Loan App & NBFC Recovery Harassment: RBI Rules and Where to Complain

Recovery is allowed. Harassment is not.

If you owe money on a loan, the lender is entitled to remind you and to recover what is due through lawful means. What it is not entitled to do is threaten, abuse, shame or blackmail you. Unfortunately, borrowers of some instant loan apps, and sometimes of NBFCs and banks, report exactly that: dozens of calls a day, abusive language, messages to everyone in their phone contacts, and threats to circulate morphed photos.

This guide explains the rules that apply, how to tell a regulated lender from an illegal app, and the official channels for complaints. If you are being threatened right now, skip to the section on where to complain.

First, find out who actually lent you the money

Most legitimate loan apps are not lenders themselves. They are lending service providers or platforms working with a bank or an RBI-registered NBFC, which is the actual lender (called the regulated entity). Under the RBI's digital lending rules, the name of the regulated entity should be disclosed to you, and your Key Fact Statement and loan agreement should show it.

Check the loan agreement, the Key Fact Statement and the app's website for the lender's name. You can verify whether an NBFC is registered with RBI using the lists published on rbi.org.in. If no regulated lender is named, or the app is not linked to any bank or registered NBFC, you may be dealing with an unregulated or illegal lending operation.

What the RBI Digital Lending Guidelines require

In September 2022, the RBI issued guidelines on digital lending for banks and NBFCs (regulated entities) and the apps and service providers they work with. RBI has since updated and consolidated these rules, so check rbi.org.in for the current text, but the core borrower protections include:

• Loan disbursal and repayment must take place directly between your bank account and the regulated entity's account, without passing through a pool account of the app or a third party.
• You must receive a Key Fact Statement before signing, showing the all-inclusive cost of the loan as an Annual Percentage Rate (APR), and no fees beyond those disclosed can be charged.
• A cooling-off or look-up period during which you can exit the loan by repaying the principal and proportionate APR without penalty.
• Apps must not access your phone resources such as files and media, contact list, call logs or telephony functions. One-time access to the camera, microphone or location may be taken only for onboarding or KYC with your explicit consent.
• The lender and its apps must have a grievance redressal officer whose contact details are displayed, and a complaint must be resolved within the specified period.
• At the time of collection, you should be told which recovery agent or agency has been authorised to contact you.

RBI rules on recovery agents and fair practices

The same RBI recovery rules that apply at a bank branch also apply when the loan came through an app: no threats or public shaming, no calls before 8 AM or after 7 PM, and the lender stays responsible for its agents. The full practical list — and how to complain — is on our recovery agent harassment page. What changes on 1 January 2027 is in RBI recovery agent rules from 2027.

One extra point that comes up often with apps: messaging the people in your phone book to shame you is a clear breach. If a regulated lender's app has taken your contact list, that also breaks the digital lending rules, which prohibit access to contacts.

Collect evidence before you do anything else

Evidence makes every complaint stronger. Start a record today:

• Screenshots of messages, WhatsApp chats and social media posts, showing the number or account and the date.
• Call logs with dates, times and numbers; call recordings where lawful and available.
• Names of any agents who identified themselves, and the agency name.
• Your loan agreement, Key Fact Statement, repayment history and app screenshots showing the lender's name.
• Statements from relatives, friends or colleagues who were contacted.

Where to complain, step by step

Use the channel that matches the problem. You can use more than one at the same time.

• The lender: write to the grievance redressal officer of the bank or NBFC (the regulated entity), not just the app's chat support. Attach your evidence and keep the acknowledgement.
• RBI Ombudsman: if the regulated lender does not reply within 30 days, or rejects or inadequately resolves your complaint, file under the Reserve Bank - Integrated Ombudsman Scheme, 2026 at cms.rbi.org.in. The RBI contact centre number 14448 can help with the process.
• Sachet portal: report unregulated lending apps or entities at sachet.rbi.org.in.
• Cyber police: report threats, extortion, morphed images or circulation of your data at cybercrime.gov.in, or call the national cyber-crime helpline 1930. For immediate danger, call 112.
• Local police: you can also file a complaint at your local police station, particularly for threats, intimidation or defamation.

Keep the loan problem and the harassment problem separate

Complaining about harassment does not cancel a genuine debt to a regulated lender, and paying does not legalise harassment. Address both. For a regulated lender, keep communicating in writing about repayment, restructuring or settlement, while pursuing your complaint about conduct. Our guide on what happens if you don't pay a personal loan explains the lawful recovery process.

For an app with no regulated lender behind it, do not pay ever-increasing demands to unknown accounts under pressure. Report the app on Sachet and to the cyber police, and seek legal advice about any amounts genuinely borrowed. If you do repay, pay only to accounts you can document, and keep proof.

Protect your phone and your data

A few practical steps reduce the damage while complaints are processed:

• Revoke the app's permissions in your phone settings and uninstall apps you no longer use, after saving the evidence you need.
• Warn close contacts that they may receive messages about you and should not engage or pay anyone.
• Change passwords for email and social media accounts, and enable two-factor authentication.
• Do not share OTPs, remote-access apps or KYC documents with anyone claiming to be a recovery agent.

How Debt Support Expert can help

Our recovery pressure support helps borrowers document harassment, write effective complaints to lenders and the RBI Ombudsman, and get the repayment side back under control through restructuring or loan settlement. We also explain your options if an account is already in default. We never collect settlement money.

If you are being harassed, request a free, confidential case assessment. If you face threats to your safety, contact the police first.

How to report loan app harassment, step by step

1. Find the real lender. Apps working for banks or NBFCs must show the lender's name. Check the loan agreement or Key Fact Statement, then check the NBFC on RBI's registered list.

2. Save proof: screenshots, call logs, the app name, UPI IDs or accounts you paid into, and any morphed photos or threats.

3. Report in the right place. Online threats, morphed photos, extortion or stolen money: cybercrime.gov.in or call 1930 (if you call 1930, file the formal complaint on the portal within 24 hours using the SMS acknowledgement number). App or lender not registered: RBI's Sachet portal. Registered bank or NBFC: its grievance officer first, then cms.rbi.org.in if there is no reply in 30 days. Violence or immediate danger: 112.

4. Protect your phone. Remove the app's access to contacts, photos and location, and tell close contacts not to respond to threats.

Do not pay into a new "settlement" link sent by an unknown number, and do not take another app loan to repay the first.