Personal Loan Fraud & Safety Checklist
Spot fake loan apps and agents, check a lender is RBI-regulated, and report fraud fast.
Updated 29 September 2026 · 8 lenders trackedWhat you need to know
Loan fraud usually follows one of three patterns: fake “pre-approved” offers that demand an upfront fee, illegal apps that lend without proper KYC and then harass borrowers, and identity theft using your KYC. RBI’s 2025 rules make legitimate lending traceable — use them to check every offer.
Checklist before you borrow
- Is the lender an RBI-regulated bank or NBFC? Check RBI’s website and its directory of lenders’ digital lending apps.
- Does the app show the lender’s name, the KFS and a grievance officer?
- Is the money coming directly from the lender’s account to yours?
- Has anyone asked for a fee, “insurance” or GST to be paid upfront to an individual or UPI ID? Stop — genuine lenders deduct fees from the loan or charge them via the KFS.
- Does the app want access to contacts, photos or call logs? Legitimate apps may not.
- Are you being pressured to decide immediately?
Digital lending rules
| Rule | What it means for you |
|---|---|
| Who can lend | Only RBI-regulated banks and NBFCs, directly or through their disclosed lending service providers (LSPs) and apps. RBI publishes a directory of lenders’ digital lending apps. |
| Money flow | Disbursal and repayment must go directly between your bank account and the lender’s — never through an agent’s or app’s pool account. |
| Key Facts Statement | Must be given before you sign, with APR and all charges. |
| Cooling-off period | At least 1 day for every digital loan: exit by repaying principal + proportionate APR, with no penalty (a disclosed one-time processing fee may be retained). |
| Multiple offers | Apps that tie up with several lenders must show all matching offers with APR and KFS, unbiased (from 1 Nov 2025). |
| Your data | Apps may collect only what is needed, with your explicit consent; they must not access your contacts, photos or call logs. |
| Complaints | Every lender and app must name a grievance officer; if unresolved in 30 days, go to the RBI Integrated Ombudsman at cms.rbi.org.in. |
Red flags: loans with no KYC or credit check, “processing” or “insurance” fees paid upfront to an individual, pressure to decide instantly, threats or calls to your contacts. Report cyber fraud at cybercrime.gov.in or call 1930.
If you are targeted
- Stop payingDo not send more money or share OTPs.
- Report cyber fraudcybercrime.gov.in or helpline 1930 — as fast as possible to freeze funds.
- Report the entityRBI’s Sachet portal (sachet.rbi.org.in) for unauthorised lenders.
- Complain about a regulated lenderLender’s grievance officer first, then the RBI Integrated Ombudsman at cms.rbi.org.in.
- Protect your creditCheck all four bureau reports for loans you did not take.
Frequently asked questions
A lender is harassing my contacts. What can I do?
Legitimate lenders may not access your contacts, and recovery must follow RBI’s code. File a police / cyber complaint (1930, cybercrime.gov.in) and report the app on Sachet.
For information and comparison only. Loan terms, rates and rules change — confirm with the lender and read the Key Facts Statement before borrowing.