By Adv. K J Muhammed Aslam · Advocate, Ernakulam (Bar Council of Kerala)
A loan app that accesses your contacts, downloads your gallery, morphs a photo, then threatens to send it to your family on WhatsApp unless you pay — and a recovery agent who calls before 8 a.m., after 7 p.m., or posts in your social feed — is not a civil recovery. Under the RBI Guidelines on Digital Lending (02 Sep 2022) consolidated into the Reserve Bank of India (Digital Lending) Directions, 2025 (08 May 2025, DOR.STR.REC.19/21.07.001/2025-26) read with the RBI Outsourcing circular on Recovery Agents (12 Aug 2022), plus Sections 66C, 66D, 66E, 67 of the IT Act and Sections 308, 351, 78, 336 BNS, that conduct is harassment, is prohibited, and has a defined complaint route.
What do the RBI digital lending rules actually require?
The framework distinguishes Regulated Entities (REs) — banks, NBFCs, co-op banks, housing finance companies — from Lending Service Providers (LSPs) and Digital Lending Apps (DLAs) who act as the RE’s agents. Five rules are decisive in harassment complaints:
| RBI rule | What it says | Paragraph |
|---|---|---|
| No pool accounts | All disbursal and repayment must be directly between borrower’s bank account and RE’s bank account — no pass-through or pool account of LSP/DLA. Fees to LSPs are paid by the RE, not by you. | 2022 Para 3; 2025 Direction 9(i)-(iii) |
| Key Fact Statement before contract | Standardised KFS with APR, all fees, penal charges, tenor, repayment schedule, cooling-off / look-up period, recovery mechanism, grievance officer details, and privacy policy must be provided before execution; digitally signed documents must flow to you on email/SMS. | 2022 Annex I Para 4-5; 2025 Direction 8 |
| Cooling-off | At least 1 day for all loans (board-fixed, disclosed in KFS); exit by paying principal + proportionate APR without penalty; the RE may retain a disclosed one-time processing fee. (The 3-day/1-day tenor split was the 2022 regime.) | 2022 Para 8; 2025 Direction 10 |
| Data minimisation | Collection by DLAs/LSPs must be need-based with prior explicit consent and audit trail. DLAs must desist from accessing contacts, call logs, files, media beyond one-time camera/microphone/location for onboarding with explicit consent. Consent must be granular, revocable, purpose-disclosed, and deletable on demand; data stored only in India. | 2022 Para 10-11; 2025 Directions 12–13 |
| Grievance + liability | RE must have a nodal grievance officer (displayed on RE, LSP and DLA, and in the KFS) and a DLA complaint facility; outsourcing does not dilute the RE’s obligations — RE remains liable for LSP acts/omissions; if unresolved in 30 days, escalate to RB-IOS. | 2022 Para 6, 12; 2025 Directions 5(vii), 11; reaffirmed 14 Feb 2023 FAQs |
| Recovery agent duties | RE must communicate the recovery agent’s details by email/SMS before the agent contacts you (14 Feb 2023 FAQs), and under the 12 Aug 2022 recovery-agent circular agents must not intimidate, harass, humiliate, call before 8 a.m. or after 7 p.m., threaten or send inappropriate messages on mobile/social. | FAQs 14 Feb 2023; Circular DOR.ORG.REC.65/21.04.158/2022-23 |
A genuine RE-backed loan leaves a KFS, an APR, and a direct bank-to-bank payment trail. A loan app that offers money on WhatsApp, takes a contact-list permission, and demands repayment to a personal UPI ID fails at least three of these tests — a marker that the lender may be unregulated, with lending legally conductible only by entities regulated by RBI or permitted under other law (2022 Press Release para 3).
Which criminal provisions apply to the harassment?
