Fake Loan Apps & Advance-Fee Scams: How to Spot Them

When you need money quickly, an app or caller that promises "instant approval, no documents" can feel like relief. Fraudsters count on that. The Reserve Bank of India warned the public in December 2020 about unauthorised digital lending apps and platforms that charge excessive interest and hidden fees, use "high-handed" recovery methods and misuse loan agreements to get at the data on borrowers' phones. Since then RBI has written much of its answer into regulation, and you can use those rules to test any offer you receive.

This guide covers two common patterns (the illegal app and the advance-fee "loan"), the checks that actually tell a genuine lender from a fake one, and what to do, in order, if you have already been caught.

Who is allowed to lend to you

Start here, because it settles most cases. According to RBI, public lending can legitimately be done by:

• banks,
• NBFCs registered with RBI, and
• other entities regulated by state governments under statute, such as the money-lending acts of the state concerned.

An app is usually not the lender. Under RBI's Digital Lending Directions, 2025, most apps are either a lender's own digital lending app (DLA) or are run by a lending service provider (LSP), which acts as the agent of a regulated bank or NBFC. Either way, a regulated lender sits behind every genuine digital loan, and that lender stays "fully responsible and liable" for what its LSP does (para 5.vii). If you can't find out which regulated entity is lending to you, don't go ahead. For a wider summary of these rules, see RBI's digital lending protections.

Scam 1: The advance-fee "loan"

This one usually arrives by call, SMS or WhatsApp rather than through an app. The pattern looks like this:

1. You get an unsolicited offer, often aimed at people who have been turned down elsewhere, promising guaranteed approval with no credit check.
2. You receive a "sanction letter" carrying a real bank's logo.
3. Before disbursement, they ask you to pay something first: a "processing fee", "GST", "insurance", "file charge" or "CIBIL clearance".
4. When you pay, a new fee appears. The loan never arrives.

The tell is the direction the money moves. RBI's rules for digital loans are explicit:

• Loan money goes only into your own bank account, never through a third party or the LSP (Digital Lending Directions, para 9.i).
• Repayments go directly into the lender's bank account, with no "pass-through" or pool account belonging to anyone else (para 9.ii).
• Any fees owed to an LSP are paid by the lender, not collected from you separately by the LSP (para 9.iv).
• Every charge must appear in the Key Facts Statement (KFS) you get before signing. A fee that isn't in the KFS can't be charged at any stage without your explicit consent (RBI KFS circular, April 2024, para 8).

So someone who asks you to send money to a personal UPI ID or an individual's account in order to "release" a loan is going against how regulated lending is supposed to work. Stop the conversation.

Scam 2: The illegal lending app

Illegal apps do disburse money, but they make it back through deductions, very short tenures and harassment. Under RBI's rules, three things set a compliant app apart.

Permissions. RBI requires that DLAs "desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions". The only exception is one-time access to the camera, microphone or location for onboarding or KYC, and only with your explicit consent (para 12.i). An app that won't work until you hand over your contacts or gallery fails that test. You're also entitled to refuse or withdraw consent for specific data uses and to ask for your data to be deleted (para 12.ii).

Paperwork. Once you sign, the KFS, sanction letter, terms and conditions and the privacy policy must reach your registered email or SMS automatically. They must be digitally signed and on the lender's letterhead (para 8.iii). The KFS must include the Annual Percentage Rate (APR), meaning the all-in annual cost including charges, along with a full repayment schedule (KFS circular, paras 3(c) and 6).

A way out. Every digital loan comes with a cooling-off period. In that window you can exit by repaying the principal plus the proportionate APR, with no penalty. Each lender's Board sets the length, but it can't be shorter than one day. The lender may keep a "reasonable one-time processing fee" only if that fee was disclosed in the KFS (para 10).

Why "small" deductions are so expensive (illustration)

This example is illustrative only. It isn't based on any real lender or app.

Say an app "sanctions" ₹10,000 but deducts ₹3,000 as fees, so ₹7,000 reaches your account. It then asks for ₹10,000 back in 7 days.

• Cost of borrowing: ₹10,000 − ₹7,000 = ₹3,000
• Cost as a share of the money you actually received: ₹3,000 ÷ ₹7,000 = 42.9% for one week
• Simple annualised rate (no compounding): 42.86% × 365 ÷ 7 ≈ 2,235% a year

This is exactly why the KFS has to show the APR, which includes all charges, and not only a headline "interest rate". If an app won't show you an APR before you accept, treat that as your answer.

Five checks to run before you accept any online loan

1. Find the lender's name. Get the actual bank or NBFC behind the offer. RBI has required digital lending platforms working for banks and NBFCs to disclose the lender's name upfront (RBI, Dec 2020).
2. Check RBI's DLA directory. From the RBI homepage, go to Citizen's Corner → DLAs deployed by Regulated Entities. Banks and NBFCs report their apps there, and the list exists so you can verify "a DLA's association with a RE" (RBI press release, May 2025). Know its limits: the list is built from what lenders submit, "on as is basis, without any further validation check by the Reserve Bank" (same press release), and being listed doesn't amount to RBI registration, authorisation or endorsement (Directions, para 17.v–vi). Use it to rule apps out, not to vouch for them.
3. Cross-check the lender's own website. A regulated lender must list its digital lending products, its DLAs, the LSPs it uses and what each one does, its grievance-redressal details, and links to RBI's complaint portal and Sachet, all in one prominent place (para 8.iv). If the app you have isn't on that list, be suspicious.
4. Read the KFS before accepting. Look at the APR, every fee, the repayment schedule and the grievance officer's contact details. Contact details for the nodal grievance officers of both the lender and the LSP must appear in the KFS (para 11.ii). For a loan of seven days or longer, the KFS terms stay open to you for at least three working days (KFS circular, para 5), so nobody should be pushing you to decide within minutes. Our guide to reading a sanction letter and KFS goes through each section.
5. Never hand over KYC documents to an unverified app or person. RBI says plainly that consumers "should never share copies of KYC documents with unidentified persons, unverified/unauthorised Apps" (RBI, Dec 2020). For more on this, see our guide on why you should never share OTP, PAN or Aadhaar with a loan agent.

