Loan Scams During Emergencies: How to Check a Lender in Minutes

By BillCut
Last updated: September 2026

The problem with an emergency is not that you stop being careful. It is that the checks you would normally make take longer than you have. Two of them do not. One is what the app asks your phone for. The other is whether the lender appears on the list the Reserve Bank publishes. Beware of loan scams during emergencies.

What Can You Check in Two Minutes?

Two things, and between them they rule out most of what goes wrong.

Check	How long	What it proves
What permissions the app asks for	Seconds, at the install screen	An app asking for contacts, files or call logs is asking for something the rules say it must not take
Whether the app appears in the list the Reserve Bank publishes	A minute, on the Reserve Bank website	Whether any regulated lender has told the regulator it uses this app
Whether a fee is demanded before the money arrives	Immediate, when it is asked for	Charges not set out in the Key Fact Statement cannot be levied at all
Which account the money is to be credited to	Immediate	Disbursement must be into your own bank account, never a third party’s

None of those requires reading reviews, searching for a company name or waiting for a callback. They are the checks that survive an emergency, which is why they are worth knowing before you need them.

What Is a Lending App Not Allowed to Ask Your Phone For?

Your contacts, your files and media, your call logs and your telephony functions. Not as a matter of good practice, but as a rule.

Under the Reserve Bank of India Digital Lending Directions, 2025, issued on 8 May 2025, digital lending apps are to desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions and the like. A one-time access can be taken for the camera, microphone, location or any other facility necessary for onboarding or know your customer requirements only, and with the explicit consent of the borrower.

The same directions require that any collection of data by the app is need-based, with the prior and explicit consent of the borrower, and with an audit trail. The borrower must be given an option to give or deny consent for the use of specific data, to restrict disclosure to third parties, to restrict data retention, to revoke consent already granted, and where required to have the data deleted.

That turns a vague worry into a bright line. An app that wants your contact list at install is not merely intrusive. It is asking for the thing the harassment later depends on, and it is asking for something a compliant lender is not permitted to take.

What the app asks for	What the directions say
Contacts, call logs, files and media, telephony functions	Apps are to desist from accessing these
Camera, microphone or location	One-time access only, for onboarding or know your customer purposes, with explicit consent
Anything else	Need-based, with prior and explicit consent, and an audit trail

How Do You Tell Whether the Lender Is Real?

By looking for the app on the list, rather than by looking for a partner name inside the app.

The same directions require every regulated entity to report all digital lending apps deployed or joined by it, whether its own or those of its lending service providers, on the Centralised Information Management System portal of the Reserve Bank, with that data subsequently published on the Reserve Bank website. So a directory of the apps that regulated lenders have declared exists, and it is maintained from the lenders’ own filings rather than from anyone’s marketing.

That matters because the usual advice, to check whether an app names a partner bank or non-banking financial company, is weak. A name printed inside an app proves nothing, and a scam app can print any name it likes. An app that does not appear in the published list is a different kind of answer.

Two caveats keep this honest. Absence from the list is a strong warning but the list depends on regulated entities filing correctly, so treat it as one check rather than the only one. And presence on the list tells you the app is declared by a regulated lender. It does not tell you the loan is suitable, or cheap.

Can a Lender Ask You to Pay Before the Loan Arrives?

No, and this is the clearest single test in the whole subject.

The Reserve Bank of India circular on the Key Facts Statement for Loans and Advances, RBI/2024-25/18 dated 15 April 2024, provides that any fees or charges not mentioned in the Key Fact Statement cannot be charged by the regulated entity to the borrower at any stage during the term of the loan without the explicit consent of the borrower. It also defines the annual percentage rate as the annual cost of credit including the interest rate and all other charges associated with the facility, and requires that rate to include all charges levied by the lender.

A genuine charge therefore behaves in a particular way. The figures below are illustrative. On a Rs 50,000 loan with a two per cent processing fee, the fee is Rs 1,000, or about Rs 1,180 with tax at eighteen per cent. It appears in the Key Fact Statement before you sign, it is inside the annual percentage rate, and it is deducted from the disbursal rather than collected from you in advance.

Anything that arrives in the other order is the scam. A verification fee, a token, a refundable security amount, a tax to be paid before release, an insurance premium demanded by transfer, all of them share one feature: money leaves you before any loan reaches you. The directions also require that disbursement shall always be made into the bank account of the borrower, except for disbursals covered exclusively under a statutory or regulatory mandate, and that in no case shall disbursal be made to a third party account including the account of a lending service provider. Money going anywhere other than to you, or coming from anywhere other than a lender, is the signal. What a legitimate disbursement looks like, and what a real delay in one looks like, is set out in this explainer on what loan disbursement is.

What Should You Do If You Have Already Shared Documents?

Act on the phone first and the paperwork second, because the phone is where the pressure comes from.

