Borrowing on your phone is convenient — and it's also where most lending fraud now happens. RBI's digital-lending framework gives you clear protections. Know them, and you can borrow online safely.
What RBI's digital-lending rules give you
The RBI's guidelines require that:
- Loans are disbursed straight to your bank account and repayments go straight to the lender — no money should route through a third-party app's account.
- You get a Key Fact Statement (KFS) with the all-in APR before you borrow.
- All fees are disclosed upfront; nothing hidden.
- There is a cooling-off / look-up period to exit a loan by repaying principal and proportionate charges.
- The app must name the regulated lender (bank/NBFC) behind it and give a grievance-redressal contact.
- Data collection must be need-based and with consent — an app has no business demanding your full contacts, photos or messages.
Warning signs of a predatory app
- Advance fee demanded before disbursal, especially to a personal UPI/account.
- Asks for permission to your contact list, gallery, or all SMS — a classic setup for harassment and extortion.
- No named regulated lender, no written agreement, no KFS.
- Impossibly fast "instant" approval with no verification, then punishing rollovers.
- Rates and penalties that aren't disclosed until after you're in.
If an app can see your contacts and photos, it can weaponise them. That permission request alone is reason to uninstall.
How to borrow online safely
- Verify the lender. Confirm the actual bank/NBFC named in the app is RBI-regulated.
- Read the KFS. Know the APR and total repayable before accepting.
- Check permissions. Deny access to contacts, gallery and SMS; a legitimate lender doesn't need them.
- Keep records. Save the sanction letter, agreement and payment receipts.
- Use the grievance channel. Regulated lenders must provide one; escalate to the RBI ombudsman if unresolved.
If you're being harassed
Recovery harassment, threats, or misuse of your photos/contacts are illegal. Preserve evidence, file a complaint on the national cybercrime portal, and report the lender to the RBI. You have rights regardless of whether you missed a payment.
The safest digital borrowing is boring: a named regulated lender, a clear KFS, money to your bank account, minimal permissions. Platforms like IndiaCard deliberately keep to that model — matching you to regulated lenders, with the terms shown before you commit.