--- title: "Loan App Harassment in India: RBI Digital Lending Rules" description: "Loan app agents calling contacts, morphing photos or threatening you? RBI Digital Lending Directions 2025, IT Act and BNS sections, and the complaint route." url: "https://advaslam.com/writing/loan-app-harassment-rbi-digital-lending/" image: "https://advaslam.com/og/writing/loan-app-harassment-rbi-digital-lending.png" --- [Cyber crime & IT Act matters](https://advaslam.com/practice/cyber-crime/) # Loan App Harassment and Recovery Threats: RBI Digital Lending Rules and Your Legal Options By [**Adv. K J Muhammed Aslam**](https://advaslam.com/profile/) · Advocate, Ernakulam (Bar Council of Kerala) Published 4 September 2026 A loan app that accesses your contacts, downloads your gallery, morphs a photo, then threatens to send it to your family on WhatsApp unless you pay — and a recovery agent who calls before 8 a.m., after 7 p.m., or posts in your social feed — is not a civil recovery. Under the **[RBI Guidelines on Digital Lending (02 Sep 2022)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12382)** consolidated into the **[Reserve Bank of India (Digital Lending) Directions, 2025 (08 May 2025, DOR.STR.REC.19/21.07.001/2025-26)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12848)** read with the **[RBI Outsourcing circular on Recovery Agents (12 Aug 2022)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12378)**, plus **[Sections 66C, 66D, 66E, 67 of the IT Act](https://indiacode.gov.in/handle/123456789/496511)** and **[Sections 308, 351, 78, 336 BNS](https://indiacode.gov.in/handle/123456789/496548)**, that conduct is harassment, is prohibited, and has a defined complaint route. ## What do the RBI digital lending rules actually require? The framework distinguishes **Regulated Entities (REs)** — banks, NBFCs, co-op banks, housing finance companies — from **Lending Service Providers (LSPs)** and **Digital Lending Apps (DLAs)** who act as the RE’s agents. Five rules are decisive in harassment complaints: | RBI rule | What it says | Paragraph | | --- | --- | --- | | **No pool accounts** | All disbursal and repayment must be **directly between borrower’s bank account and RE’s bank account** — no pass-through or pool account of LSP/DLA. Fees to LSPs are paid **by the RE, not by you**. | 2022 Para 3; 2025 Direction 9(i)-(iii) | | **Key Fact Statement before contract** | Standardised **KFS** with **APR**, all fees, penal charges, tenor, repayment schedule, **cooling-off / look-up period**, recovery mechanism, **grievance officer** details, and privacy policy must be provided before execution; digitally signed documents must flow to you on email/SMS. | 2022 Annex I Para 4-5; 2025 Direction 8 | | **Cooling-off** | At least **1 day** for all loans (board-fixed, disclosed in KFS); exit by paying principal + proportionate APR without penalty; the RE may retain a disclosed one-time processing fee. (The 3-day/1-day tenor split was the 2022 regime.) | 2022 Para 8; 2025 Direction 10 | | **Data minimisation** | Collection by DLAs/LSPs must be **need-based with prior explicit consent and audit trail**. DLAs must **desist from accessing contacts, call logs, files, media** beyond one-time camera/microphone/location for onboarding with explicit consent. Consent must be granular, revocable, purpose-disclosed, and deletable on demand; data stored only in India. | 2022 Para 10-11; 2025 Directions 12–13 | | **Grievance + liability** | RE must have a **nodal grievance officer** (displayed on RE, LSP and DLA, and in the KFS) and a DLA complaint facility; **outsourcing does not dilute** the RE’s obligations — RE remains liable for LSP acts/omissions; if unresolved in **30 days**, escalate to **RB-IOS**. | 2022 Para 6, 12; 2025 Directions 5(vii), 11; reaffirmed 14 Feb 2023 FAQs | | **Recovery agent duties** | RE must communicate the **recovery agent’s details by email/SMS before the agent contacts you** (14 Feb 2023 FAQs), and under the 12 Aug 2022 recovery-agent circular agents **must not** intimidate, harass, humiliate, call before 8 a.m. or after 7 p.m., threaten or send inappropriate