1 July 2026. According to the text of the Scheme, it covers NBFCs that are authorised to accept deposits, and NBFCs with a customer interface and assets of Rs 100 crore or more as on the date of the audited balance sheet of the previous financial year, with some categories excluded. A small NBFC may fall outside it.
- Time limit: under the 2026 Scheme, the complaint must be made to the Ombudsman within 90 days from the end of the 30-day period or from the date of the lender’s last communication, whichever is later. The Scheme does not allow a complaint to be filed through an advocate unless the advocate is the person aggrieved.
- Unregulated apps: the Scheme does not cover services outside the RBI’s regulatory purview. For an unregistered lender, the routes described in this guide are the police, 1930 and cybercrime.gov.in.
Morphed photos and messages to your contacts
Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in February 2026:
- Two-hour deadline to act: on a complaint by you, or by anyone on your behalf, about content that exposes your private area, shows you in full or partial nudity or in a sexual act, or is in the nature of impersonation in electronic form, “including artificially morphed images”, the platform must take all reasonable and practicable measures to remove or disable access to it within two hours (rule 3(2)(b)).
- Grievance officer: a complaint to the platform’s grievance officer must be acknowledged within 24 hours and resolved within seven days. A request to remove content that is, among other things, obscene, invasive of bodily privacy or impersonating another person is to be resolved within 36 hours (rule 3(2)(a)(i) and its first proviso).
- Appeal: you can appeal to the Grievance Appellate Committee within 30 days (rule 3A(3)); the Committee works online.
These rules apply to intermediaries, including platforms and messaging services, and rule 3(2)(b) covers such content hosted, stored, published or transmitted by the intermediary. Report messages sent to your contacts to the police as well.
The criminal law that may apply
Which offences apply depends on the facts: what was said or sent, whether money was demanded or paid, whether images were morphed or shared, and the victim’s gender. The main provisions, with what the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) First Schedule says about each:
| Provision | What it covers | Maximum punishment | Police power |
|---|---|---|---|
| BNS s.308(2), extortion | putting a person in fear of injury, which includes harm to reputation (s.2(14)), and thereby dishonestly inducing them to deliver money or property | 7 years, or fine, or both | cognizable, non-bailable |
| BNS s.308(3) | putting or attempting to put a person in fear of injury in order to commit extortion | 2 years, or fine, or both | cognizable, bailable |
| BNS s.351, criminal intimidation | threatening injury to a person, their reputation or property, or to someone they are interested in, to cause alarm or make them do something they are not legally bound to do | 2 years, or fine, or both; up to 7 years for a threat to cause death or grievous hurt or to impute unchastity to a woman (s.351(3)); up to 2 years more for an anonymous threat (s.351(4)) | non-cognizable, bailable |
| BNS s.356, defamation | making or publishing an imputation about a person, by words, signs or visible representations, intending to harm, or knowing or having reason to believe it will harm, their reputation | simple imprisonment up to 2 years, or fine, or both, or community service | non-cognizable, bailable |
| BNS s.79 | words, sounds, gestures or objects intended to insult the modesty of a woman, or intruding on her privacy | simple imprisonment up to 3 years and fine | cognizable, bailable |
| BNS s.336(4), forgery for harming reputation | making a false document or false electronic record intending it to harm a person’s reputation | 3 years and fine | cognizable, bailable |
| BNS s.319, cheating by personation | cheating by pretending to be another person | 5 years, or fine, or both | cognizable, bailable |
| IT Act s.66E | capturing, publishing or transmitting an image of the private area of any person without consent, in circumstances violating privacy | 3 years, or fine up to Rs 2 lakh, or both | cognizable, bailable (IT Act s.77B) |
| IT Act s.67 | publishing or transmitting obscene material in electronic form | 3 years and fine up to Rs 5 lakh (first conviction) | cognizable, bailable (IT Act s.77B) |
| IT Act s.66D | cheating by personation using a communication device or computer resource | 3 years and fine up to Rs 1 lakh | cognizable, bailable (IT Act s.77B) |
Section 66E of the IT Act is limited to images showing a private area, which the section defines. Section 72A of the IT Act (disclosing personal information in breach of a lawful contract) is no longer a criminal offence: since 30 November 2023, under the Jan Vishwas (Amendment of Provisions) Act, 2023, it carries a penalty of up to Rs 25 lakh. Separately, accessing a computer or copying data from it without permission can give rise to a claim for compensation under section 43 of the IT Act, and doing so dishonestly or fraudulently is an offence under section 66.
