What can I do if a digital lending app harasses me for loan recovery?

A loan app I borrowed a small amount from is calling my contacts, sending abusive messages and threatening me even though I only missed one due date. What protection do I have under RBI's digital lending rules? I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

What can I do if a digital lending app harasses me for loan recovery? is governed in India primarily by RBI Digital Lending Guidelines 2022, Reserve Bank of India Act 1934, Section 45-IA, Information Technology Act 2000, Section 66E and Indian Penal Code 1860, Section 507. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

The RBI Digital Lending Guidelines 2022 mandate that recovery agents of regulated entities and their Lending Service Providers cannot contact the borrower's contact list, use threatening language or call outside 8 am to 7 pm.

Every digital loan must be routed through a bank or NBFC regulated by the RBI under Section 45-IA of the RBI Act, and unregulated apps operating outside this framework are themselves acting illegally.

Accessing a borrower's phone contacts or photos without explicit consent, and circulating them, can amount to an offence under Section 66E of the Information Technology Act 2000 for violation of privacy.

Criminal intimidation of the borrower or family members through threats of harm or reputational damage is punishable under Section 507 of the Indian Penal Code 1860 for anonymous criminal intimidation.

The RBI requires the regulated entity to be accountable for its outsourced recovery agents' conduct, so the borrower can hold the bank or NBFC responsible even if the harassment came from a third-party app or agency.

What to do next: 1) Save screenshots, call recordings and messages as evidence of the harassment and threats; 2) File a written complaint with the regulated entity's grievance redressal officer and, if unresolved, escalate to the RBI Ombudsman; 3) Lodge a complaint with the local cyber crime cell or police station citing the specific IT Act and IPC provisions; 4) Report the app to the RBI and the app store if it is not listed as a registered digital lending app.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under RBI Digital Lending Guidelines 2022 carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.

Disclaimer: This information is for general awareness and does not constitute legal advice. Statutes and their interpretation change, and outcomes depend on the facts of your case. Please consult a qualified advocate before acting on it.