messages on mobile/social. | FAQs 14 Feb 2023; Circular DOR.ORG.REC.65/21.04.158/2022-23 | A genuine RE-backed loan leaves a KFS, an APR, and a direct bank-to-bank payment trail. A loan app that offers money on WhatsApp, takes a contact-list permission, and demands repayment to a personal UPI ID fails at least three of these tests — a marker that the lender may be **unregulated**, with lending legally conductible only by entities regulated by RBI or permitted under other law (2022 Press Release para 3). ## Which criminal provisions apply to the harassment? The same conduct that violates the RBI framework often violates the IT Act and BNS simultaneously — the FIR commonly carries a mix: | Conduct | Primary sections | What they cover | | --- | --- | --- | | Accessing contacts / gallery without valid consent, sharing personal data with third parties | IT Act Sec 72A; DPDP Act, 2023 ss.4 & 6 (consent-based processing, phasing in from 2027) | Disclosure in breach of lawful contract with intent/knowledge of wrongful loss — since 30 Nov 2023 a civil penalty of up to ₹25 lakh, not an offence (Jan Vishwas Act, 2023) | | Morphing your photo, creating a fake nude or threat image | IT Act Sec 66E (privacy), 66D (personation), 67/67A (obscene/sexually explicit electronic content); BNS Sec 336 (forgery), Sec 78 (stalking of a woman) | 66E: up to 3 years/₹2 lakh; 67A: 5 years first/7 years subsequent; BNS 78: up to 3-5 years | | Sending that image to your contacts or threatening to | IT Act Sec 67/67A; BNS Sec 308 (extortion: fear to deliver money), Sec 351 (criminal intimidation), Sec 78 | Extortion: up to 7 years (10 if fear of death or grievous hurt) — coercing debt payment by threats falls here | | Repeated abusive calls on phone/social | BNS Sec 351; 12 Aug 2022 circular (8am-7pm rule); IT Rules 3(2) grievance | Bar on intimidation and odd-hour calls | | Impersonating police or court to threaten arrest | IT Act Sec 66D; BNS Sec 319 (cheating by personation), 308 | See [digital arrest guide](https://advaslam.com/writing/digital-arrest-scam-india-what-to-do/) for the same pattern | A separate **takedown clock** now applies to morphed images: under the **IT (Intermediary Guidelines) Rules 2021 as amended 10 Feb 2026 (in force 20 Feb 2026)**, intermediaries must remove or disable access to unlawful content — including non-consensual nudity or morphed imagery — **within 3 hours** of actual knowledge via a court order or authorised government notification under Rule 3(1)(d), and must remove or disable such content **within 2 hours** of your user grievance under Rule 3(2)(b). File the platform grievance with URLs alongside the police complaint. ## What should you do step by step — the order that matters? 1. **Preserve first.** Screenshot the threats, the morphed image, the app permission screen showing contact/gallery access, the KFS if any, the UPI/repayment demand, and the call log with times. Keep the original device — see [Section 63 BSA guide](https://advaslam.com/writing/electronic-evidence-bsa-section-63-certificate-guide/). 2. **Stop paying to “remove” the image.** Payment confirms leverage and rarely ends the demand. 3. **Write to the RE’s nodal grievance officer** (name and contact must be on the RE/LSP/DLA and in the KFS). Attach the preserved material, cite the Guidelines paragraphs, and demand cessation of contact-list use and harassment. Keep delivery proof. 4. **File a cyber complaint** at [cybercrime.gov.in](https://cybercrime.gov.in) and 1930, and a written complaint at the jurisdictional police / district Cyber Police Station citing the sections above. Cybercrime.gov.in allows confidential reporting. 5. **File a platform grievance** with each platform hosting the morphed image/content — cite IT Rules 2021 Rule 3(1)(d) (3-hour court/government track) and Rule 3(2)(b) (2-hour user-grievance track for nudity, morphed or impersonation content). 