A lender can ask you to repay. It can call you, send reminders, and in the end take you to court or report the default to credit bureaus. It cannot threaten you, abuse you, message your contacts, or put your photo on a “defaulter” poster on WhatsApp. When a loan app or recovery agent does that, it is breaking RBI’s rules and, often, the criminal law.
Loan app harassment usually comes from one of two places. Some apps are run by or for a bank or RBI-registered NBFC, and are bound by RBI’s rules. Others are illegal apps with no licence at all, and the “loan” is a trap for extortion. The complaint route depends on which one you are dealing with, but in both cases you can go to the police.
First, find out whether the app is legal
RBI-regulated lenders must report the apps they use to RBI, and RBI has published a directory of these digital lending apps on its website since 1 July 2025. Search for the app’s name and check which bank or NBFC it names. RBI does not verify these entries itself, so also check that the lender’s name shown inside the app matches.
If the app is not listed, and the lender is not a bank or RBI-registered NBFC, treat it as an unregulated lender. Many harassment cases involve apps of this kind.
What RBI’s rules require of regulated lenders
RBI’s Digital Lending Directions, 2025, issued on 8 May 2025, apply to banks and NBFCs that lend through apps and to the service providers they use. Among other things:
- The loan must be paid straight into your bank account, and repayment goes to the lender, not to some third party’s account.
- You must get a Key Fact Statement showing the full cost of the loan before you sign.
- Before a recovery agent contacts you, the lender must tell you the agent’s details by SMS or email.
- Lending apps are not supposed to access your contact list, call logs, photos or files. Access to the camera, microphone or location is allowed only for limited purposes like onboarding and KYC, with your consent.
- The lender is responsible for what its agents and service providers do.
On recovery conduct, RBI told banks, NBFCs and other lenders in August 2022 that they and their agents must not intimidate or harass borrowers in any way, verbally or physically, must not make threatening or anonymous calls, and must not call before 8 am or after 7 pm. RBI has been tightening these recovery rules further in 2026.
What recovery agents are not allowed to do
Putting the rules and the criminal law together, an agent crosses the line when they:
- call your relatives, friends, colleagues or employer to shame you
- threaten violence, arrest, or “police action” that they have no power to take
- use abusive or sexual language, especially towards women
- send morphed or obscene photos of you, or threaten to
- call at night or keep calling dozens of times a day
- come to your home or office and create a scene
Offences that may apply
The Bharatiya Nyaya Sanhita (BNS) replaced the IPC from 1 July 2024. Depending on what was said and done, these may apply:
| Conduct | Provision |
|---|---|
| Threats of harm to you, your family or reputation | Section 351 BNS, criminal intimidation (old Section 506 IPC) |
| Demanding money by putting you in fear | Section 308 BNS, extortion (old Sections 383 and 384 IPC) |
| Messages to your contacts calling you a thief or fraud | Section 356 BNS, defamation (old Sections 499 and 500 IPC) |
| Words or messages insulting a woman’s modesty | Section 79 BNS (old Section 509 IPC) |
| Sending or posting morphed or obscene images | Section 67 of the Information Technology Act, along with BNS offences |
Defamation is usually taken up on a private complaint before the magistrate rather than an FIR. Intimidation, extortion and offences involving obscene images are matters for the police.
Karnataka’s law on coercive recovery
In 2025 Karnataka passed the Karnataka Micro Loan and Small Loan (Prevention of Coercive Actions) Act, 2025. It covers lenders operating in Karnataka that are not regulated by RBI, including moneylenders, unregistered microfinance outfits and lending platforms. They must register in their district and are barred from coercive recovery. If an unregistered lender or app is harassing you in Karnataka, mention this Act in your complaint.
Where to complain
You can use more than one of these at the same time.
- Police. File a complaint at your local police station or a CEN police station in Bengaluru, and on the cyber crime portal, cybercrime.gov.in, under the option for other cyber crimes. Attach screenshots, call recordings and the call log. If the station will not register an FIR, see when the police refuse to file an FIR.
- The lender. If the app is linked to a bank or NBFC, complain in writing to that lender’s grievance officer. Their details must be shown on the app and website.
- The RBI Ombudsman. If a regulated lender does not respond within 30 days or rejects your complaint, file on cms.rbi.org.in.
- Sachet. For lenders and apps that are not registered with RBI, report them on RBI’s Sachet portal (sachet.rbi.org.in), which handles complaints about unregistered entities. This helps get them shut down, though it will not stop the calls by itself.
Our guide to filing a cyber crime complaint in Bengaluru covers the police complaint in more detail.
What to do right now
- Do not pay more to an illegal app to “settle” a threat. With extortion apps, paying usually leads to more demands.
- Stop the app’s access to your contacts and files in your phone settings, then uninstall it. Keep screenshots first.
- Warn close family and colleagues that they may get messages, so the messages lose their power.
- If you did borrow from a legal lender, keep repaying what you genuinely owe, or ask for a restructuring in writing. Harassment does not cancel the loan, but it is a separate wrong you can act on.
- If anyone feels unsafe or overwhelmed, speak to someone today. Threats made to drive a person to despair are taken seriously by the police and courts.
Questions people ask
Can a loan app message my contacts?
No. RBI’s rules say lending apps should not access your contact list, and calling your contacts to shame you can be defamation and intimidation. Report it to the police and to the lender.
Can a recovery agent come to my house?
A regulated lender’s agent may contact you about the loan, after the lender has told you who the agent is. They cannot threaten you, abuse you, or harass your family. If they do, you can file a police complaint.
Where do I complain about loan app harassment?
To the police and on cybercrime.gov.in, to the lender’s grievance officer, to the RBI Ombudsman for regulated lenders, and on the Sachet portal for unregistered ones.
Do I still have to repay the loan if the agent harassed me?
If the loan is from a legal lender, the debt usually remains. Harassment is a separate offence you can complain about. With illegal extortion apps, get advice before paying anything more. Our cyber crime lawyer page explains how we help.
Talk to us about your matter
Call or WhatsApp to fix a time. Bring your papers to the office in Rajarajeshwari Nagar.
This article is general information about the law as it stood when it was written. Your facts change the answer. Speak to an advocate before you act on it.