Ten recovery e-mails, more than 1,250 borrowers exposed

Between 29 May and 12 August 2026, ten recovery e-mails sent by Indian short-tenure lending apps placed the addresses of more than 1,250 borrowers in the open "To" or "Cc" field, where every recipient could read every other name. Over the same period, at least three separate e-mails went to a single borrower's employer. Every figure on this page is taken from the lenders' own sanction letters, Key Facts Statements and recovery e-mails.

The borrower is not named here and never will be. Nor is his employer, his city or his job. The people whose addresses appeared in those ten e-mails are not named either — naming them would simply repeat the disclosure. What follows is the paperwork.

Chronology

Total: 190 + 50 + 80 + 130 + 116 + 295 + 269 + 120 = 1,250. The count includes only the events set out above; the two SalaryBolt e-mails are documented but not counted, so the true figure is higher.

One such approach to an employer, and the regulatory complaint that followed it, is documented separately in a companion account of a lender contacting a borrower's employer.

Update, 18 October 2026: what the Reserve Bank and the companies have since said

After this page was first published, the borrower took his complaints to the Reserve Bank of India's complaint system. Several have been closed. What follows is quoted from the RBI's closure letters and from the companies' own written replies. It records what those documents say and adds nothing to them.

Two RBI findings on contact with the employer (30 September 2026)

Ampire Finance Pvt Ltd (SalarySetu, SnapPaisa, F1SpeedLoan). The RBI's Consumer Education and Protection Cell (CEPC) recorded that the company "has acknowledged contacting the employer as per the loan agreement". It found that "a perusal of the Loan agreement reveals that there are no clauses which permit the RE to contact the employer for requesting assistance in contacting the employee/complainant/borrower or convey its message or to share his contact information. Therefore, the RE is in non-compliance of the agreed terms and conditions of the loan agreement and in non-compliance to extant regulatory guidelines". It recorded that "The action of the RE viz., unauthorized contact of the employer has been forwarded to the Department of Supervision, Central Office, RBI for necessary action". It also recorded the company's statement that "it has ceased further employee communication". Before the closure, on 8 September 2026, the company had written to the borrower, in the names of both SalarySetu and SnapPaisa: "the employer communication was initiated by our collection team".

Naman Finlease Pvt Ltd (Qualoan, Zaylo Loan, Funds Bull, Zepto Finance). The CEPC recorded that "The entity has stated that communication with the employer was undertaken for verification purposes as per loan agreement and has acknowledged the inadvertent disclosure of email addresses to multiple recipients due to human error." It went on: "We observed that the Disclosure clause of the agreement referred by the entity does not permit it to contact the employer and advised it not to contact the employers. We have also referred the matter to the Supervisory Department." In replies to the borrower on 2 September 2026, Qualoan said its e-mail to the employer "was sent solely for verification purposes", and Zaylo Loan said its recovery e-mail "was inadvertently sent with multiple recipients visible in the "To" field due to a human error by the concerned agent."

What other companies said in reply

Shivji Finance and Investments Pvt Ltd (SalaryBolt), 10 September 2026: "the concerned agents marked multiple IDs while sharing loan-related information, resulting in a breach of our data-privacy and confidentiality standards." It said "the concerned agent is no longer associated with SalaryBolt", that it had issued "a formal warning to the concerned collection team leader", and: "We sincerely apologize for the data-privacy and process lapse".

Aman Fincap Ltd (Paisa On Salary), 1 September 2026: "Use of personal email accounts and group emails exposing borrower details was inappropriate." It said collection actions on the borrower's loan account "have been paused pending review".

Agarwal Assignments Pvt Ltd (LoanWithin), 7 October 2026: "We also sincerely apologise for the contents and tone of the subsequent email sent to you." and "Upon receiving communication regarding the matter, we immediately terminated the concerned executive." The RBI closed the complaint on 13 October 2026 on that reply. On 15 October 2026, two days later, a WhatsApp message signed "Loan within" told the borrower: "Our executive will visit your home add office location and also call on your reference No." That message was put to the company in writing on 16 October 2026.

Devmuni Leasing & Finance Ltd (Loan112). Closing the borrower's complaint on 14 October 2026, the CEPC recorded that the company "acknowledged a deviation in the recovery communication dated 23 July 2026 and stated that a warning letter had been issued to the concerned executive."

Two per cent a day, on Loan112's own statement

Loan112's own statement of account, sent to the borrower on 3 October 2026, records:

• a sanctioned principal of Rs 1,20,000;
• a Rs 12,000 processing fee and Rs 2,160 GST deducted, so Rs 1,05,840 was paid out;
• interest of Rs 1,200 a day to the repayment date (Rs 22,800);
• then, for sixty days, both "overdue interest" of Rs 1,200 a day (Rs 72,000) and "penal charges" of Rs 1,200 a day (Rs 72,000).

