The fear is often not the repayment itself. It is that somebody will call your family, circulate an edited photo or message your workplace. Those threats are designed to make you act before checking the claim. The rule is to separate two questions: what money is lawfully owed, and what abuse needs to be reported.
First establish who actually lent the money
An app name is not necessarily the lender’s legal name. Find the loan agreement, Key Facts Statement, disbursal entry and repayment schedule. The regulated lender may be a bank or a non-banking financial company, usually called an NBFC. Independently find its website and complaint contact. Ask it to confirm the loan account, outstanding balance and authorised repayment route.
RBI’s digital lending directions require disclosures and grievance arrangements for regulated digital lending. They also restrict access to phone resources such as contact lists and call logs. These protections are relevant when a regulated lender or its service provider is involved. A criminal app may ignore them, which is why police reporting and bank complaints can be needed together.
| Situation | Illustrative amount | First action | Record to preserve |
|---|---|---|---|
| Loan credited but terms disputed | ₹5,000 received, ₹9,000 demanded | Ask the verified lender for an itemised statement | Bank credit, agreement and demand |
| Money paid to an unknown collector | ₹3,000 transferred | Contact bank and report suspected cyber fraud promptly | UTR, recipient and messages |
| No loan recognised | ₹8,000 demanded by message | Do not accept the claim without verification | Sender, alleged account and threats |
| Contacts or photos misused | No payment needed to report | Preserve evidence and report the abuse | Screenshots, usernames and timestamps |
The table uses fictional amounts to organise the problem; it does not establish whether any particular charge is lawful. If money appeared in your account unexpectedly, leave it untouched and ask the bank to investigate. Do not return it to a new UPI ID supplied by the threatening caller. The destination needs independent verification.
What to do during the first few hours
- Save screenshots of threats, the app listing, its permissions, loan documents and payment instructions. Keep original messages and a written timeline.
- Tell one trusted person what is happening. If contacts are being targeted, explain briefly that abusive messages should be preserved and not paid or forwarded.
- Review app permissions and remove unnecessary access to contacts, media and other sensitive data. Removing access now cannot recall data already copied.
- If you shared passwords, OTPs or screen access, secure the affected accounts from a trusted device and contact your bank.
- Report threats, extortion and image misuse through cybercrime.gov.in or local police. For immediate physical danger, contact police without waiting for a lender’s response.
Preserve available evidence before uninstalling the app, unless keeping it active creates an immediate security problem. Do not send extra identity documents to the harasser to prove your innocence. Submit necessary documents only through a verified lender, bank or official complaint process. A caller’s knowledge of your address or PAN does not prove their authority.
Complain through the right channel
For a genuine regulated loan, send the lender’s grievance officer a concise written complaint. Include the loan account, dates, collector numbers, exact misconduct and the remedy requested. Ask for a statement of dues, an authorised payment channel and an end to abusive contact. Keep the acknowledgement and any reply together with your evidence.
If an eligible complaint is rejected or the reply is unsatisfactory, or there is no reply within 30 days, RBI’s complaint framework may allow escalation through the RBI Complaint Management System. Our Ombudsman guide explains the route. The Ombudsman deals with covered regulated entities; it cannot make every anonymous criminal app a regulated lender.
A repayment check using real bank movements
Consider fictional borrower Kavita. Her account received ₹5,000, she already paid ₹2,000 through the lender’s verified channel, and a new caller demands ₹9,000 to a personal account. She should send the verified lender the disbursal and repayment references and request a reconciliation. Neither the caller’s figure nor subtracting ₹2,000 from ₹5,000 establishes the contractual balance without the actual terms.
If she has already transferred to the caller, she reports that transaction promptly to her bank and 1930, then completes the cybercrime report. She keeps legitimate loan payments and suspected fraud payments in separate rows. The UPI fraud checklist helps capture those references clearly.
What the next thirty days should look like
During the first week, follow up on complaint acknowledgements and document any continuing threats. Over the next weeks, review your credit report for loans you do not recognise and dispute errors with the named lender and bureau. Checking your full credit report explains what to look for. Do not assume uninstalling an app closes a loan or removes a reported account.
There is no dependable date by which threats or investigations will end. Keep your household essentials funded, make a repayment plan only for verified obligations and retain records after closure. Ask for written closure confirmation from the actual lender. A message saying settled from an unfamiliar collector is insufficient evidence that the account is closed.
What to do next
- Preserve threats and documents, then secure affected accounts and permissions.
- Verify the actual lender and request a written statement of dues.
- Report abuse and suspected fraud, keeping every acknowledgement together.
