India's digital lending sector has grown faster than the collections practices around it, and the gap between the two shows up regularly as cyber crime complaints. A recovery call that goes too far, a WhatsApp message sent to a borrower's family, or a contact list scraped from the app at onboarding and used to pressure repayment — each of these can move a lending app from a civil default matter into a criminal complaint, sometimes overnight.
This matters for two different audiences: borrowers who are being harassed and need to know what recourse exists, and lending platforms — and the collections agencies or individual agents they engage — who need to understand exactly where the legal line sits before a routine recovery escalates into an FIR.
Where recovery practices become a crime
Chasing a genuine default is not, by itself, illegal. What tips lawful recovery into a cyber crime or harassment complaint is usually one or more of the following:
- Contacting people in the borrower's phone contact list who have no connection to the loan, especially where consent to access those contacts was buried in an app permission rather than clearly obtained
- Morphing or circulating a borrower's photograph, or threatening to do so, to pressure repayment
- Repeated calls or messages at a volume or hour that amounts to harassment or criminal intimidation
- Threats of arrest, defamation, or exposure to an employer that the agent has no actual authority to carry out
- Publishing or threatening to publish a "defaulter list" naming the borrower to third parties
The sections typically invoked
Complaints of this kind are usually filed under a combination of provisions: Sections 66C and 66E of the IT Act where identity or private images are misused, the Bharatiya Nyaya Sanhita's provisions on criminal intimidation and defamation, and — where the harassment is directed particularly at a woman borrower — the crime-against-women provisions covered at crime against women matters. Where the underlying app itself is unlicensed or operating outside RBI's digital lending guidelines, the complaint can also draw in economic offence provisions, moving it toward EOW-type scrutiny.
If you're the borrower being harassed
Preserve everything before you respond to anything — screenshots of messages, call logs with timestamps, and the exact identity of who is contacting you (agent name, number, and which app or agency they claim to represent). A complaint can be filed with the cyber cell or through cybercrime.gov.in, and where the harassment involves morphed images or threats of image circulation, that falls squarely within sextortion-adjacent provisions that are handled with the complainant's identity protected — see cyber crime cases generally for how these are approached.
It is worth being clear-eyed about one thing: being genuinely in default does not forfeit your protection against harassment. The two are legally separate questions, and a lender's remedy for a default is civil recovery or a properly conducted process — not intimidation.
If you run a lending platform or collections operation
The exposure here is not limited to the field agent who sent an inappropriate message. RBI's digital lending guidelines place responsibility on the regulated entity for the conduct of its recovery agents and outsourced collections partners, and a pattern of complaints against agents acting under your brand can expose the company and its officers, not just the individual agent. This is one of the exposure categories covered in more depth at cyber crime legal services for fintech companies.
Practically, this means three things: a written, RBI-compliant collections policy that agents are actually trained on rather than one that exists only on paper; a documented escalation and complaint-handling process so a single agent's conduct doesn't become a pattern before anyone notices; and a clear separation, in writing, between the platform's obligations and any third-party collections agency's conduct — because that separation is exactly what gets tested if a complaint is filed.
Where a complaint against the company is a genuine risk vs a mislabelled dispute
Not every borrower complaint against a lending platform reflects genuine wrongdoing — some are filed by borrowers seeking leverage against a legitimate recovery effort. Distinguishing a real harassment pattern from a defensive complaint filed to delay repayment requires looking at the actual conduct on record, not just the borrower's characterisation of it. Where a complaint is, on close reading, a repayment dispute dressed as a criminal allegation, a quashing petition may be the appropriate response rather than a prolonged criminal defence.
What to bring to a consultation
For a borrower: screenshots and call logs, the loan agreement or app terms if available, and any identifying details of the agent or number involved. For a platform: the recovery policy in force at the time, the specific agent's communication records, and any prior complaints against the same agent or vendor.
Frequently asked questions
Is it illegal for a lending app to contact people in my phone's contact list?
It depends on how consent was obtained and how those contacts are used. Contacting unrelated third parties to pressure repayment, especially where consent was not clearly and specifically given for that purpose, is a recognised basis for a harassment complaint.
Can I file a police complaint even though I actually owe the money?
Yes. Being in default does not remove your protection against harassment, threats or misuse of your data. The debt is a separate civil matter from the conduct used to recover it.
What should a lending platform do if a customer complains about a recovery agent?
Investigate and document the specific communication immediately, don't wait for a pattern to form before acting, and be prepared to demonstrate — in writing — that the conduct was outside company policy if that's genuinely the case. A documented, prompt response is one of the strongest protections against the complaint escalating to the company itself.
Can the lending company be held responsible for what an outsourced collections agency did?
Often yes, at least in terms of regulatory exposure — RBI's digital lending framework places responsibility on the regulated entity for its outsourced recovery conduct, regardless of the contractual arrangement with the agency.
For a free first consultation — whether you're being harassed by a recovery agent or managing exposure as a platform — call +91 82954 13475 at any hour, or send the details of your matter.
Facing this yourself?
Call +91 82954 13475 or send the details. The first consultation is free. This post is general information and is not advice on any particular case.