Fake Loan Apps in 2026 - The RBI Verified DLA Directory Explained
The Indian digital lending market added roughly 400 new consumer apps between 2023 and 2025. A significant fraction of them were unauthorised, scam-adjacent, or outright fraudulent. This guide is written by someone who has watched this ecosystem evolve from inside a regulated NBFC and can walk you through the exact verification steps that separate legitimate lenders from the ones you should never share your Aadhaar with.
What the RBI verified DLA directory is
Since July 1, 2025, the Reserve Bank of India has operated a centralised public directory of all Digital Lending Applications (DLAs) authorised to offer loans in India. The directory lists every DLA that is either owned by or operated on behalf of an RBI-regulated entity (a bank, NBFC, or housing finance company).
The directory is accessible at rbi.org.in and updates automatically whenever a regulated entity adds or removes a partner DLA from its books. Any lending app not listed in the directory is either unauthorised or operating outside the RBI framework.
Before applying for any personal loan through an app or website, verify the DLA in the directory. This is the single most useful two-minute check a borrower can do to protect themselves from fraud.
Why the directory matters
Before this directory existed, borrowers had no straightforward way to check whether a lending app was legitimate. Reviews on Play Store and App Store were often manipulated. Company websites looked professional. Customer service numbers answered promptly. The scam infrastructure had reached a level of sophistication where casual due diligence was easy to defeat.
The directory shortcuts that entire due diligence process. If the DLA is listed, it is operating under RBI supervision. Complaints are actionable. Recovery practices are constrained. Data handling follows the framework. If it is not listed, none of those protections apply.
The scale of the problem justifies the caution. Between 2020 and 2024, the RBI recorded over 50,000 consumer grievances tied to unauthorised digital lending. Complaints included harassment during recovery, unauthorised access to contacts, morphed image threats, and hidden fees that turned a Rs. 10,000 loan into a Rs. 40,000 debt within weeks.
Verify the DLA name exactly as it appears on the app store listing, not the marketing name used in advertisements. Fraudulent apps often use display names that closely mimic legitimate ones (for example, “InstaCredit Pro” instead of “InstaCredit” from a well-known NBFC). The directory search should match the DLA name exactly to the entity’s regulated name. If the match is only approximate, that is a red flag worth investigating further. The RBI directory also lists the parent regulated entity for each DLA, so a legitimate app should always trace back to a bank or NBFC you can look up on the RBI’s separate list of regulated entities.
The seven red flags of a fraudulent lending app
Even before checking the RBI directory, certain patterns almost always indicate a fraudulent or unauthorised lender.
- Excessive permissions on install. Legitimate lending apps need access to SMS (for OTP), storage (for document upload), and camera (for KYC selfie). They do not need access to your full contact list, call logs, media gallery, or location history. Any app requesting these permissions is likely harvesting data for use in aggressive recovery.
- Interest rate quoted only after loan approval. Legitimate lenders quote rates upfront through a Key Fact Statement. Fraudulent apps often display a headline like “loan available in 5 minutes” without any rate information until after you have submitted documents.
- Processing fee deducted before disbursement. Regulated lenders deduct fees from the disbursed amount or bill them into the EMI. Any app that asks you to pay a fee via UPI to a personal account before releasing the loan is fraudulent.
- Loan sanctioned within minutes without CIBIL check. Every regulated lender pulls your CIBIL report before sanction. An “instant approval without credit check” pitch is almost always a fraud.
- Communication only through WhatsApp with personal numbers. Regulated entities use official domain email addresses and customer service numbers listed on their websites. Personal WhatsApp numbers are a strong fraud signal.
- Threats of contact-list access during collection. Any lender that suggests during onboarding that they can contact your family or employer in case of default is signalling illegal collection practices.
- App not available on official Play Store or App Store. Legitimate apps are almost always on official stores. Apps distributed through APK downloads or third-party links are usually operating outside the regulatory framework.
What to do if you have already fallen into a fake app trap
If you have taken a loan from an app that turns out to be fraudulent, do three things immediately.
Stop paying via the app’s UPI links or accounts. Any further payment locks you deeper into the extortion pattern. Legitimate loans are recorded on your bureau; fraudulent loans typically are not, so non-payment does not damage your CIBIL score.
File a complaint on the RBI CMS portal at cms.rbi.org.in and simultaneously report the app to CERT-In and the Cyber Crime portal at cybercrime.gov.in. Provide screenshots of the loan agreement, transaction history, and any threats received.
If the app threatens to contact your family or share morphed images, file a criminal complaint at your local police station. These threats are cognisable offences under the Bharatiya Nyaya Sanhita and the IT Act. The RBI framework specifically prohibits accessing personal data on borrower devices during recovery.
Legitimate apps to consider instead
Our detailed comparison of established digital lenders in the best personal loan apps guide and the specific comparison of KreditBee, MoneyTap, and Fibe walks through the mainstream regulated options and where each one is most competitive.
For most salaried borrowers, the safest routes remain the digital lending arms of large banks (HDFC PayZapp, SBI YONO Personal Loan, ICICI iMobile) and established NBFCs (Bajaj Finserv, Tata Capital, Poonawalla). These are all listed on the RBI directory and operate under full RBI supervision. Before formally applying to any of them, run your numbers through the personal loan eligibility checker to get an indicative offer without triggering a hard bureau inquiry.
The most common fraud vector in 2025 and 2026 has been apps offering Rs. 10,000 to Rs. 50,000 short-tenure loans (7 to 30 days) at eye-watering effective rates that are advertised as low weekly fees. A “Rs. 100 per week fee” on a Rs. 10,000 loan for 7 days is an annualised rate of over 500 percent. These apps target borrowers in emergency situations and typically use aggressive collection immediately. Any legitimate NBFC lends at rates under 36 percent per annum. Anything above that ceiling is legally suspect and operationally dangerous, regardless of how the pricing is disguised.
What to check before every future loan
Whenever you consider a new digital loan, run this sequence in order. Search the app name on the RBI DLA directory. Confirm the parent regulated entity is a bank or NBFC listed separately on rbi.org.in. Check that the app requests only necessary permissions on install. Read the Key Fact Statement before you accept the loan. Verify that the interest rate does not exceed 36 percent per annum.
Any single failure across these five checks is enough reason to walk away. There are always other legitimate lenders. There is no loan urgent enough to justify going to an unauthorised app.
This guide was written by practitioners who have worked on personal loan product design, credit policy, and underwriting at Indian banks and NBFCs. We write from the inside of the system - not from a generic content brief. Data, lender rates, and eligibility criteria are verified quarterly. If you spot an error or outdated figure, write to us.
Use our free tools to check your eligibility and calculate your EMI before you apply - no signup required.