6. **If unresolved in 30 days, escalate to RB-IOS** at [cms.rbi.org.in](https://cms.rbi.org.in) against the RE (not the LSP). The ombudsman route is record-based — the written grievance and the 30-day lapse are the foundation. ## What if the lender is not an RBI-regulated entity at all? Then the RBI framework’s RE-centric route is incomplete — the entity sits in the **third category** of the 10 Aug 2022 Press Release: lending not by an RE or under other law, for which the Working Group recommended legislative and institutional intervention. The remedy is primarily criminal and platform-based: police (Sections 308, 351, 78, 66C-E), IT Rules takedown, and reporting the app to **MeitY / Google Play / Sachet** (sachet.rbi.org.in) as an unauthorised lending app. Do not assume an app on the Play Store is an RE — the KFS and direct RE-to-you bank trail are the verification tests. ## Primary sources - [RBI Guidelines on Digital Lending (02 Sep 2022, DOR.CRE.REC.66/21.07.001/2022-23)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12382) - [RBI (Digital Lending) Directions, 2025 (08 May 2025, DOR.STR.REC.19/21.07.001/2025-26)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12848) - [RBI Recovery Agents circular (12 Aug 2022, DOR.ORG.REC.65/21.04.158/2022-23)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12378) - [RBI Press Release: Recommendations of WGDL — Implementation (10 Aug 2022)](https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=54187) - [IT Act, 2000 — Sections 66C, 66D, 66E, 67, 67A, 72A](https://indiacode.gov.in/handle/123456789/496511) - [BNS, 2023 — Sections 78, 308, 336, 351](https://indiacode.gov.in/handle/123456789/496548) - [BNSS, 2023 — Sections 35, 94](https://indiacode.gov.in/handle/123456789/496550); [BSA, 2023 — Section 63](https://indiacode.gov.in/handle/123456789/496549) - [IT (Intermediary Guidelines) Rules, 2021 as amended 10 Feb 2026](https://egazette.gov.in/WriteReadData/2026/269993.pdf) (Rule 3(1)(d) — 3-hour court/government takedown; Rule 3(2)(b) — 2-hour user-grievance removal) - [Reserve Bank – Integrated Ombudsman Scheme, 2026 (in force 1 July 2026, replacing the 2021 Scheme) — RBI FAQs](https://www.rbi.org.in/commonman/Upload/English/FAQs/PDFs/RBIOS01072026.pdf); [Sachet](https://sachet.rbi.org.in) FAQ ## Common questions **Are loan apps allowed to call my contacts or morph my photos?** No. RBI's Guidelines on Digital Lending (02 Sep 2022) and the comprehensive Reserve Bank of India (Digital Lending) Directions, 2025 (08 May 2025) mandate need-based, consent-driven data collection — DLAs must desist from accessing contacts, call logs, files and media beyond one-time camera/microphone/location for onboarding with explicit consent. Unlawful sharing of contact and gallery data additionally attracts the civil penalty under IT Act Section 72A; harassment, morphed-photo threats and contact-shaming attract IT Act Sections 66C, 66D and 66E and BNS Sections 75 (sexual harassment), 78 (stalking), 308 (extortion) and 351 (criminal intimidation). **What must a loan app disclose before I take a digital loan?** A standardised Key Fact Statement (KFS) with APR (annual percentage rate), all fees, penal charges, loan tenor, repayment schedule, cooling-off or look-up period, grievance redressal officer details, recovery mechanism and a privacy policy must be provided before contract execution. Disbursal and repayment must be directly between your bank account and the Regulated Entity — no pool or pass-through account of the lending service provider. **What is the cooling-off period for a digital loan?** Under the 2025 Directions, the period is fixed by the lender's board and must be at least one day for every digital loan, whatever the tenor: you may exit by paying principal and proportionate APR without penalty. The RE may retain a reasonable one-time processing fee if you exit during the cooling-off period, provided this is disclosed upfront in the KFS. For borrowers continuing after the cooling-off period, pre-payment remains available under extant RBI guidelines. **Who is responsible when a recovery agent harasses me?