Loan App Fraud: RBI Digital Lending Rules and How to Stay Safe

"Instant loan in 5 minutes, no documents, no CIBIL check." Messages like this reach millions of phones every day. Some come from genuine lenders. Many do not. Fake loan apps have trapped borrowers with hidden charges, harassment and threats. This guide explains how loan app fraud works, what the RBI digital lending rules require from genuine lenders, and what to do if you have been targeted.

How fake loan apps typically work

1. The bait: an ad, SMS or WhatsApp message promising instant money with no checks.
2. Excessive permissions: the app asks for access to your contacts, photos, location and messages.
3. A small, expensive loan: the amount credited is far less than promised after hidden "fees", and repayment is due in days.
4. Harassment: if you are late, or even when you are not, recovery agents call your contacts, send morphed photos or make threats.
5. The debt trap: the borrower is pushed to take another app loan to repay the first.

Another common scam is the advance-fee fraud: a caller promises a large loan but asks you to first pay a "processing fee", "insurance", "GST" or "file charge". Once you pay, the loan never arrives.

What RBI's digital lending rules require

The Reserve Bank of India has issued guidelines for digital lending by banks, NBFCs and other regulated entities. Key protections for borrowers include:

• Loans must come from a regulated entity, such as a bank or an RBI-registered NBFC. The app must name the lender.
• Money goes straight to your bank account, and repayments go directly to the lender, not through a third party's personal account.
• A Key Fact Statement (KFS) must be given before you sign, showing the annual percentage rate (APR), all fees and the repayment schedule.
• No hidden charges: fees not mentioned in the KFS cannot be charged.
• A cooling-off period, during which you can exit the loan by repaying the principal and the proportionate APR, without a penalty.
• Consent-based data use: apps should collect only the data needed and with your explicit consent, and should not access contacts or photos for recovery.
• A grievance officer must be named, with a way to complain.

Rules are updated from time to time, so check the RBI website for the latest guidelines.

Red flags of a fake loan app or agent

• It does not name a bank or RBI-registered NBFC as the lender
• It asks for an upfront payment before disbursal
• It promises guaranteed approval regardless of credit score
• No Key Fact Statement, or the rate is not disclosed in writing
• It asks for access to contacts, photo gallery or SMS
• Repayment is to be made to a personal bank account or UPI ID
• Very short tenures, such as 7 days, with very high effective cost
• The app is not on an official app store, or was shared as a file link
• Pressure to decide immediately

How to check whether a lender is genuine

• Find the lender's name in the app, KFS or loan agreement.
• Check RBI's lists: RBI publishes lists of registered NBFCs, and has also started publishing a directory of digital lending apps reported by regulated entities. Look the lender up on the official RBI website.
• Visit the lender's official website and see whether the app or partner is listed there.
• Look for a physical address and a grievance officer.
• Read the KFS before accepting and check the APR. Our guide on comparing loan offers using APR can help.

Protect yourself

• Never share OTPs, UPI PINs, net banking passwords or card CVVs
• Do not install apps from links in SMS or WhatsApp messages
• Deny contact, photo and SMS permissions to loan apps
• Never pay an advance fee to "release" a loan
• Keep screenshots of all messages, payments and app screens
• Borrow from your own bank or a known, regulated lender first

If you have been targeted: what to do

1. Do not pay more money to the fraudster to "settle" or stop threats.
2. Report cyber fraud immediately on the national cybercrime helpline 1930 or at cybercrime.gov.in, especially if money was taken from your account.
3. Inform your bank and ask it to block any suspicious mandates or transactions.
4. Report the app to the app store, and report unregistered lending activity on RBI's Sachet portal.
5. File a police complaint if you face threats or harassment, with your screenshots as evidence.
6. Complain to the lender's grievance officer if a regulated lender is involved; if not resolved, you can approach the RBI Ombudsman.
7. Tell your contacts to ignore messages from recovery agents.

Frequently asked questions

Are all instant loan apps fake?

No. Many banks and regulated NBFCs offer genuine digital loans. The test is whether the lender is regulated, the KFS is clear and there are no advance fees.

Can a genuine lender ask for a processing fee?

Yes, but it is disclosed in the KFS and usually deducted from the loan amount at disbursal. It is never collected in advance into a personal account.

How can EzyLoan help?

EzyLoan works only with RBI-regulated partner banks and NBFCs and never asks for an advance fee. We help you compare genuine personal loan options. Learn more about how a loan DSA works, or visit our lending partners page.

This article is general information, not legal advice. Check the RBI website for the latest rules. EzyLoan is a loan facilitator (DSA), not a lender.