The permission problem is not unique to lending apps, and the same pattern of an app being given more access than it needs is covered in this piece on remote access apps and your bank account. Uninstalling the app does not withdraw what it already took, but the directions give you a right that does apply. You may revoke consent already granted to collect personal data and, where required, require the entity to delete or forget the data. Put that request in writing to the lender named in the app and keep a copy, because it is the document that shows when you withdrew consent.

Then report it, and report it in the right places rather than only to the app.

What happened	Where it goes
Money was taken, or documents were used to defraud you	The National Cyber Crime Reporting Portal at cybercrime.gov.in, and the helpline 1930
The approach came by call, SMS or WhatsApp	The Chakshu facility on Sanchar Saathi, which takes reports of suspected fraud communication across those channels
A regulated lender is involved and the complaint is unresolved	The lender’s grievance officer first, then the Reserve Bank Integrated Ombudsman Scheme

The Press Information Bureau release on steps taken to check cyber crime records that the National Cyber Crime Reporting Portal was launched to enable the public to report all types of cyber crime, and that the toll free helpline 1930 was introduced in 2020 to support victims, operating around the clock throughout the year. The Sanchar Saathi portal of the Department of Telecommunications describes Chakshu as the facility for citizens to report suspected fraud communications intended to defraud telecom service users, received by call, SMS or WhatsApp, and also lets you check the mobile connections issued in your name.

Where a regulated lender is involved, the Digital Lending Directions provide that if a complaint is rejected wholly or partly, or the borrower receives no reply within 30 days, the borrower can lodge a complaint under the Reserve Bank Integrated Ombudsman Scheme, introduced on 12 November 2021, through the portal at cms.rbi.org.in, with a contact centre on 14448.

What If the Threats Have Already Started?

Treat the threats as a separate offence from the loan, and do not pay to make them stop.

The harassment that follows these apps works because the operator has your contact list and something that looks like leverage. Paying does not remove either. It confirms that pressure works and it funds the next round.

Three things are worth doing in order. Report the numbers and messages through Chakshu, so the connections themselves are actioned. File on the cyber crime portal and call 1930, which is the route that reaches law enforcement. And tell the people most likely to be contacted, briefly and before it happens, because the tactic depends entirely on the shock of a relative getting a call.

If a regulated lender’s name is attached to any of it, that is not a reason to treat the conduct as legitimate. It is a reason to complain to that lender in writing and then escalate, because the lender is answerable for what is done in its name. What lawful recovery actually looks like, including the hours within which a recovery agent may call, is set out in this piece on when banks can take legal action.

Where Does BillCut Fit Into This?

BillCut is an Indian debt refinancing platform, and its commercial interest here is in the part of the story that came before the emergency.

Most people who end up on an unverified loan app did not want a loan from a stranger. They wanted money today and had nowhere to get it, and the reason they had nowhere is usually that the buffer had already gone. Very often it went into servicing an existing balance.

The figures below are illustrative and are not quoted from any lender. Assume Rs 50,000 owed.

How it is being carried	How long	Interest paid
On a credit card at 3.5 per cent a month, paying the minimum due	About 226 months	About Rs 1,01,786
As a 12 month loan at an illustrative 24 per cent a year	12 months at about Rs 4,728	About Rs 6,736

 

The gap between those rows is what a buffer is made of. A balance servicing itself at the first rate consumes the money that would otherwise have covered an emergency, which is how a medical bill turns into a search for an urgent loan at midnight.

What BillCut does is work with regulated lenders to convert a high interest card balance into a loan with a fixed EMI. Three limits before the link. It does not reduce what you owe, so a card cleared and used again leaves you with a loan and a balance. It replaces a flexible minimum with a fixed monthly obligation, which is the wrong direction if your income is unpredictable rather than stretched. And approval is not automatic.

It is also not an answer to an emergency that is happening now. If you need money today, the checks above are the useful part of this page. If a balance is what removed your cushion, you can look at what a structured repayment would cost through BillCut’s debt refinancing service.

What Should You Do Before the Next Emergency?

Three things, none of which takes long and all of which are easier now than under pressure.

• Check which of your existing apps still hold permissions they should not. The right to revoke consent and require deletion applies to apps you already installed, not only to new ones.
• Know where the published list of digital lending apps sits on the Reserve Bank website, so that finding it is not the slow step at the moment you need it.
• Decide in advance which one or two regulated lenders you would approach, so the emergency does not begin with a search result.
• Know that a digital loan carries a short exit window after it is taken, which is explained in this piece on the instant loan cooling-off period, so a decision made under pressure is not always final.

The single most useful habit is narrower than a general emergency fund. It is knowing, before anything happens, what you would do if you needed Rs 50,000 by tomorrow. People who can answer that in a sentence do not end up installing whatever appears first.

Frequently Asked Questions