** The Regulated Entity (bank,NBFC,co-op) is fully responsible for its lending service provider and DLA. Outsourcing does not dilute the RE's obligations (2025 Directions: outsourcing shall in no manner dilute statutory/regulatory obligations; RE remains liable for acts/omissions of LSP). RBI's 12 Aug 2022 recovery-agent circular additionally bars intimidation, harassment, calling before 8 am or after 7 pm, and public humiliation. Complaints go to the RE's nodal grievance officer, and unresolved complaints (30 days) to the RBI Integrated Ombudsman (RB-IOS). **What criminal complaints can be filed for loan app threats?** Depending on facts: Section 308 BNS (extortion), Section 351 BNS (criminal intimidation), Section 78 BNS (stalking including electronic stalking of a woman), Section 79 BNS (word, gesture or act intended to insult the modesty of a woman), Section 336 BNS (forgery where morphed images are used), and IT Act Sections 66C (identity theft), 66D (personation), 66E (privacy violation for intimate/morphed images), 67/67A (obscene/sexually explicit electronic content), plus IT Rules 2021 clocks — Rule 3(1)(d) (3-hour removal of unlawful content on court order or authorised government intimation) and Rule 3(2)(b) (2-hour removal for nudity, morphed imagery or impersonation on user grievance). **A note on this article.** It is general legal information, not legal advice. The law may have changed since the date shown; before acting on anything here, take advice on your specific situation from an advocate of your choice. Keep reading Cyber crime & IT Act matters ### Cyber Fraud Defence in Kerala: Freeze to Recovery Hub Answer cyber fraud in Kerala step by step: freeze unfreezing, UPI and task-scam recovery, P2P taint, notices, escalation, evidence, ED and CIBIL sequels. 5 Oct 2026 [Cyber Fraud Defence in Kerala: Freeze to Recovery Hub](https://advaslam.com/writing/cyber-fraud-defence-kerala/) Cyber crime & IT Act matters ### Telegram Task Scam and Online Job Fraud: How It Works and How to Recover Money in Kerala Lost money to a Telegram task or job scam? Why Section 66D IT Act and Section 318(4) BNS apply, why chasing deeper levels hurts, and 1930 and bank steps. 6 Sept 2026 [Telegram Task Scam and Online Job Fraud: How It Works and How to Recover Money in Kerala](https://advaslam.com/writing/telegram-job-task-scam-recovery/) Contact [WhatsApp](https://wa.me/919497240215?text=Hello%2C%20I%20found%20advaslam.com%20and%20would%20like%20to%20discuss%20a%20matter.) [contact@advaslam.com](mailto:contact@advaslam.com) [+91 94972 40215](tel:+919497240215) 3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment) ```json {"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://advaslam.com/#website","url":"https://advaslam.com","name":"Adv. K J Muhammed Aslam","alternateName":"advaslam.com","publisher":{"@id":"https://advaslam.com/#person"},"inLanguage":"en-IN"},{"@type":"Person","@id":"https://advaslam.com/#person","name":"K J Muhammed Aslam","alternateName":["Adv. K J Muhammed Aslam","Advocate K J Muhammed Aslam","Muhammed Aslam K J","Adv. Aslam"],"honorificPrefix":"Adv.","jobTitle":"Advocate","description":"Advocate enrolled with the Bar Council of Kerala, practising from High Court Junction, Ernakulam: cyber and technology law, data protection (DPDP), business, banking and IPR, and litigation before the High Court of Kerala and the courts at Ernakulam.","url":"https://advaslam.com/profile/","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"alumniOf":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"memberOf":[{"@type":"Organization","name":"Bar Council of Kerala","url":"https://barcouncilkerala.org/lawyer-registry-list"},{"@type":"Organization","name":"Kerala High Court Advocates' Association","url":"https://khcaa.com/"}],"identifier":[{"@type":"PropertyValue","propertyID":"Bar Council of Kerala Enrolment No.","value":"K/001823/2026"},{"@type":"PropertyValue","propertyID":"KHCAA Membership No.","value":"OAJ 358"}],"knowsAbout":["Information Technology Act 2000","Cyber crime law","Technology law and technology contracts","Digital Personal Data Protection Act 2023","DPDP compliance","Data protection and privacy law","Business and commercial law","Contract drafting and negotiation","Banking and finance law","Negotiable Instruments Act cheque dishonour","SARFAESI