Most warnings about fake loan apps stop at "be careful". That is not very useful, because the apps that cause the damage are designed to look careful themselves: a clean logo, a Play Store listing with thousands of reviews, a customer care number that someone answers. What helps more is understanding the machine behind the screen. Fake loan apps run a four-stage playbook, and every stage has a moment where you can still walk away without losing anything.
I have reconstructed that playbook from complaints filed by readers, from police advisories, and from a few conversations with people who went all the way to stage four. The stages below are in the order they happen.
Stage one: the approval that arrives too fast
A genuine lender has to check who you are and whether you can repay. That takes a KYC step, a credit bureau pull, and some form of income evidence. A fake app skips most of this. You enter a phone number, allow a few permissions, and within minutes a screen says "Congratulations, you are approved for ₹40,000".
The speed is the first tell. Regulated lenders can be quick, but they cannot be instant for a first-time borrower, because the bureau pull and KYC are mandatory. If an app approves you before it has seen your PAN, your Aadhaar and your bank statement, it has not approved anything. It has started a sales funnel.
Stage two: permissions that have nothing to do with lending
Before you see the money, the app asks for access. Contacts, photos, call logs, SMS, sometimes location and the microphone. The reason given is "verification". The real reason is leverage for stage four.
Permission requested | Legitimate lending use | Why a fake app wants it |
|---|---|---|
SMS read | Bank OTP auto-fill, sometimes income signals | Harvest OTPs and bank balance messages |
Contacts | None | Threaten and message your family and employer |
Photos and files | KYC document upload only | Pull personal images for edited "defaulter" posters |
Call logs | None | Build a pressure list of frequent contacts |
Location | Fraud checks, optional | Track and intimidate |
RBI's digital lending rules say a lending app may access only what is needed for KYC and the loan, and must take your consent for each item. An app that refuses to proceed unless you grant contacts and photos is already outside those rules, and this is the cheapest point to stop: uninstall before the next screen.
Stage three: the fee before the loan
Now the app asks for money. The label varies: processing fee, GST on the loan, insurance, "account verification deposit", or a small sum to "activate" the disbursal. The amount is usually between ₹500 and ₹5,000, chosen to feel small against the loan you were promised.
No regulated lender in India collects a fee before disbursing. Processing charges are deducted from the loan amount or added to the EMI schedule; they are never collected upfront by UPI to a personal account or a wallet. If you pay, one of two things happens. Either the app vanishes and the money is gone, or the loan is disbursed at a far smaller amount than promised, which leads to stage four.
Stage four: the seven-day loan and the collection machine
Some fake apps do pay out, because the real business is not the loan, it is the recovery. A typical pattern: you were promised ₹40,000 for 90 days, and ₹6,000 lands in your account with a repayment of ₹9,500 due in seven days. The "difference" is a processing deduction you never agreed to. The annualised interest on such a loan runs into thousands of percent.
When the seven days pass, the collection starts. It uses everything gathered in stage two: calls to your contacts describing you as a fraudster, edited photos sent to your family, messages to your employer. The goal is not to recover ₹9,500. It is to make you take a second loan from a sister app to pay the first, and a third to pay the second.
What a regulated lender does | What a fake app does |
|---|---|
Discloses the full cost in a Key Fact Statement before you accept | Hides fees until money is deducted |
Disburses to your bank account from the lender's account | Disburses from individual or shell accounts |
Gives a cooling-off period to exit without penalty | Starts the clock the moment money lands |
Recovers through registered agents with a grievance officer | Harasses contacts gathered from your phone |
Reports the loan to credit bureaus | Never reports, because it is not a lender |
The checks that take ten minutes
Before you install any lending app, four checks cover most of the risk. First, find the regulated entity behind the app; every legitimate app names a bank or NBFC partner, and that name should appear in the Play Store listing, the website and the loan agreement. Second, search that partner on the RBI's published list of registered NBFCs. Third, read the permissions screen before granting anything and refuse contacts and photos. Fourth, look for a Key Fact Statement with the annual percentage rate, the total repayable amount and the grievance officer's contact.
For a longer treatment of the registration check, see RBI-registered loan apps in India, and for the broader question of whether app lending is safe at all, are loan apps safe in India covers the ground. TrueBalance also publishes a compact five-point version of this check at truebalance.io/articles/how-to-spot-a-fake-loan-app that is handy to send to a family member who is about to install something. Established apps such as KreditBee, Navi and CASHe pass all four checks; that is the baseline any new app should meet before it earns a single permission.
What legitimate speed looks like
It is worth saying clearly that fast is not the same as fake. A registered lending app with a returning customer whose KYC is already complete can genuinely approve and disburse in minutes. The difference is in what happened before that speed: a real KYC, a real bureau check, a Key Fact Statement you could read, and money arriving from a named lender's account into yours with no fee asked in between. Speed after those steps is a product feature. Speed instead of those steps is the scam.
If you are already inside the machine
If you paid a fee and nothing arrived, stop paying and report. If you received a small loan and the harassment has begun, do not take a second loan to pay the first; that is the trap's only real mechanism. Collect evidence: screenshots of the app, the UPI transaction, the threatening messages. File a complaint on the National Cyber Crime Reporting Portal or call 1930, and inform your bank so the account can be watched. Tell the people in your contacts that messages about you are from a scam; the threat loses most of its force once the audience knows.
A loan from an unregistered app is not enforceable in the way a bank loan is, and the harassment is itself a crime. You are the complainant here, not the defaulter.
How the money actually moves
One more pattern separates the two worlds. A regulated lender disburses from its own current account, and the narration on your bank statement names the NBFC or bank. A fake app sends money through a chain of individual accounts and wallets, often from a different name each time, and asks you to repay by UPI to yet another personal handle. If the sender on your statement is a person rather than a company, that single line tells you everything the glossy app screen was built to hide.
Why this keeps working
The playbook works because each stage asks for a little more than the last, and each step feels like protecting the money already committed. That is the same logic that keeps people in any sunk-cost trap. Knowing the four stages in advance breaks the logic: you can see the whole shape before stage one ends, and uninstalling at the permissions screen costs nothing at all.
Frequently asked questions
The app is on the Play Store with good reviews. Is it safe? Not on that basis. Fake apps buy reviews and are often removed only after complaints accumulate. Check the regulated partner and the permissions, not the rating.
Can a real lender ask for an upfront fee? No. Processing charges come out of the disbursal or the EMI schedule. Any request to pay before you receive the loan is a scam signal.
Will a loan from a fake app affect my CIBIL score? Usually not, because unregistered apps do not report to the bureaus. The damage is financial and personal, not to the score.
They have my contacts. What can I do? Warn your contacts first, then report with evidence. Harassment of third parties is a criminal offence regardless of any amount owed.
Is a small loan from a new app worth trying to see if it is genuine? No. Run the four checks instead. A genuine lender passes them on the first screen; a fake one cannot pass any of them.