The total is Rs 2,86,800, which is 2.71 times the sum paid out. The two daily charges together come to 2% of the principal a day, or 730% a year. The company's Key Fact Statement discloses one charge for delayed payment, "Penal charges, if any, in case of delayed payment", at "1% per day", and no "overdue interest". These figures were put to the company in writing on 16 October 2026.

The companies

Ampire Finance Pvt Ltd — SalarySetu, SnapPaisa, F1SpeedLoan

Recorded in the RBI's list of registered NBFCs at Sl. 434. The register also records a former name, "Maulesh Investments", shows the company registered in Ahmedabad while it operates from Delhi, and carries a personal Gmail address as its registered contact.

Its own sanction letter: sanctioned Rs. 85,000; processing fee Rs. 4,250 plus GST at 18% of Rs. 765, so Rs. 5,015 deducted in total; net received Rs. 79,985; single repayment after 39 days; disclosed APR 411.79%.

Conduct on the record: on 16 July 2026 it e-mailed five HR and staff addresses at the borrower's employer. A second written cease-and-desist was served on it on 2 August 2026. On 10 August 2026 it e-mailed five named addresses at that employer disclosing the borrower's employee code, employer, designation and work location, copying both his personal and his work addresses — the second such approach by this company and one of several approaches made to that employer by lenders. The same day it sent a Rs. 99,000 "final reminder" listing, in writing, as consequences of non-payment: "Communication with your employer regarding the pending loan repayment" and "Contacting the references provided by you during the loan application process."

Naman Finlease Pvt Ltd — Qualoan, Zaylo Loan, Funds Bull, Zepto Finance

Sl. 5115, CIN U70101DL1997PTC088735. (Zepto Finance is a brand of Naman Finlease and is unconnected with any other business trading under a similar name.)

Zaylo's own paperwork: sanctioned Rs. 85,000, about Rs. 10,030 deducted, net Rs. 74,970; its own Key Facts Statement discloses an APR of 458.59%; on the sum actually received the cost is 539.04%.

Conduct: 2 June 2026, four addresses at the borrower's employer received an "Employment Verification and Message Forwarding Request". 1 August 2026, a Zaylo recovery e-mail exposed 116-plus addresses. 5 August 2026, a Qualoan recovery e-mail went to approximately 295 borrowers with every address in the open "To" field.

Kasar Credit and Capital Pvt Ltd — Salary On Time

Sl. 3930. Its own Key Facts Statement: sanctioned Rs. 1,00,000; fee Rs. 10,000 plus GST Rs. 1,800, i.e. Rs. 11,800 deducted at source; net Rs. 88,200; repayment Rs. 1,17,000; term 17 days; interest 1% per day; penal interest 2% per day (730% a year). The KFS discloses an APR of 486.67%. On the sum actually received, the cost is 701.08% a year — 214.41 percentage points above the company's own disclosed figure. The KFS names a personal Gmail address as the Nodal Grievance Officer's contact.

Satisfaction Commercial Pvt Ltd — Toofan Loan

Own documentation: sanctioned Rs. 1,15,000; Rs. 10,856 deducted; net Rs. 1,04,144. On 8 June 2026 a recovery e-mail was sent to 269 borrowers with every address visible in the To and Cc fields; one recipient then replied to the whole list, compounding the exposure.

Richman Fincap Ltd — Salary Champion

Sl. 6551. Own documentation: sanctioned Rs. 44,000; Rs. 6,956 deducted; net Rs. 37,044; disclosed APR 503.94%. On 12 August 2026 a recovery e-mail was sent from a personal Gmail account with 120-plus borrower addresses in the open "To" field.

Vanshika Micro Credit — Dhanwalle

Own Key Facts Statement: loan Rs. 76,000; fee Rs. 7,600; net Rs. 68,400; repayment Rs. 1,06,400; term 40 days; 1% per day, penal interest at double that. The KFS prints "Annual Percentage Rate 365.00" — which is 1% × 365 and excludes the fee deducted. On the sum received, the cost is 506.94% a year. The KFS states no loan account number at all. On 27 July 2026, between 13:20 and 14:48, one recipient received 45 calls from two numbers associated with the brand; six were answered and the caller used abusive language.

Subhlakshmi Finance, Squid Loans, SalaryBolt

Documented here for their mass-disclosure e-mails only: Subhlakshmi, roughly 190 addresses on 29 May 2026; Squid, roughly 50 on 28 June and roughly 80 on 11 July; SalaryBolt on 6 and 10 July, the second followed by a fellow borrower replying to the entire list.

How the arithmetic works

Take the Kasar Credit and Capital loan, using only figures printed on its own Key Facts Statement.