Act","Intellectual property law","Copyright and trademark law","Patent infringement","GST and income-tax law","Blockchain and cryptocurrency technology","Web3 wallets and NFTs","Drone regulation and DigitalSky framework","Writ petitions under Article 226","Criminal law","Civil and consumer litigation","Family and succession law","Service and labour law","Legal drafting","Mediation and dispute resolution"],"knowsLanguage":["en","ml"],"workLocation":{"@id":"https://advaslam.com/#practice"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"Enrolment as an advocate","identifier":"K/001823/2026","recognizedBy":{"@type":"Organization","name":"Bar Council of Kerala"},"description":"Enrolled as an advocate with the Bar Council of Kerala (K/001823/2026), 2026"},{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","educationalLevel":"Bachelor","recognizedBy":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"description":"BBA LLB (Hons.), Bharata Mata School of Legal Studies (2025)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"Remote Pilot Certificate","recognizedBy":{"@type":"Organization","name":"Directorate General of Civil Aviation, India"},"description":"DGCA Remote Pilot Certificate, issued 2022"}],"subjectOf":[{"@type":"CreativeWork","name":"Govind Babu v. State of Kerala (Crl.M.C. No. 5640 of 2026, 2026:KER:69496)","url":"https://indiankanoon.org/doc/151180872/","datePublished":"2026-09-10","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Viji Sagar v. State of Kerala (Crl.M.C. No. 1603 of 2026, 2026:KER:20803)","url":"https://indiankanoon.org/doc/193042273/","datePublished":"2026-03-09","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Anjana v. Manoharan A.P. (C.R.P. No. 442 of 2025, 2026:KER:10054)","url":"https://indiankanoon.org/doc/68585852/","datePublished":"2026-02-05","publisher":{"@type":"Organization","name":"High Court of Kerala"}}],"sameAs":["https://www.linkedin.com/in/azlubro","https://portal.khcaa.com/advocate?id=10480","https://lexosys.com"]},{"@type":"LegalService","@id":"https://advaslam.com/#practice","name":"Adv. K J Muhammed Aslam — Advocate, Ernakulam","url":"https://advaslam.com","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"geo":{"@type":"GeoCoordinates","latitude":9.9889,"longitude":76.2748},"hasMap":"https://www.google.com/maps/search/?api=1&query=Lalan+Towers+High+Court+Junction+Ernakulam","areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"City","name":"Kochi"},{"@type":"State","name":"Kerala"},{"@type":"Country","name":"India"}],"openingHoursSpecification":{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],"opens":"10:00","closes":"18:30"},"founder":{"@id":"https://advaslam.com/#person"},"knowsAbout":["Cyber crime and IT Act matters","Data protection and DPDP Act compliance","Business, banking, intellectual property and tax","Legal drafting","Criminal law: bail, quash and appeals","Writ petitions before the High Court of Kerala","Civil, property and consumer matters","Family and succession matters","Service and labour matters"]},{"@type":"BlogPosting","@id":"https://advaslam.com/writing/loan-app-harassment-rbi-digital-lending/#article","isPartOf":{"@id":"https://advaslam.com/#website"},"headline":"Loan App Harassment and Recovery Threats: RBI Digital Lending Rules and Your Legal Options","description":"Loan app agents calling contacts, morphing photos or threatening you? RBI Digital Lending Directions 2025, IT Act and BNS sections, and the complaint route.","url":"https://advaslam.com/writing/loan-app-harassment-rbi-digital-lending/","mainEntityOfPage":"https://advaslam.com/writing/loan-app-harassment-rbi-digital-lending/","datePublished":"2026-09-04T00:00:00.000Z","dateModified":"2026-09-04T00:00:00.000Z","keywords":"loan app harassment India, recovery agent harassment RBI rules, RBI digital lending guidelines 2022, loan app morphed photo threat, digital lending harassment complaint","inLanguage":"en-IN","author":{"@id":"https://advaslam.com/#person"},"publisher":{"@id":"https://advaslam.com/#person"},"image":"https://advaslam.com/og/writing/loan-app-harassment-rbi-digital-lending.png","about":{"@type":"Service","@id":"https://advaslam.com/practice/cyber-crime/#service","name":"Cyber