How to Spot Fake Loan Apps and Find Safe Online Payday Loans

A safe online payday loan in India comes from a bank or an RBI-registered NBFC, is offered either directly or through a disclosed Lending Service Provider (LSP), gives you a Key Fact Statement before you accept, and never asks for money up front. A fake loan app does the opposite: it hides the lender, charges a fee before disbursal, grabs your contacts and photos, and pressures you to accept before you can check anything.

This article explains the RBI rules that protect you, how to verify any lender or app, the red flags of fraud, and what to do if you have been cheated.

Why fake loan apps exist, and why they target short-term borrowers

People searching for a payday loan are usually in a hurry, which is what fraudsters exploit. The typical fake app either collects an "insurance", "processing" or "GST" fee and disappears, or disburses a small amount, inflates the dues with invented charges, and uses your harvested contact list to threaten and shame you into paying.

Removed apps reappear under new names, so the protection that works is knowing how to verify, not memorising a list.

What RBI's digital lending rules require

RBI issued its Guidelines on Digital Lending in September 2022 and consolidated them into the Digital Lending Directions in 2025. The rules apply to every bank and NBFC and to any LSP acting for them. The requirements that matter most to a borrower are:

• Only a regulated entity (RE) can lend. An app or website that is not itself a bank or NBFC must be an LSP acting for a named RE, and that RE's name must be shown to you before you apply.
• Loan money must flow directly from the lender's bank account to yours, and repayments must go back to the lender's account. No pass-through accounts of the LSP or a third party.
• You must receive a standardised Key Fact Statement (KFS) showing the Annual Percentage Rate, all fees, the recovery mechanism and the grievance officer's details, before you sign.
• Any fee the lender pays the LSP cannot be charged to you separately.
• Apps may only collect data needed for the loan, with your explicit consent, and must not access your contacts, call logs, files or media; one-time camera, microphone or location access for KYC is allowed.
• You get a cooling-off period during which you can exit the loan by paying principal and proportionate charges, with no penalty.
• The lender must appoint a nodal grievance officer, and both the lender and the LSP must publish their contact details. If your complaint is not resolved within 30 days, you can escalate to the RBI Ombudsman.

How to verify a lender or LSP in five steps

Step 1: Find the name of the actual lender

Open the app's or website's "About", "Partners" or "Lending partner" page and look for a company name followed by "an RBI-registered NBFC" or a bank name. If you cannot find any lender name, or the only name is the app's own brand, stop. On CreditThirty, for instance, the LSP is MD Finlabs Private Limited and the lender is Salora Capital Limited, an RBI-registered NBFC; this is disclosed on the site and on the partners page.

Step 2: Check the lender on RBI's register

Go to the RBI website and open the list of registered NBFCs. Search for the exact legal name. Check that the registration is active; RBI publishes a separate list of cancelled registrations. For banks, confirm the bank is on RBI's list of scheduled banks.

Step 3: Cross-check the LSP on the lender's own website

RBI requires every lender to publish, on its own website, the list of LSPs and digital lending apps it works with. Find the lender's official site (type the address yourself; do not follow a link from the app) and confirm the app or platform you are using is listed there.

Step 4: Check the app store listing and the privacy policy

On the Google Play Store or Apple App Store, a legitimate lending app shows the developer name, the regulated entity it works with, and a privacy policy link. Read what permissions it asks for. If it wants your contacts, SMS history, call logs or gallery, it is breaking RBI rules regardless of who the lender is. Never install a loan app from an APK file or a link sent on WhatsApp or Telegram.

Step 5: Look for the KFS, the grievance officer and the cooling-off period

Before accepting, you must be shown a KFS with an APR and every charge. The app or website should also display a grievance redressal policy with a named nodal officer and the RBI Ombudsman escalation route; see ours at /grievance-redressal-policy. If any of these is missing, or the app wants you to accept before the KFS appears, walk away.

Red flags that reliably identify a fake or predatory loan app

What a safe online payday loan looks like in practice

A safe short-term loan process has a recognisable shape. You see the lender's name before you start. You complete KYC through official channels (PAN, Aadhaar OTP, DigiLocker or video KYC) inside the app, never by messaging documents to a person. You are shown a KFS with the APR, the net amount you will receive, the repayment date and every fee, and you have time to read it. Funds arrive from, and repayments go to, the lender's own account. If you have a problem, there is a named grievance officer and a path to the RBI Ombudsman.

Our how it works and charges and fees pages describe this flow for CreditThirty; the exact charges for any loan are set by the lender and shown in your KFS before acceptance.

What to do if you have been cheated or harassed

If you have paid an upfront fee and heard nothing back, or an app is demanding inflated sums and threatening you, act in this order.

1. Stop paying. Do not pay "settlement" amounts to make the harassment stop; it signals that the tactic works.
2. Preserve evidence. Take screenshots of the app, chats, call logs, UPI and bank transactions, and any threatening messages. Note the app name, developer name, UPI IDs and bank accounts money went to or came from.
3. File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in, which also lists the national cybercrime helpline, or file an FIR at your local police station.
4. Report the entity on RBI's Sachet portal (sachet.rbi.org.in), which exists to flag unregistered entities and unauthorised lending so regulators and state police can act.
5. Tell your bank. Ask them to block any e-mandate or standing instruction linked to the app and to flag the counterparty accounts. If money was taken by fraud, your bank's dispute process applies.
6. Revoke the app's contacts, storage and SMS permissions in your phone settings, uninstall it, and warn your contacts that they may receive calls using your name.
7. If the lender is a genuine regulated entity behaving badly (for example, harassment by a recovery agent), complain to its grievance officer in writing, and if unresolved after 30 days, escalate to the RBI Ombudsman through the Complaint Management System at cms.rbi.org.in.

Protecting your credit file after a scam

If you shared your PAN and Aadhaar with a fake app, pull your credit report from CIBIL or another bureau within a few weeks and again after three months. If you find an enquiry or account you do not recognise, raise a dispute with the bureau and the lender named, attaching your cybercrime complaint number.

Key takeaways

• Only a bank or RBI-registered NBFC can lend; an app or website is either that lender or a disclosed LSP acting for it.
• Verify in five steps: find the lender name, check it on RBI's NBFC list, confirm the LSP on the lender's own website, inspect the app store listing and permissions, and insist on a KFS and grievance details before accepting.
• Any fee before disbursal, any request for contacts or gallery access, and any claim that approval is certain are hallmarks of fraud.
• Funds must come from and return to the lender's own bank account, never through a third party.
• If cheated: stop paying, keep evidence, report on cybercrime.gov.in and RBI Sachet, alert your bank, revoke permissions, and check your credit report.

Frequently asked questions

How do I check if a loan app is approved by RBI?

RBI does not approve apps directly. It regulates lenders. Find the name of the bank or NBFC behind the app, then look it up on the RBI website's list of registered NBFCs or banks. Also confirm that the lender's own official website names the app or platform as its Lending Service Provider.

What are the biggest red flags of a fake loan app?

Asking for a fee before the loan is paid out, demanding access to your contacts and photo gallery, no named RBI-regulated lender, no Key Fact Statement, pressure to accept quickly, communication only through WhatsApp or Telegram, and an APK download link instead of an official app store listing. Any one of these should make you pause.

What should I do if a fake loan app has cheated or harassed me?

Stop paying, keep screenshots and transaction records, file a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in), report the entity on RBI's Sachet portal, alert your bank to block further debits, and uninstall the app after revoking its permissions.