How to tell a legal loan app from an illegal one — in about two minutes

Last updated 29 July 2026.

The short answer

A legal loan app is operated by, or for, an entity the Reserve Bank of India regulates — a bank or an NBFC holding a certificate of registration. You verify it by finding the operating company’s name in the loan agreement or Key Facts Statement and searching the RBI’s own published list for that name. Not the app’s brand. Not the Play Store listing. The company.

The Government of India has blocked 87 illegal loan-lending applications (MeitY, section 69A IT Act) and the RBI has issued repeated public advisories about them. But the harm does not stop at unlicensed apps: the pages in this record show what some registered companies put in their own paperwork too. So the useful question is not “is this app on a list somewhere” — it is whether a regulated entity is genuinely behind it, and whether the terms were disclosed to you before you took the money.

A legal loan app versus an illegal one

These are the requirements the RBI’s Digital Lending Directions and Fair Practices Code place on regulated lenders, set against what borrowers report from apps that follow none of them.

What to check	A lender following the rules	The pattern borrowers report
Who is lending	Names the bank or RBI-registered NBFC in the agreement and Key Facts Statement	Names no regulated entity, or only a brand and a website
Key Facts Statement	Given before you borrow, stating the all-inclusive APR, every fee, and the total repayable	Absent, shown only after disbursal, or the rate differs from what was advertised
Where the money goes	Disbursed to, and repaid from, your own bank account — no pass-through wallet	Routed through a third-party wallet or an individual's account
Fees	Disclosed upfront; nothing is demanded before disbursal	An advance, processing or “verification” fee demanded before the money arrives
Permissions	Need-based only, with explicit consent; no contacts, gallery or media access	Demands contacts, gallery, SMS or always-on location before disbursing
Tenure	Clear tenure with a cooling-off period during which you can exit by repaying principal and proportionate charges	Days-long tenure, automatic rollovers, and no exit
Recovery	Contact with you alone, 8 a.m. to 7 p.m., by lawful means	Calls to your employer, family and contact list; threats; public shaming
Grievance route	A named grievance officer, and escalation to the RBI Ombudsman	No grievance officer, no address, or a contact that does not respond

Ten warning signs

1It will not tell you which bank or registered NBFC is actually lending the money.
2It asks for your contact list, photo gallery or SMS access before it will disburse.
3A fee is demanded before the loan arrives — a genuine lender deducts disclosed charges from the disbursal or bills them, and never asks you to pay first to “unlock” a loan.
4The interest is quoted per day rather than as an annual rate, and no Key Facts Statement is given.
5The amount that reaches your account is smaller than the amount you are told you owe, with no explanation given in writing.
6The app or website publishes no registered company name, no CIN, and no verifiable address.
7The tenure is a few days or weeks, with an offer to “roll over” instead of close.
8You are pushed to accept within minutes, or told an offer expires today.
9The repayment is to a wallet, a UPI ID or an individual — not a company bank account.
10Recovery messages arrive before the due date, or mention your employer, family or contacts.

How to verify any loan app yourself

1
Find the company name, not the brand
Open the loan agreement, the Key Facts Statement or the app's own “About”/“Terms” page and find the legal name of the company — something ending in Private Limited, Limited, or similar. The app's brand name is marketing; the company is the thing that is regulated.
2
Search the RBI's own list
On its Non-Banking Financial Companies page, the Reserve Bank of India publishes the “List of NBFCs and ARCs registered with the RBI” and, separately, the “List of NBFCs and ARCs whose CoR has been cancelled by the RBI”. There is no search box: download the spreadsheet and use your device's find function on the company name. If a company describes itself to you as an NBFC, ask in writing for its certificate of registration number and check that number against the list.
3
Check the company exists on the MCA register
The Ministry of Corporate Affairs register shows a company's CIN, incorporation date, registered office and filing history. Search the company name, not the brand — brand names do not appear on the register. Trading under a brand name is common and lawful; it simply means you must search the company.
4
Read the Key Facts Statement before you accept
It must state the amount disbursed, the all-inclusive Annual Percentage Rate, every fee, the total repayable, and the grievance contact. If you cannot see one before you borrow, stop there.
5
Check what the app is asking to read
In your phone's app settings, look at the permissions requested. Contacts, gallery, media and always-on location have no place in a lending decision.

Already installed one? Do this now

1Revoke the app's permissions in your phone settings — contacts, storage, photos, camera, microphone and location — before anything else.
2Uninstall the app. That does not cancel a genuine debt, but it stops further collection from your device.
3Do not pay anyone who contacts you privately offering to “settle” or “remove your name”. That is a separate fraud that targets people already under pressure.
4Screenshot everything, dated: the app's own pages, the Key Facts Statement, the disbursal credit in your bank statement, and every call log and message.
5Change the passwords on any account whose one-time passwords may have passed through the device, and check your bank statements.
6Report it — the routes are below. If there are threats, blackmail or your images or contacts have been misused, that is a police matter, and 1930 is staffed for it.