Abetment of suicide is a separate offence under BNS section 108, punishable with up to 10 years and fine.
Filing a police complaint
- Any police station (zero FIR): information about a cognizable offence can be given at a police station irrespective of where the offence was committed, orally or by electronic communication (BNSS section 173(1)).
- Online information: information given electronically is taken on record once the informant signs it within three days (section 173(1)(ii)).
- Woman officer: where a woman gives information about an offence under BNS section 79, among others, it is to be recorded by a woman police officer or any woman officer (first proviso to section 173(1)).
- Free copy: the informant or victim is to be given a copy of the FIR free of cost (section 173(2)).
- Preliminary enquiry: for cognizable offences punishable with three years or more but less than seven years, the officer in charge may, with prior permission from an officer not below the rank of Deputy Superintendent of Police, hold a preliminary enquiry within 14 days to ascertain whether there is a prima facie case for proceeding (section 173(3)).
- If the police refuse: send the substance of the information in writing and by post to the Superintendent of Police concerned (section 173(4)); in a commissionerate such as Hyderabad, written representations can also be made to the officers above the Station House Officer, from the Assistant and Deputy Commissioners of Police up to the Commissioner of Police and the Director General of Police. If that does not result in action, an application supported by an affidavit can be made to a Magistrate (sections 173(4) and 175(3)).
Criminal intimidation under BNS section 351 and defamation under section 356 are non-cognizable. Where these are the only offences, the police enter the information and refer the informant to the Magistrate, and cannot investigate without a Magistrate’s order (BNSS section 174(1) and (2)). Where a case involves two or more offences and at least one is cognizable, the whole case is deemed cognizable (section 174(4)).
Data protection law: what is in force
The Digital Personal Data Protection Act, 2023 is being brought into force in stages under a notification of 13 November 2025 (G.S.R. 843(E)). The provisions on consent (section 6, apart from sub-section (9), which follows one year after the notification), the duties of those who handle personal data (section 8), the rights of individuals (sections 11 to 14) and the penalties (section 33) are appointed to come into force eighteen months after that notification. Until they commence, section 43A of the IT Act, which provides for compensation where a body corporate is negligent in protecting sensitive personal data, continues to apply.
The loan itself
Harassment by recovery agents and the amount you owe are separate questions. Harassment does not cancel a loan you actually took, and that loan still has to be paid back. Interest charged at a rate that is unusual compared with what is conventional in India is a different matter. What is owed depends on the loan agreement, the Key Fact Statement and what was actually paid out and repaid. An NBFC may recall a loan only in line with the loan agreement (Responsible Business Conduct Directions, para 16). Take advice on your own loan before paying an amount you dispute, or refusing to pay.
If you never applied for a loan and money was put into your account without a request, keep the bank statement showing the credit, do not use or spend that money, and include the statement in your complaint. The Telangana Cyber Security Bureau describes this as part of the pattern of loan fraud. If you installed the app or checked your eligibility without applying, or have already used some of the money, take advice on your own position.
Related guides: cyber crime, sextortion, fake profiles and online defamation, the first 48 hours after cyber fraud and bank account frozen in a cyber complaint.
Frequently asked questions
What should I do first if a loan app is harassing me?