If you've already been targeted: what to do, in order

If you got a suspicious call, SMS or WhatsApp message but haven't lost money, report it on Chakshu on the Department of Telecommunications' Sanchar Saathi portal. DoT asks for reports within 30 days for action. Chakshu isn't meant for reporting money you've already lost.

If you've lost money, move fast:

1. Call 1930 or file at cybercrime.gov.in. The Ministry of Home Affairs runs the 1930 helpline and the National Cyber Crime Reporting Portal. Its Citizen Financial Cyber Fraud Reporting and Management System exists to report financial fraud immediately and "stop siphoning off funds by the fraudsters" (PIB/MHA, March 2025). The sooner you report, the better the chance of stopping the money.
2. Call your own bank to block any card, UPI or net-banking credentials you shared.
3. Report the app or entity on Sachet. RBI asks the public to report unauthorised apps, and the bank accounts linked to them, to law enforcement or through Sachet (RBI, Dec 2020).
4. Revoke the app's permissions, then uninstall it. Keep screenshots of the app, its listing, the payment receipts and the chats first, because you'll need them as evidence.

If the lender is regulated (a real bank or NBFC, or an LSP working for one), complain to the lender's nodal grievance officer first. If they reject your complaint, you're unhappy with the reply, or you hear nothing within 30 days, you can escalate to the RBI Ombudsman (Directions, para 11.iv). The current scheme, the Reserve Bank – Integrated Ombudsman Scheme 2026, took effect on 1 July 2026. You can file online at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the Centralised Receipt and Processing Centre, Reserve Bank of India, Central Vista, Sector 17, Chandigarh – 160017. Filing is free. You must have complained to the lender first, and you need to file within 90 days of the lender's 30-day window ending or of its last reply, whichever is later. RBI's toll-free contact centre, 14448, can explain the process and give you a complaint's status (RBI FAQs on RB-IOS 2026). In short, CMS is for regulated entities, and Sachet plus the police are for unauthorised ones.

If you're being threatened about a loan you did take, the lender has obligations here too. Before a recovery agent contacts you, the lender must tell you by email or SMS who that agent is (para 8.v). See your rights with loan recovery agents.

If high-cost debt is why you were looking

If existing EMIs or card dues are what pushed you towards a quick loan, look at the numbers on regulated options first:

• Compare your current EMIs with a single loan using the EMI savings calculator.
• If one existing personal loan is the expensive one, see how refinancing through a balance transfer works, including the charges on both sides.

---

A note on the rules cited here: On 28 November 2025, RBI moved its regulations into entity-wise consolidated Master Directions "on an 'as-is' basis" (RBI press release). The paragraph numbers above refer to the original Digital Lending Directions (May 2025) and the KFS circular (April 2024), where these rules were first set out.

This article is general information, not legal or financial advice.

If high-cost debt is what you're dealing with, you can send an enquiry. CredLinq is not a lender and can't recover money lost to a scam; we help you understand your options. CredLinq doesn't ask for PAN or Aadhaar. If you choose to apply, the lender will ask for them directly.

How we research this

We write this guide from primary sources only: RBI directions, circulars and press releases, and official government portals. We don't use lender marketing or aggregator sites. Every rule stated above links to the document it comes from. The sources below were re-opened and checked on 23 October 2026.

1. Reserve Bank of India, RBI Cautions against unauthorised Digital Lending Platforms/Mobile Apps, press release 2020-2021/819, 23 Dec 2020. https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=50846 (accessed 2026-10-23)
2. Reserve Bank of India, Reserve Bank of India (Digital Lending) Directions, 2025, RBI/2025-26/36 DOR.STR.REC.19/21.07.001/2025-26, 8 May 2025. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12848 (accessed 2026-10-23)
3. Reserve Bank of India, RBI issues Reserve Bank of India (Digital Lending) Directions, 2025, press release 2025-2026/288, 8 May 2025 (DLA directory). https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=60403 (accessed 2026-10-23)
4. Reserve Bank of India, Key Facts Statement (KFS) for Loans & Advances, RBI/2024-25/18 DOR.STR.REC.13/13.03.00/2024-25, 15 Apr 2024. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12663 (accessed 2026-10-23)
5. Press Information Bureau (Ministry of Home Affairs), Cyber Crime Portal, 12 Mar 2025. https://pib.gov.in/PressReleasePage.aspx?PRID=2110801 (accessed 2026-10-23)
6. Department of Telecommunications, Sanchar Saathi – Chakshu: Report Suspected Fraud Communication. https://sancharsaathi.gov.in/sfc/ (accessed 2026-10-23)
7. Reserve Bank of India, Reserve Bank of India issues Consolidated Master Directions, press release 2025-2026/1588, 28 Nov 2025. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=61705 (accessed 2026-10-23)
8. Reserve Bank of India, FAQs – Reserve Bank – Integrated Ombudsman Scheme, 2026 (updated 1 Jul 2026). https://www.rbi.org.in/commonperson/english/scripts/FAQs.aspx?Id=3407 (accessed 2026-10-23)

We link to Sachet, cybercrime.gov.in and RBI's CMS portal so you can use them; those portals block automated checks, so we confirmed their addresses from the RBI, MHA and DoT documents above. What we say about each one comes from the RBI and Government of India documents listed above.

Last reviewed: 23 October 2026