5 Loan-Fraud Red Flags to Spot Before You Pay a Rupee
Fake fintech apps stole ₹380 Cr from Indian consumers in 2025. Here's how to spot a scam in the first 30 seconds — and where to report it.
Red flag #1 · Upfront processing fee via UPI
No RBI-licensed lender in India will ever ask for a processing fee via UPI to a personal-name VPA. Legitimate fees are deducted from the disbursed amount, not paid upfront. If the collector's UPI ID reads like a personal handle (for example, 'anilkumar@paytm'), hang up immediately — it is the single clearest fraud signal in the market today.
No RBI-licensed lender ever asks for a processing fee via UPI to a personal-name VPA. Legitimate fees are deducted from the disbursal, not paid upfront. If the collector's UPI ID reads 'anilkumar@paytm' — hang up.
Red flag #2 · SMS with a personal WhatsApp number
Real lender SMS messages arrive from a 6-character alphabetic short-code such as 'HDFCBK' or 'ICICIB' — never from a 10-digit personal mobile number. Legitimate lenders also never route underwriting through WhatsApp. If a loan message links to a WhatsApp chat with a personal number, treat the entire lender as unverified and delete the thread.
Real lender SMSes come from a 6-character alphabetic short-code (e.g., 'HDFCBK', 'ICICIB'). Never from a 10-digit personal mobile. And they never link out to WhatsApp — legitimate underwriting happens in-app or via customer-care landlines.
Red flag #3 · No mention of RBI or ombudsman
Every legitimate loan agreement in India carries the lender's RBI licence number and a link to the RBI Integrated Ombudsman scheme for grievance redressal. If a sanction letter or app disclaimer omits these two elements, the lender is not RBI-regulated — refuse to sign, walk away, and report the entity on the RBI Sachet portal within 24 hours.
Every legitimate loan agreement carries the lender's RBI licence number + a link to the RBI Integrated Ombudsman scheme. Missing? It's not a bank.
Red flag #4 · Contacts-access permission for the app
The RBI's Digital Lending Guidelines from September 2022 explicitly ban regulated lenders from accessing your phone contacts, gallery or SMS inbox. If a loan-app install screen asks for any of these three permissions, the app is either unlicensed or in direct violation of RBI rules. Uninstall immediately and report the app via cybercrime.gov.in before entering any KYC data.
The RBI's Digital Lending Guidelines (Sep 2022) ban lenders from accessing contacts, gallery, or SMS. If a loan app asks for these on install — uninstall + report.
Red flag #5 · Interest rate that sounds too good
Any unsecured personal-loan rate under 8% per annum is impossible in India today. Even AAA-rated NBFCs themselves borrow from banks at roughly 8%, so nobody can profitably lend below that on unsecured credit. Ads promising 4-6% rates are bait — the moment you share PAN or Aadhaar, the fraudsters have everything they need to steal your identity.
Under 8% p.a. on an unsecured personal loan is impossible in India today — even AAA-rated NBFCs borrow from banks at ~8% themselves. Anything advertised at 4-6% is bait to collect your PAN + Aadhaar.
Where to report
Two portals handle loan fraud in India. The RBI's Sachet portal (sachet.rbi.org.in) accepts complaints against licensed lenders and NBFCs and resolves within 30 days. The National Cybercrime Reporting Portal (cybercrime.gov.in) handles outright fraud and threatening recovery agents. File on both if the case fits — parallel filings usually get resolved faster.
RBI's Sachet portal (sachet.rbi.org.in) for licensed-lender complaints; cybercrime.gov.in for outright fraud + threatening recovery agents. Both have < 30-day resolution SLAs.
The team keeping every rate card, every disclosure and every RBI filing on Loan4Bank compliant. Publishes safety, fraud-prevention and RBI-guideline explainers so borrowers never sign what they can't read.
One email. One WhatsApp. Zero spam.
Every Sunday: 3 credit tips, 1 rate-alert, and the tax deadline you keep forgetting. Unsubscribe with a single tap.
Or follow the digest on WhatsApp instead