How to Spot an Illegal Loan App in India: The Red Flags That Matter

An illegal loan app is one that puts money in your hands without a regulated entity — a bank or an RBI-registered NBFC — behind it, and it almost always announces itself before the cash arrives. The signatures are consistent: no named lender, no Key Fact Statement, a demand for your contact list and photo gallery, a fee payable upfront, and a tiny loan repayable in days rather than months. Both decisive checks — who is lending, and what the app wants to read on your phone — can be done before you install anything.

What makes a loan app illegal in India?

Not the app itself. Lending is a regulated activity, so the question is always whether a regulated entity is the lender. A lawful digital loan has a bank or an NBFC as the lender of record; the app is at most a service provider acting for it, and it must disclose which one. An illegal operation skips that, and everything else follows from the one missing fact: no supervision, no grievance officer, no ombudsman route, and no rule about how you may be contacted.

How do you check who is actually lending?

Before you fill anything in, look for these:

1. The name of the regulated entity, stated in the app or on its website. Not a brand name — a legal entity.
2. Whether that entity appears on the RBI's own registers of banks and NBFCs. A name that is not on a register is not a lender.
3. A Key Fact Statement before the agreement, with the all-in APR, every charge, the schedule, the cooling-off period and a named grievance officer.
4. A real registered address and working phone line, not only an email address and a chat window.
5. A privacy policy saying what data is collected and who it is shared with.

A lawful lender passes all five easily, because all five are requirements rather than courtesies. The regulator publishes the rules and the registers at the official Reserve Bank of India website, which is where a name should be verified.

Which permissions are the clearest warning sign?

Permissions are where the intent shows. Under RBI's digital lending rules, data collection must be need-based and with explicit prior consent, and a lending app has no business reading your contact list, call logs, SMS inbox, stored files or photo gallery. Camera, microphone and location access should be one-time and tied to a stated purpose such as KYC. So when an app insists on contacts and gallery access before it will show you a loan, understand what it is buying: the contact list is the collection department, and the gallery is the material for humiliating you later.

What do the money mechanics of a scam look like?

Three mechanics recur:

• An upfront payment before disbursal. Any request to pay a processing, verification or release fee in order to receive your loan is an advance-fee scam: a lawful fee is disclosed in the KFS and deducted from the disbursal, never transferred by you first.
• A deduction that was never disclosed. Approved Rs 5,000, credited Rs 3,500, repayable Rs 6,000 in seven days. That is Rs 2,500 on the Rs 3,500 you actually received, more than 70 percent of the cash in a single week. No lawful APR looks like that, which is why there is no KFS.
• Money that does not come from a bank or NBFC. Disbursal must move directly from the regulated lender's account to yours. Cash arriving from a wallet or an individual's account means the lender is not who they say.

To see what a legitimate version of the same loan should cost, run your figures through the (Paisa Boxx) Loan App Pointer app, an independent, unofficial calculator and guide: it is not a lender, it does not offer loans, and it cannot be used to apply for one.

What does the pressure stage look like?

Illegal apps are built around a very short tenor, because the business is the rollover rather than the interest. Expect a loan due in seven to fifteen days and an offer to extend for another fee. Then, the moment a payment is late, the contact list you surrendered becomes the leverage: messages to relatives and colleagues, calls through the night, abusive language, morphed photographs, threats of police action. None of that is debt collection and none of it is lawful.

What should you do before you install anything?

• Read the permissions on the Play listing first, and walk away from contacts, SMS and gallery requests.
• Find the regulated entity's legal name and check it against the RBI registers yourself.
• Ask for the KFS before you apply, and keep a copy.
• Never pay anything in order to receive a loan, and never share an OTP, your Aadhaar or PAN details, your bank credentials or a card number with an app, a caller or a link.

What if you have already borrowed from one?

Revoke the permissions you granted, particularly contacts and storage. Screenshot the app, the agreement, the disbursal and every demand: the record is your protection. Keep repayments traceable through your bank account rather than a private wallet. Complain in writing to the lender where a regulated entity really is involved, and report the operation to the regulator where it is not. Threats, abuse and misuse of your photographs are police matters, including through the national cybercrime channels.

Frequently asked questions

Is an app on Google Play automatically legitimate?

No. Store policies help, and illegal apps are removed when found, but presence in a store is not a licence to lend. The test remains whether a named regulated entity is the lender.

They have my contacts. Should I pay to make it stop?

Paying an unlawful demand usually buys a bigger one, because it proves the pressure works. Preserve the evidence, repay only what is genuinely owed and only traceably, and report the threats. Do not borrow from a second app to clear the first.

Can I tell from the cost alone whether an app is illegal?

An extreme cost is strong evidence, but the decisive tests are structural: no regulated lender named, no KFS, an upfront fee, or money flowing through a private account. Any one of those four is enough to walk away.

The decision that protects you is made before you install: find out who the lender is, and look at what the app wants to read on your phone. If there is no regulated entity and no Key Fact Statement, there is no loan worth taking, however fast the money moves. To price a genuine offer instead, the independent, unofficial app on Google Play calculates the EMI and the all-in cost offline. It is not a government app, it is not affiliated with, endorsed by, sponsored by, or connected to the Reserve Bank of India or any government agency, ministry or department, and it does not represent any government entity. It does not offer loans and cannot be used to apply for a loan, and it cannot check a status or access any account.