Scam guide · Loan apps
Instant loan app harassment: how to check a loan app and what to do
By Aman Gupta, 12+ years in cyber security · Updated 7 October 2026
The short answer
A genuine lender needs your identity and bank details, not your contact list or photo gallery. Avoid loan apps that ask for contacts, photos or SMS, check that the lender is a bank or an RBI-registered NBFC, and if you are being harassed, do not pay extortion demands: keep screenshots, report at cybercrime.gov.in or on 1930, and tell your local police.
Why the permissions matter
Predatory instant-loan apps give a small loan, add huge charges, and when the borrower struggles, message their family, friends and employer, sometimes with edited photos. They can only do that because the app was given access to the contact list and photos when it was installed. A lender deciding whether to lend has no use for your contacts.
Before you install a loan app
- Install only from Google Play, and read the developer name and the company behind it.
- Find the lender's name in the app and check it is a bank or an RBI-registered NBFC (the RBI website lists them). An app that does not name a regulated lender is a warning.
- Refuse contacts, photos, files and SMS permissions. If the app will not work without them, do not use it.
- Read the total repayment, not just the loan amount. Very short tenures with large "processing fees" are the pattern.
If you are being harassed
- Do not pay extortion demands. Paying usually leads to more demands.
- Keep screenshots of messages, numbers and the app details.
- Report at cybercrime.gov.in or call 1930, and file a complaint at your local police station.
- Report unregulated lenders on the RBI's Sachet portal, and report the app on Google Play.
- Remove the app's permissions in Settings → Apps → Permissions, then uninstall it.
- Tell family and close contacts first, so a threatening message does not reach them as a surprise.
If the stress is too much, talk to someone you trust today. You are not alone in this, and it is the lender who is breaking the law.
Where SecureOne helps, and where it can't
SecureOne's loan app check lists lending apps on your phone that hold contacts, photos or SMS access. It cannot check whether a lender is registered with the RBI. SecureOnes Privacy advisor also shows which apps on your phone hold your contacts, photos, camera and location.
Get SecureOne for Android · See every feature and its limits
Quick answers
How do I know if a loan app is RBI approved?
Find the name of the lender inside the app and check that it is a bank or an NBFC registered with the RBI. An app that does not name a regulated lender is a warning sign.
A loan app is messaging my contacts. What should I do?
Do not pay extortion demands. Keep screenshots, report at cybercrime.gov.in or on 1930, file a police complaint, remove the app's permissions and uninstall it, and warn close contacts.
Why does a loan app ask for my contacts?
A lender does not need your contacts to decide on a loan. Predatory apps take them to pressure you through your family and colleagues later.
Lost money to a scam? Call 1930 (National Cyber Crime Helpline) and report at cybercrime.gov.in as soon as you can.