The same conduct that violates the RBI framework often violates the IT Act and BNS simultaneously — the FIR commonly carries a mix:
| Conduct | Primary sections | What they cover |
|---|---|---|
| Accessing contacts / gallery without valid consent, sharing personal data with third parties | IT Act Sec 72A; DPDP Act, 2023 ss.4 & 6 (consent-based processing, phasing in from 2027) | Disclosure in breach of lawful contract with intent/knowledge of wrongful loss — since 30 Nov 2023 a civil penalty of up to ₹25 lakh, not an offence (Jan Vishwas Act, 2023) |
| Morphing your photo, creating a fake nude or threat image | IT Act Sec 66E (privacy), 66D (personation), 67/67A (obscene/sexually explicit electronic content); BNS Sec 336 (forgery), Sec 78 (stalking of a woman) | 66E: up to 3 years/₹2 lakh; 67A: 5 years first/7 years subsequent; BNS 78: up to 3-5 years |
| Sending that image to your contacts or threatening to | IT Act Sec 67/67A; BNS Sec 308 (extortion: fear to deliver money), Sec 351 (criminal intimidation), Sec 78 | Extortion: up to 7 years (10 if fear of death or grievous hurt) — coercing debt payment by threats falls here |
| Repeated abusive calls on phone/social | BNS Sec 351; 12 Aug 2022 circular (8am-7pm rule); IT Rules 3(2) grievance | Bar on intimidation and odd-hour calls |
| Impersonating police or court to threaten arrest | IT Act Sec 66D; BNS Sec 319 (cheating by personation), 308 | See digital arrest guide for the same pattern |
A separate takedown clock now applies to morphed images: under the IT (Intermediary Guidelines) Rules 2021 as amended 10 Feb 2026 (in force 20 Feb 2026), intermediaries must remove or disable access to unlawful content — including non-consensual nudity or morphed imagery — within 3 hours of actual knowledge via a court order or authorised government notification under Rule 3(1)(d), and must remove or disable such content within 2 hours of your user grievance under Rule 3(2)(b). File the platform grievance with URLs alongside the police complaint.
What should you do step by step — the order that matters?
- Preserve first. Screenshot the threats, the morphed image, the app permission screen showing contact/gallery access, the KFS if any, the UPI/repayment demand, and the call log with times. Keep the original device — see Section 63 BSA guide.
- Stop paying to “remove” the image. Payment confirms leverage and rarely ends the demand.
- Write to the RE’s nodal grievance officer (name and contact must be on the RE/LSP/DLA and in the KFS). Attach the preserved material, cite the Guidelines paragraphs, and demand cessation of contact-list use and harassment. Keep delivery proof.
- File a cyber complaint at cybercrime.gov.in and 1930, and a written complaint at the jurisdictional police / district Cyber Police Station citing the sections above. Cybercrime.gov.in allows confidential reporting.
- File a platform grievance with each platform hosting the morphed image/content — cite IT Rules 2021 Rule 3(1)(d) (3-hour court/government track) and Rule 3(2)(b) (2-hour user-grievance track for nudity, morphed or impersonation content).
- If unresolved in 30 days, escalate to RB-IOS at cms.rbi.org.in against the RE (not the LSP). The ombudsman route is record-based — the written grievance and the 30-day lapse are the foundation.
What if the lender is not an RBI-regulated entity at all?
Then the RBI framework’s RE-centric route is incomplete — the entity sits in the third category of the 10 Aug 2022 Press Release: lending not by an RE or under other law, for which the Working Group recommended legislative and institutional intervention. The remedy is primarily criminal and platform-based: police (Sections 308, 351, 78, 66C-E), IT Rules takedown, and reporting the app to MeitY / Google Play / Sachet (sachet.rbi.org.in) as an unauthorised lending app. Do not assume an app on the Play Store is an RE — the KFS and direct RE-to-you bank trail are the verification tests.
Primary sources
- RBI Guidelines on Digital Lending (02 Sep 2022, DOR.CRE.REC.66/21.07.001/2022-23)
- RBI (Digital Lending) Directions, 2025 (08 May 2025, DOR.STR.REC.19/21.07.001/2025-26)
- RBI Recovery Agents circular (12 Aug 2022, DOR.ORG.REC.65/21.04.158/2022-23)
- RBI Press Release: Recommendations of WGDL — Implementation (10 Aug 2022)
- IT Act, 2000 — Sections 66C, 66D, 66E, 67, 67A, 72A
- BNS, 2023 — Sections 78, 308, 336, 351
- BNSS, 2023 — Sections 35, 94; BSA, 2023 — Section 63
- IT (Intermediary Guidelines) Rules, 2021 as amended 10 Feb 2026 (Rule 3(1)(d) — 3-hour court/government takedown; Rule 3(2)(b) — 2-hour user-grievance removal)
- Reserve Bank – Integrated Ombudsman Scheme, 2026 (in force 1 July 2026, replacing the 2021 Scheme) — RBI FAQs; Sachet
FAQ