The Loan App on Your Phone Already Has Your Contacts

The loan takes four minutes. You download the app, you photograph your face and your PAN card, you tap a button, and the money is in your account before the tea gets cold. Somewhere in those four minutes, on a screen most people swipe past, the app asks for something that has nothing at all to do with lending: your contacts. Sometimes your photo gallery too. That single permission is the whole business model, and it is the reason loan app harassment has become one of the most common complaints reaching India’s cyber-crime police. The contact list is not underwriting. It is the collection department, pre-installed on your phone, and you handed over the keys yourself.

I want to be precise about what I am describing here. There is a large, legitimate digital lending industry in India, regulated by the Reserve Bank, and there are apps operating entirely outside it. The distinction matters less than you would think to the person being harassed, because the mechanism is the same and the borrower usually cannot tell the two apart at the moment of installing. So let us look at the mechanism rather than the brand.

What the permission is actually for

A bank that lends you money assesses whether you can repay. It looks at income, at existing obligations, at a credit score assembled from your past behaviour with other lenders. This is slow, it is exclusionary, and it is why a very large number of Indians have never been offered formal credit in their lives. The instant-loan app does something different. It does not need to know whether you can repay, because it has arranged matters so that you will — or so that your refusal becomes unbearable.

Here is how the arrangement works when it goes wrong, as documented in years of police complaints, consumer forum filings and reporting across Indian newsrooms. The app takes your contacts at install. On default — and in reported cases before any genuine default, sometimes days before a payment is even due — recovery agents begin calling the numbers in that list. Not you. Your mother. Your manager. The colleague whose number you saved after one project. The message is rarely a demand for money. It is an announcement: this person is a fraud, this person has stolen, ask them to pay. In the worst reported cases the agents move from words to images, circulating morphed photographs pulled from the gallery permission alongside abusive messages in WhatsApp groups assembled out of the borrower’s own address book.

Read that sequence again and notice that none of it is lending. The loan is the pretext. The product being sold is a small sum of money at a very high effective rate, collateralised not by property or income but by the borrower’s standing among the people who know them.

A bank asks whether you can repay. An app like this asks how much humiliation you can absorb before you find the money somewhere.

Why shame is such an efficient collateral

The cruelty here is not incidental, and it is not the work of one rogue agent having a bad day. It is designed, and it is designed around a specific reading of the Indian borrower.

Consider who takes a four-minute loan of a few thousand rupees. Overwhelmingly it is someone with no credit history and no cushion, covering a medical bill, a school fee, a rent gap, a repayment on something else. Someone, in other words, for whom the loan is already a small emergency. Now consider what that person has that a lender can seize. Not assets. Not a salary a court will attach. What they have is a reputation in a tightly connected social world — a family, a workplace, a neighbourhood, a community where a phone call suggesting you are a thief does lasting damage.

Physical collateral has to be valued, stored and sold. Social collateral costs nothing to hold and can be destroyed instantly, at scale, by a call-centre worker paid per recovery. That asymmetry is the entire innovation. It is also why these operations can lend to people no bank would touch: the bank has no way to collect from someone with nothing, and this model has a very effective one.

It is worth sitting with how much this resembles other credit traps rather than treating it as a strange new thing. The same logic — extend easy credit to people with thin margins, then rely on pressure rather than assessment — runs through the EMI debt trap that has quietly reorganised middle-class spending, and through a long history of Indian moneylending in which the enforcement was always social before it was legal. What changed is the throughput. A moneylender could shame you in a village. An app can shame you in four hundred contacts in an afternoon, from another state, with no one present in the room.

And the harm does not stop at embarrassment. Reporting in India has repeatedly connected sustained harassment of this kind to borrowers taking their own lives. I am not going to describe any of those cases. I raise it only so that nobody reads what follows as advice about an inconvenience. It is not an inconvenience. If you or someone you know is in that place, please talk to somebody — a family member, a doctor, a helpline — before you talk to the app.

What the regulator has actually done

The Reserve Bank of India has moved on this, and it is worth knowing the rules because they give you language for a complaint.

Since 2022 the RBI has issued digital lending norms, now consolidated into the Reserve Bank of India (Digital Lending) Directions, 2025, which took effect in May 2025. The provisions that matter most to the borrower are these:

• The money must come from a regulated lender. Loan disbursal and repayment flow directly between the borrower and a regulated entity — a bank or an NBFC — not through an app company’s own account. An app is a shopfront; it is not allowed to be the lender in disguise.
• Data collection must be need-based, with explicit consent and an audit trail. The Directions specifically target blanket access to phone contacts, media files and call logs. A lending app has no legitimate need for your address book, and the borrower must be able to deny consent for a data category, refuse third-party sharing, revoke consent later and ask for deletion.
• The true cost must be disclosed upfront. A Key Fact Statement has to be shown at the offer stage, carrying the lender’s name, the sanctioned amount, the tenor, the annual percentage rate, the repayment and any penal charges — so the real cost of a “small” loan is visible before you accept it, not discovered afterwards.
• No automatic credit-limit increases. A limit can be raised only on the borrower’s explicit request, which closes off the old trick of quietly expanding someone’s exposure until they cannot climb out.
• Apps must be declared. Regulated entities have to report the digital lending apps they operate or partner with to an RBI directory, so there is a record of which apps sit inside the system.