Keep screenshots of the app, the loan screens, calls, messages, threats and payments, and ask your contacts for screenshots of anything sent to them. Report on 1930 or cybercrime.gov.in, or to the Hyderabad City Cyber Crimes Police Station (phone and WhatsApp 87126 66346, 24/7; its page asks people who lost less than Rs 1 lakh in a cyber fraud to go to their local police station), and check whether the lender is a bank or an RBI-registered NBFC.
Can a loan app send messages to my contacts?
For loans from an RBI-regulated NBFC, the RBI Directions say the app must not access your contact list, files, media or call logs, and that the NBFC and its agents must not harass anyone in debt collection, including intruding on the privacy of the borrower’s family, referees and friends or sending inappropriate messages on mobile or social media.
At what times can a recovery agent call me?
For NBFC loans other than microfinance loans, the RBI Directions list calling a borrower before 8 a.m. or after 7 p.m. for recovery of overdue loans as harassment, along with persistent calls and threatening or anonymous calls. For NBFC microfinance loans, persistent calls and calls before 9 a.m. or after 6 p.m. are listed as harsh recovery methods. Banks have separate Directions.
How do I check whether a loan app is linked to an RBI-regulated lender?
The RBI publishes a directory of apps based on what regulated lenders report. It does not verify that data, and a listing is not RBI registration, authorisation or endorsement of the app. Check that the lender named in the app is a bank or appears on the RBI’s list of registered NBFCs, and that the lender’s own website lists the app.
Can I complain to the RBI Ombudsman about a loan app?
Only if the lender is covered by the Reserve Bank Integrated Ombudsman Scheme, 2026. For NBFCs this means, broadly, NBFCs authorised to accept deposits and those with a customer interface and assets of Rs 100 crore or more. You must first complain to the lender in writing or by another mode you can prove. If the lender rejects it, you are not satisfied with the reply, or there is no reply within 30 days, the complaint must be made to the Ombudsman within 90 days of the end of that 30-day period or of the lender’s last communication, whichever is later. An unregistered lender is not covered.
How quickly must a platform act on a morphed photo of me?
Under rule 3(2)(b) of the IT Rules, 2021, as amended in February 2026, on a complaint by you or someone on your behalf, the platform must take all reasonable and practicable measures to remove or disable access to impersonating content, including artificially morphed images, within two hours.
Is threatening to shame a borrower a crime?
It may be, depending on the facts. Threatening harm to a person’s reputation, with intent to cause alarm or to make them do something they are not legally bound to do, can be criminal intimidation under BNS section 351, and intentionally putting a person in fear of injury and thereby dishonestly inducing them to hand over money can be extortion under section 308. Criminal intimidation on its own is non-cognizable, which affects how the police can act.
Does harassment mean I no longer have to repay the loan?
Not for a loan you actually took. Harassment does not cancel that loan, and it still has to be paid back. Interest charged at a rate that is unusual compared with what is conventional in India is a different matter. What is owed depends on the loan agreement and what was actually paid out and repaid. Take advice on your own loan before paying a disputed amount or refusing to pay. If you never applied for a loan and money was put into your account, do not use or spend that money, keep the bank statement showing the credit, and take advice on your own position.
For a discussion about a loan app matter with Musab Hashmi & Associates, call +91 89771 24916 or send an enquiry. Do not send images, identity numbers, bank details or copies of documents in the first message.
General legal information, not legal advice. Checked on 27 October 2026 against the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Nagarik Suraksha Sanhita, 2023 and its First Schedule, the Information Technology Act, 2000 as amended, the Jan Vishwas (Amendment of Provisions) Act, 2023, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 in the Ministry of Electronics and IT’s consolidated text (updated as on 10 February 2026), the Digital Personal Data Protection Act, 2023 and the commencement notification G.S.R. 843(E), the Reserve Bank of India (Non-Banking Financial Companies: Credit Facilities) Directions, 2025 and (Responsible Business Conduct) Directions, 2025, the Reserve Bank Integrated Ombudsman Scheme, 2026, RBI and Ministry of Finance releases, and the official pages of the Telangana Cyber Security Bureau and the Hyderabad City Cyber Crimes Police Station.