crime & IT Act matters","url":"https://advaslam.com/practice/cyber-crime/","provider":{"@id":"https://advaslam.com/#practice"}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://advaslam.com/"},{"@type":"ListItem","position":2,"name":"Articles","item":"https://advaslam.com/writing/"},{"@type":"ListItem","position":3,"name":"Loan App Harassment and Recovery Threats: RBI Digital Lending Rules and Your Legal Options","item":"https://advaslam.com/writing/loan-app-harassment-rbi-digital-lending/"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Are loan apps allowed to call my contacts or morph my photos?","acceptedAnswer":{"@type":"Answer","text":"No. RBI's Guidelines on Digital Lending (02 Sep 2022) and the comprehensive Reserve Bank of India (Digital Lending) Directions, 2025 (08 May 2025) mandate need-based, consent-driven data collection — DLAs must desist from accessing contacts, call logs, files and media beyond one-time camera/microphone/location for onboarding with explicit consent. Unlawful sharing of contact and gallery data additionally attracts the civil penalty under IT Act Section 72A; harassment, morphed-photo threats and contact-shaming attract IT Act Sections 66C, 66D and 66E and BNS Sections 75 (sexual harassment), 78 (stalking), 308 (extortion) and 351 (criminal intimidation)."}},{"@type":"Question","name":"What must a loan app disclose before I take a digital loan?","acceptedAnswer":{"@type":"Answer","text":"A standardised Key Fact Statement (KFS) with APR (annual percentage rate), all fees, penal charges, loan tenor, repayment schedule, cooling-off or look-up period, grievance redressal officer details, recovery mechanism and a privacy policy must be provided before contract execution. Disbursal and repayment must be directly between your bank account and the Regulated Entity — no pool or pass-through account of the lending service provider."}},{"@type":"Question","name":"What is the cooling-off period for a digital loan?","acceptedAnswer":{"@type":"Answer","text":"Under the 2025 Directions, the period is fixed by the lender's board and must be at least one day for every digital loan, whatever the tenor: you may exit by paying principal and proportionate APR without penalty. The RE may retain a reasonable one-time processing fee if you exit during the cooling-off period, provided this is disclosed upfront in the KFS. For borrowers continuing after the cooling-off period, pre-payment remains available under extant RBI guidelines."}},{"@type":"Question","name":"Who is responsible when a recovery agent harasses me?","acceptedAnswer":{"@type":"Answer","text":"The Regulated Entity (bank,NBFC,co-op) is fully responsible for its lending service provider and DLA. Outsourcing does not dilute the RE's obligations (2025 Directions: outsourcing shall in no manner dilute statutory/regulatory obligations; RE remains liable for acts/omissions of LSP). RBI's 12 Aug 2022 recovery-agent circular additionally bars intimidation, harassment, calling before 8 am or after 7 pm, and public humiliation. Complaints go to the RE's nodal grievance officer, and unresolved complaints (30 days) to the RBI Integrated Ombudsman (RB-IOS)."}},{"@type":"Question","name":"What criminal complaints can be filed for loan app threats?","acceptedAnswer":{"@type":"Answer","text":"Depending on facts: Section 308 BNS (extortion), Section 351 BNS (criminal intimidation), Section 78 BNS (stalking including electronic stalking of a woman), Section 79 BNS (word, gesture or act intended to insult the modesty of a woman), Section 336 BNS (forgery where morphed images are used), and IT Act Sections 66C (identity theft), 66D (personation), 66E (privacy violation for intimate/morphed images), 67/67A (obscene/sexually explicit electronic content), plus IT Rules 2021 clocks — Rule 3(1)(d) (3-hour removal of unlawful content on court order or authorised government intimation) and Rule 3(2)(b) (2-hour removal for nudity, morphed imagery or impersonation on user grievance)."}}]}]} ```