A polished app, instant eligibility message or Play Store listing does not tell you who is legally lending the money. Before you share PAN, Aadhaar, bank statements or salary data, write down the legal name of the bank or NBFC that will appear as the creditor. The same entity should be identifiable in the Key Facts Statement, sanction communication, loan agreement and repayment instructions. If the app cannot clearly tell you who the regulated lender is, stop there.
The fastest useful check is to ignore the advertised EMI and compare cash you actually receive with cash you are contractually required to repay. A ₹2,00,000 sanction is not the same as ₹2,00,000 in your bank account if processing fees, taxes or bundled products are deducted before disbursal. Record the sanctioned amount, every upfront deduction, net amount received, APR, number of instalments and total repayment. That single worksheet exposes many offers that look cheap only because the marketing headline hides the all-in cost.
| Check | What good evidence looks like | Red flag |
|---|---|---|
| Actual lender | Same bank/NBFC name across KFS, agreement and repayment channel | Only the app brand is visible |
| Cost | APR, fees and repayment schedule in writing | Only a daily rate or EMI is advertised |
| Disbursal | Clear trail showing who sent the money and how deductions were calculated | Unexplained deductions or third-party collection |
| Data | Permissions that are proportionate to onboarding and servicing | Pressure to grant unrelated access to contacts, photos or files |
| Recovery | Named lender grievance channel and documented communication | Threats, public shaming or demands through unknown personal accounts |
Do the five-minute legitimacy test before accepting
- Identify the legal lender. Verify the name independently rather than relying on a logo inside the app.
- Open the Key Facts Statement. Read the APR and every fee before accepting the loan.
- Calculate net cash received. Subtract every upfront deduction from the sanctioned amount.
- Check the repayment destination. Do not send instalments to an unrelated personal UPI ID because a caller tells you to.
- Save the evidence. Keep the KFS, agreement, sanction letter, repayment schedule, screenshots and complaint references in one folder.
For suspicious entities or schemes, use official RBI resources such as Sachet and verify current directions on the RBI website. For an eligible unresolved complaint against a regulated entity, the current RBI complaint system now identifies the Reserve Bank–Integrated Ombudsman Scheme, 2026; use the live CMS portal rather than following an old 2021-only article.
If the loan has already been disbursed and something looks wrong
Separate the problem into four buckets: cost mismatch, data misuse, repayment mismatch, or recovery conduct. For a cost mismatch, compare the KFS and sanction letter with the bank credit and first statement. For a repayment mismatch, ask the regulated lender in writing to confirm the authorised payment channel. For abusive recovery or data misuse, preserve call logs, messages and screenshots before blocking numbers or deleting the app. If you believe there is cyber-enabled fraud, use the official National Cyber Crime Reporting Portal as appropriate.
The practical decision rule
Do not ask, “Is this app popular?” Ask, “Can I independently identify the regulated lender, reconcile the exact cost, understand the data access, and prove every payment?” If any one of those four answers is no, the loan is not ready to accept. A legitimate loan can still be expensive, but an expensive loan should at least be transparent enough to audit before you sign.