Alongside this, the government has used Section 69A of the IT Act to block illegal lending apps, and Google has restricted personal-loan apps on the Play Store to regulated entities and their declared partners. Thousands of apps have come down over the past few years.

These are real improvements and they are not a solution. Rules bind the entities that accept being bound; an operation running off a sideloaded APK, a shifting set of shell companies and a call centre outside the country is not filing Key Fact Statements. Enforcement runs a step behind distribution, which is the pattern that shows up almost everywhere once you start looking at how technology gets captured — a tool arrives, someone works out how to point it at the people with the least room to object, and the law arrives to describe the damage afterwards. The same gap is why India’s data protection Act, which on paper forbids exactly this kind of purposeless data grab, will only bite to the extent anyone is willing and able to enforce it against operators who are hard to find.

Warning signs, before you tap accept

• The app wants contacts, gallery, call logs, SMS or location for a loan. No lender needs any of it to decide whether to lend.
• You cannot find, on the app or its website, the name of the bank or NBFC actually lending the money.
• There is no Key Fact Statement before you accept, and the interest is quoted as a small daily or weekly figure rather than an annual rate.
• A processing fee is deducted so that you receive noticeably less than the sanctioned amount, while repayment is calculated on the full amount.
• The tenor is absurdly short — seven days, fourteen days — with rollover offered immediately.
• Contact is only over WhatsApp or a personal number, with no registered office, no grievance officer and no complaint channel.
• The app arrived by SMS or social media link and installs from outside the official app store.

The leverage is not the debt. The leverage is that the people in your phone do not yet know.

If the harassment has already started

The single most important thing first: do not pay to make the shaming stop. Paying a harasser to stop harassing you does not close the account; it confirms that the method works on you, and in reported case after reported case it is followed by a new demand, a new “processing fee”, a new app. Repay a genuine, documented debt to the regulated lender named in your loan agreement, through the official channel, and not one rupee more to anyone who calls.

1. Tell the people first. Message your family, your close colleagues, your manager, before the agents reach them: “I took a small loan from an app and they are calling my contacts with abuse. Ignore it, forward me anything you get.” This one step removes most of the leverage, because the entire threat depends on the disclosure being a surprise that lands on your reputation before your version does.
2. Document everything. Screenshots of every message, the numbers calling, call logs, the app’s listing page, the loan agreement, bank statements showing what was actually credited and what was debited, and any morphed image circulated. Back it up somewhere off the phone.
3. Revoke permissions, then uninstall. In Android settings, withdraw the app’s access to contacts, storage, call logs and SMS before you delete it, and check what else it has quietly retained. Uninstalling alone does not undo what was already copied, but it stops further collection.
4. Report it as a cyber-crime. File on the National Cyber Crime Reporting Portal at cybercrime.gov.in, run by the Ministry of Home Affairs, and upload the evidence. The 1930 helpline runs round the clock and is the right number to call. Circulating morphed images and threatening messages are criminal offences in their own right, entirely separate from whether you owe money.
5. File with the police too. Go to the local police station or the cyber cell with printed copies and get an acknowledgement. Insist on it; the written record is what forces the matter to be treated as extortion rather than a “loan dispute”.
6. Complain to the RBI where there is a regulated lender. If a bank or NBFC is named anywhere in your agreement, raise a grievance with them and escalate to the RBI’s ombudsman scheme. A regulated lender is answerable for the conduct of the service providers collecting on its behalf.
7. Report the app. Flag it on the app store listing, so the takedown machinery at least has a signal to act on.

Notice how much of that is simply refusing the frame. The operation needs you isolated, ashamed and convinced this is a private failure you must quietly buy your way out of. It is the same psychological architecture behind the digital arrest scam: manufacture urgency, manufacture disgrace, forbid you to consult anyone, and collect while you are still too frightened to think. The counter is identical in both cases and it is unglamorous. Slow down. Tell somebody. Write it down. Report it.

The thing to keep hold of

Instant credit is not the villain of this story. Access to small, fast, fairly priced loans would be genuinely transformative for tens of millions of Indians who have never been offered any. What happened instead is that a real need met an easy technical capability — the address book sitting there behind one tap — and a business grew in the gap between them, converting the intimacy of a phone into an instrument of collection.

So the practical takeaway is small and boring, and I would rather give you that than outrage. When any app asks for something that has no bearing on what it does for you, that permission is a product. Decline it. And if you have already granted it and the calls have begun: the moment you stop treating it as your secret, most of what they sold you disappears.