Ten recovery e-mails, more than 1,250 borrowers exposed

Between 29 May and 12 August 2026, ten recovery e-mails sent by Indian short-tenure lending apps placed the addresses of more than 1,250 borrowers in the open "To" or "Cc" field, where every recipient could read every other name. Over the same period, three separate e-mails went to a single borrower's employer. Every figure on this page is taken from the lenders' own sanction letters, Key Facts Statements and recovery e-mails.

The borrower is not named here and never will be. Nor is his employer, his city or his job. The people whose addresses appeared in those ten e-mails are not named either — naming them would simply repeat the disclosure. What follows is the paperwork.

Chronology

Total: 190 + 50 + 80 + 130 + 116 + 295 + 269 + 120 = 1,250. The count includes only the events set out above; the two SalaryBolt e-mails are documented but not counted, so the true figure is higher.

One such approach to an employer, and the regulatory complaint that followed it, is documented separately in a companion account of a lender contacting a borrower's employer.

The companies

Ampire Finance Pvt Ltd — SalarySetu, SnapPaisa, F1SpeedLoan

Recorded in the RBI's list of registered NBFCs at Sl. 434. The register also records a former name, "Maulesh Investments", shows the company registered in Ahmedabad while it operates from Delhi, and carries a personal Gmail address as its registered contact.

Its own sanction letter: sanctioned Rs. 85,000; processing fee Rs. 4,250 plus GST at 18% of Rs. 765, so Rs. 5,015 deducted in total; net received Rs. 79,985; single repayment after 39 days; disclosed APR 411.79%.

Conduct on the record: on 16 July 2026 it e-mailed five HR and staff addresses at the borrower's employer. A second written cease-and-desist was served on it on 2 August 2026. On 10 August 2026 it e-mailed five named addresses at that employer disclosing the borrower's employee code, employer, designation and work location, copying both his personal and his work addresses — the second such approach by this company and, on the borrower's record, the fourth made to that employer by any lender. The same day it sent a Rs. 99,000 "final reminder" listing, in writing, as consequences of non-payment: "Communication with your employer regarding the pending loan repayment" and "Contacting the references provided by you during the loan application process."

The sequence, stated without inference: the e-mails above were sent on those dates. The borrower whose employer received them was later asked to leave his job. No court or regulator has determined that the two are connected, and this page asserts no connection.

Naman Finlease Pvt Ltd — Qualoan, Zaylo Loan, Funds Bull, Zepto Finance

Sl. 5115, CIN U70101DL1997PTC088735. (Zepto Finance is a brand of Naman Finlease and is unconnected with any other business trading under a similar name.)

Zaylo's own paperwork: sanctioned Rs. 85,000, about Rs. 10,030 deducted, net Rs. 74,970; its own Key Facts Statement discloses an APR of 458.59%; on the sum actually received the cost is 539.04%.

Conduct: 2 June 2026, four addresses at the borrower's employer received an "Employment Verification and Message Forwarding Request". 1 August 2026, a Zaylo recovery e-mail exposed 116-plus addresses. 5 August 2026, a Qualoan recovery e-mail went to approximately 295 borrowers with every address in the open "To" field.

Kasar Credit and Capital Pvt Ltd — Salary On Time

Sl. 3930. Its own Key Facts Statement: sanctioned Rs. 1,00,000; fee Rs. 10,000 plus GST Rs. 1,800, i.e. Rs. 11,800 deducted at source; net Rs. 88,200; repayment Rs. 1,17,000; term 17 days; interest 1% per day; penal interest 2% per day (730% a year). The KFS discloses an APR of 486.67%. On the sum actually received, the cost is 701.08% a year — 214.41 percentage points above the company's own disclosed figure. The KFS names a personal Gmail address as the Nodal Grievance Officer's contact.

Satisfaction Commercial Pvt Ltd — Toofan Loan

Own documentation: sanctioned Rs. 1,15,000; Rs. 10,856 deducted; net Rs. 1,04,144. On 8 June 2026 a recovery e-mail was sent to 269 borrowers with every address visible in the To and Cc fields; one recipient then replied to the whole list, compounding the exposure.

Richman Fincap Ltd — Salary Champion

Sl. 6551. Own documentation: sanctioned Rs. 44,000; Rs. 6,956 deducted; net Rs. 37,044; disclosed APR 503.94%. On 12 August 2026 a recovery e-mail was sent from a personal Gmail account with 120-plus borrower addresses in the open "To" field.

Vanshika Micro Credit — Dhanwalle

Own Key Facts Statement: loan Rs. 76,000; fee Rs. 7,600; net Rs. 68,400; repayment Rs. 1,06,400; term 40 days; 1% per day, penal interest at double that. The KFS prints "Annual Percentage Rate 365.00" — which is 1% × 365 and excludes the fee deducted. On the sum received, the cost is 506.94% a year. The KFS states no loan account number at all. On 27 July 2026, between 13:20 and 14:48, one recipient received 45 calls from two numbers associated with the brand; six were answered and the caller used abusive language.