And the thing worth saying plainly: being unable to repay a loan is not a crime. It is a civil matter. You cannot be jailed simply for being unable to pay, and anyone threatening you with arrest over a defaulted loan is applying unlawful pressure. If it has reached the point where you cannot see a way out, talk to someone today — Tele-MANAS, 14416, is free and open around the clock.

How do I know if a loan app is legal in India?

A legal loan app must be operated by, or on behalf of, an entity regulated by the Reserve Bank of India — a bank, or an NBFC holding a certificate of registration. Search the RBI's published list of registered NBFCs for the OPERATING COMPANY's name, which appears in the loan agreement and Key Facts Statement, not the app's brand name. Brand names do not appear on the RBI list. If the app cannot tell you which regulated entity is lending you the money, that is the answer.

What permissions should a real loan app never ask for?

Under the RBI's Digital Lending Directions, a lending app may collect only need-based data with your explicit consent. It has no legitimate need for your full contact list, your photo gallery, your media files, or continuous location. An app that demands access to your contacts or gallery before it will disburse money is collecting the means to pressure you through the people you know.

Is it illegal for a loan app to charge very high interest?

The RBI does not cap interest rates for most NBFCs, so a high rate is not by itself unlawful. What the RBI does require is disclosure: the all-inclusive Annual Percentage Rate must be stated in a Key Facts Statement given to you before you borrow. Charges never disclosed in that statement, and interest charged on money deducted upfront that you never received, can be disputed.

I already installed a loan app. What should I do right now?

Revoke its permissions in your phone's settings — contacts, storage, camera, microphone, location — then uninstall it. Removing the app does not cancel a real debt, so keep every document. Take dated screenshots of the app's own pages, its Key Facts Statement, and every message or call log. If your data has been misused or you have been threatened, report it at cybercrime.gov.in or call 1930.

Can a loan app publish my photo or message my contacts?

No. The RBI Fair Practices Code bars a lender and its recovery agents from contacting your employer, family, friends or references, or disclosing your debt to them, and bars abuse, threats and public shaming. Morphed images, messages to your contact list and public humiliation can also cross into criminal territory. Preserve the evidence and report it at cybercrime.gov.in or on 1930.

Does an app being on the Play Store mean it is RBI approved?

No. App-store presence is not regulatory approval, and the RBI does not approve apps at all. Legitimacy flows through the regulated entity behind the app — the bank or registered NBFC that actually lends the money. An app calling itself “RBI approved” or “RBI registered” is describing something that does not exist.

Where to report a loan app

• RBI Sachet — sachet.rbi.org.in — to report an entity or an unlawful lending practice.
• RBI Complaint Management System — cms.rbi.org.in — the RBI Ombudsman, through the Centralised Receipt and Processing Centre (CRPC), after first raising the complaint with the lender’s grievance officer and allowing 30 days.
• National Cyber Crime Reporting Portal — cybercrime.gov.in — or helpline 1930 — for threats, abuse, data exposure or misuse of phone data.
• Consumer commission — file online through e-Jagriti (the portal that replaced e-Daakhil) — for deficiency in service or an unfair trade practice.
• Check the lender yourself — the RBI publishes the list of NBFCs and ARCs registered with it, and a separate list of those whose certificate of registration has been cancelled. Search by the operating company’s name, not the app brand.
• Free government legal aid — NALSA / SLSA / DLSA, your right under Article 39A. How to apply.

Step-by-step, with what to write and what to attach: how to report a loan app and escalate it.

Corrections and right of reply

Every page quoted here was read on 29 July 2026. Any company named on this page may write to grievance@loantrap.org.

If any company named on this page tells us that a statement here is inaccurate, we will check it against our source, and where we are wrong we will correct or remove it and publish the correction on this page with equal prominence, within 7 days.

Grievance Officer (IT Rules 2021): grievance@loantrap.org — complaints acknowledged within 24 hours and disposed of within 15 days.

About this page

This page is public-interest reporting from primary documents. Quotations are reproduced as read on the stated date; websites change. Nothing on this page is legal or financial advice.

Nothing on this page is an allegation that any company or person named has committed an offence. Where a matter is described as alleged, it is an allegation only and has not been established. Where a company does not appear on a public register, there may be lawful explanations, and this page makes no finding either way.

The name of this site describes the subject it covers — problem borrowing and its consequences. It is not a statement about any company named on this page.

Last updated and what changed

Last updated 29 July 2026. Quoted pages read on 29 July 2026.

• 29 July 2026 — Page published.