Is Account Aggregator Safe? A Borrower’s Guide to Consent, Fraud and Complaints

By BillCut
Last updated: 22 October 2026

An Account Aggregator is usually safe to use because it is regulated by the Reserve Bank of India (RBI), cannot move your data without your explicit consent and cannot see the data it carries. The weak point is you approving a request you did not read, or sharing an OTP with a fraudster. Here is how to check, revoke and complain.

Is Account Aggregator safe by design?

The RBI’s Master Direction for NBFC-Account Aggregators builds several protections into the system. An AA must be a company with an RBI certificate of registration, and it can act only on your explicit consent.

Protection	What the rules say
Consent first	No financial information can be retrieved, shared or transferred without your explicit consent
No passwords	The AA must not request or store your credentials, such as passwords or PINs
Nothing kept	Financial information the AA accesses must not reside with it
No other use	The AA cannot use customer information for anything other than its AA business, and cannot support transactions
Your record	The AA must let you see the consents you gave and who received your data
Exit option	The AA must give you a way to revoke consent

The government’s PIB explainer on the AA network adds that data is encrypted by the sender and can be decrypted only by the recipient, so the AA itself cannot see it.

Where can Account Aggregator users still get hurt?

The rules protect the pipe, not your choices. Once you approve a request, the lender or app you named receives the data for the purpose stated, and revoking later may not undo what was already shared.

Situation	Genuine AA request	Warning sign
Where it starts	Inside an app or site you opened to apply for something	A call, SMS or WhatsApp link you did not ask for
What it asks for	Your approval on a consent screen	Your OTP, PIN, net banking password or screen share
Who gets the data	A named, regulated lender or entity	A vague or unknown recipient
Purpose and expiry	Clearly stated, with an expiry date	Missing, or far longer than the task needs

The Department of Financial Services’ Account Aggregator framework page says 17 companies hold RBI certificates as AAs. If an app claims to be an AA, it is reasonable to ask for its RBI registration details before you link anything.

How do you read an Account Aggregator consent request?

Under the Master Direction, the consent artefact must show what information is requested, the purpose, the recipients, and the consent creation and expiry dates. Check each one against what you are actually trying to do.

Here is an illustrative example. A loan app asks for 24 months of past statements and wants to fetch fresh data every month for 12 months. If you approve, the lender could end up seeing about 36 months of your transactions. If you only need a one-time eligibility check, a shorter window or a single fetch may be enough, so look for that option or decline.

Wider access is not free. Every extra month shared shows more of your spending, and a lender may also use what it sees to spot existing high cost debt. If your statements show several EMIs or card dues at high rates, it may be worth checking whether one structured EMI would cost less in total. Check your options with BillCut.

BillCut’s guide on sharing less through AA logins covers how to keep each request narrow.

How do you revoke Account Aggregator consent?

Every AA must offer a way to revoke consent. When you revoke, a fresh consent artefact is shared with the financial information provider, such as your bank. Steps differ by app, but usually look like this:

1. Open your AA app and find the list of active consents.
2. Check each recipient and expiry date against the record of consents the AA must show you.
3. Revoke consents for lenders you did not borrow from, or for tasks already completed.
4. Keep a screenshot of the revocation in case you need to complain later.

How do you complain about an Account Aggregator?

Start with the AA itself. The Master Direction requires each AA to have a board approved grievance policy and to resolve complaints within one month of receiving them. If it does not, the customer may appeal to the RBI.

If you were tricked into sharing an OTP or PIN, or money has left your account, report it at once on the National Cyber Crime portal or call 1930, and tell your bank. BillCut explains how fraudsters use SIM swaps to target borrowers.

What should you do to use Account Aggregators safely?

1. Start AA linking only from an app or site you opened yourself.
2. Never share an OTP, PIN or password with anyone, including callers who say they are from an AA.
3. Read the recipient, purpose and expiry date before approving.
4. Review and revoke unused consents every few months.
5. Complain to the AA in writing first, and keep records of every step.

The RBI announced on 7 October 2026 that NBFC-AAs will be made interoperable, with a target of 31 December 2026, so you can use any AA of your choice. More choice may mean more apps asking you to link accounts, which makes these checks matter more.

How BillCut can help

BillCut is a balance transfer and debt reduction platform. It works with lending partners to help eligible borrowers move high interest dues, such as credit card balances and personal loan EMIs, into one structured EMI. BillCut earns from helping borrowers refinance, so it has an interest in this option. Approval and terms depend on the partner lender. For more on your data rights as a borrower, see BillCut’s guide to data consent rules for borrowers.

Frequently asked questions

Disclaimer: this article is for general information only and is not financial or legal advice. The example figures are illustrative. Check your app settings and documents, and speak to your bank or a qualified professional before making decisions.