Subhlakshmi Finance, Squid Loans, SalaryBolt

Documented here for their mass-disclosure e-mails only: Subhlakshmi, roughly 190 addresses on 29 May 2026; Squid, roughly 50 on 28 June and roughly 80 on 11 July; SalaryBolt on 6 and 10 July, the second followed by a fellow borrower replying to the entire list.

How the arithmetic works

Take the Kasar Credit and Capital loan, using only figures printed on its own Key Facts Statement.

1. Sanctioned: Rs. 1,00,000.
2. Deducted before any money moved: fee Rs. 10,000, plus GST on that fee of Rs. 1,800 — Rs. 11,800. Note what the second line means: the tax on the charge levied against the borrower is itself paid out of the borrower's money. He funds the tax on his own fee.
3. Actually credited: Rs. 88,200.
4. Repayable: Rs. 1,17,000, in 17 days.
5. Cost of the credit: 1,17,000 − 88,200 = Rs. 28,800.
6. As a proportion of the sum received: 28,800 ÷ 88,200 = 0.326531, i.e. 32.65% for 17 days.
7. Annualised: 0.326531 × (365 ÷ 17) = 0.326531 × 21.470588 = 7.010787 → 701.08% a year.

The company's own disclosed figure is 486.67%. The gap arises because the disclosed rate is worked on the sanctioned amount, and the borrower never had the sanctioned amount. This is simple annualisation — the conservative basis; compounding would produce a higher number. The same method applied to Vanshika Micro Credit's own figures gives 506.94% against a printed "365.00", and to Zaylo's gives 539.04% against a printed 458.59%.

What the rules actually say

RBI Direction RBI/DOR/2025-26/362. Chapter III-A, Paragraph 9 deals with confidentiality of borrower information. Paragraphs 98 to 100 govern recovery conduct, including contact with third parties. Chapter III-B, Paragraph 29 requires the all-inclusive annual percentage rate — every charge, not the headline interest alone — to be disclosed in the Key Facts Statement.

Section 72A, Information Technology Act 2000 covers disclosure of personal information in breach of a lawful contract, and carries imprisonment of up to three years.

CERT-In Directions of 28 April 2022 require certain cyber incidents to be reported within six hours. Whether any company here did or did not report is not knowable from the outside, and nothing on this page asserts either way.

The Digital Personal Data Protection Act 2023 is not in force and no Data Protection Board has been constituted. Do not send complaints there; there is nowhere to send them.

If this happened to you

Preserve first, complain second. Once a lender is contacted, material has a way of disappearing.

• Do not reply to all. Replying to a mass e-mail republishes every address on it, including your own.
• Save the original e-mail as a file, with full headers, not as a screenshot. A .eml or .msg export preserves the routing information; an image does not.
• Record the exact date, time, sender address and the number of recipients visible.
• Keep call logs with numbers, timestamps and duration; keep recordings if your handset makes them lawfully.
• Do not uninstall the app before you have exported your statements and Key Facts Statement.

Then use the official channels only: cybercrime.gov.in, cms.rbi.org.in, sachet.rbi.org.in, and incident@cert-in.org.in.

FAQ

Are these companies registered? Where a serial number is given above — Ampire Sl. 434, Naman Finlease Sl. 5115, Kasar Sl. 3930, Richman Fincap Sl. 6551 — it is because the entry was found in the RBI's own published list. Where no serial is given, nothing is asserted either way. Registration status is a matter for the Reserve Bank alone.

Is a rate of 701% unlawful? That is not for this page to decide. What the record shows is a gap between a company's own disclosed APR and the cost of the money actually received. The disclosure obligation sits in Chapter III-B, Paragraph 29 of RBI/DOR/2025-26/362.

Can a lender write to my employer? Recovery conduct and third-party contact are governed by Paragraphs 98 to 100 of the same Direction, and confidentiality by Chapter III-A, Paragraph 9. Read them and judge the e-mails against them.

My address was in one of these e-mails. Preserve the original with headers, do not reply-all, and use the four channels above. This page will not name you.

Can I complain to the Data Protection Board? No. It does not exist yet.

Right of reply

Any company named on this page may write to us with a correction, a clarification or a statement of its position. Where a factual error is demonstrated, it will be corrected and the correction noted with its date. Where a company disputes a characterisation, its response will be published alongside the material in full and unedited.

No adjudication

No court, tribunal, ombudsman or regulator has adjudicated any of the conduct described on this page. Every figure is drawn from a lender's own sanction letter, Key Facts Statement or recovery e-mail; every event is stated with its date. Nothing here alleges any offence, and no statement should be read as a finding against any company or person.