1. Sanctioned: Rs. 1,00,000.
2. Deducted before any money moved: fee Rs. 10,000, plus GST on that fee of Rs. 1,800 — Rs. 11,800. Note what the second line means: the tax on the charge levied against the borrower is itself paid out of the borrower's money. He funds the tax on his own fee.
3. Actually credited: Rs. 88,200.
4. Repayable: Rs. 1,17,000, in 17 days.
5. Cost of the credit: 1,17,000 − 88,200 = Rs. 28,800.
6. As a proportion of the sum received: 28,800 ÷ 88,200 = 0.326531, i.e. 32.65% for 17 days.
7. Annualised: 0.326531 × (365 ÷ 17) = 0.326531 × 21.470588 = 7.010787 → 701.08% a year.

The company's own disclosed figure is 486.67%. The gap arises because the disclosed rate is worked on the sanctioned amount, and the borrower never had the sanctioned amount. This is simple annualisation — the conservative basis; compounding would produce a higher number. The same method applied to Vanshika Micro Credit's own figures gives 506.94% against a printed "365.00", and to Zaylo's gives 539.04% against a printed 458.59%.

What the rules actually say

RBI Direction RBI/DOR/2025-26/362. Chapter III-A, Paragraph 9 deals with confidentiality of borrower information. Paragraphs 98 to 100 govern recovery conduct, including contact with third parties. Chapter III-B, Paragraph 29 requires the all-inclusive annual percentage rate — every charge, not the headline interest alone — to be disclosed in the Key Facts Statement.

Section 72A, Information Technology Act 2000 covers disclosure of personal information in breach of a lawful contract, and carries imprisonment of up to three years.

CERT-In Directions of 28 April 2022 require certain cyber incidents to be reported within six hours. Whether any company here did or did not report is not knowable from the outside, and nothing on this page asserts either way.

There is no public portal yet for complaints to the Data Protection Board. Do not send complaints there; use the channels listed on this page.

If this happened to you

Preserve first, complain second. Once a lender is contacted, material has a way of disappearing.

• Do not reply to all. Replying to a mass e-mail republishes every address on it, including your own.
• Save the original e-mail as a file, with full headers, not as a screenshot. A .eml or .msg export preserves the routing information; an image does not.
• Record the exact date, time, sender address and the number of recipients visible.
• Keep call logs with numbers, timestamps and duration; keep recordings if your handset makes them lawfully.
• Do not uninstall the app before you have exported your statements and Key Facts Statement.

Then use the official channels only: cybercrime.gov.in, cms.rbi.org.in, sachet.rbi.org.in, and incident@cert-in.org.in.

FAQ

Are these companies registered? Where a serial number is given above — Ampire Sl. 434, Naman Finlease Sl. 5115, Kasar Sl. 3930, Richman Fincap Sl. 6551 — it is because the entry was found in the RBI's own published list. Where no serial is given, nothing is asserted either way. Registration status is a matter for the Reserve Bank alone.

Is a rate of 701% unlawful? That is not for this page to decide. What the record shows is a gap between a company's own disclosed APR and the cost of the money actually received. The disclosure obligation sits in Chapter III-B, Paragraph 29 of RBI/DOR/2025-26/362.

Can a lender write to my employer? Recovery conduct and third-party contact are governed by Paragraphs 98 to 100 of the same Direction, and confidentiality by Chapter III-A, Paragraph 9. Read them and judge the e-mails against them. In two complaints closed on 30 September 2026, the Reserve Bank of India's Consumer Education and Protection Cell recorded that Ampire Finance's loan agreement had no clause permitting it to contact the borrower's employer, and that the clause Naman Finlease relied on did not permit it to contact the employer. See the update of 18 October 2026 on this page.

My address was in one of these e-mails. Preserve the original with headers, do not reply-all, and use the four channels above. This page will not name you.

Can I complain to the Data Protection Board? Not yet. There is no public portal for complaints to the Board.

What changed, 18 October 2026. Removed a sentence about the borrower's employment and corrected a statement about the Data Protection Board. Replaced 'the fourth made to that employer by any lender' with 'one of several approaches made to that employer by lenders', and 'three separate e-mails' with 'at least three': records reviewed after 13 August show more approaches than this page first counted, so all counts here are minimums as at 13 August 2026. Added the update of 18 October 2026, and revised the no-adjudication note to reflect the RBI closure letters it quotes.

Right of reply

Any company named on this page may write to us with a correction, a clarification or a statement of its position. Where a factual error is demonstrated, it will be corrected and the correction noted with its date. Where a company disputes a characterisation, its response will be published alongside the material in full and unedited.

No adjudication

Except for the Reserve Bank of India closure letters quoted in the update of 18 October 2026, no court, tribunal, ombudsman or regulator has adjudicated any of the conduct described on this page. Those letters are quoted exactly and are not characterised further. Every other figure is drawn from a lender's own sanction letter, Key Facts Statement, statement of account, recovery e-mail or written reply; every event is stated with its date. Nothing here alleges any offence, and no statement should be read as a finding against any company or person beyond what the quoted RBI letters themselves record.