Financial frauds in the banking sector reached Rs 36,014 crore in 2024–25, up from Rs 12,230 crore the previous year, according to the Reserve Bank of India's (RBI) Annual Report 2025. A growing number of these cases involved digital platforms, including unauthorised lending apps that misuse personal data or deploy aggressive recovery practices.
These risks are more common among first-time borrowers, many of whom access quick loans through mobile apps without verifying their legitimacy. Cases involving data theft, blackmail and harassment have been reported by law enforcement agencies across the country.
Advertisement
RBI Whitelist Aims to Guide Borrowers
To bring clarity and protect borrowers, RBI released a whitelist of around 1,600 authorised digital lending apps in July 2025. These apps are operated by regulated banks or non-banking financial companies (NBFCs), and are legally permitted to offer loans in India.
Borrowers can refer to the list, available on RBI's official website, to verify if an app is legitimate. Some of the verified lenders include Aditya Birla Capital Limited, Apollo Finvest (India) Ltd., AU Small Finance Bank Limited and Godrej Finance Limited, and so on.
Namita Viswanath, partner at CMS IndusLaw, said, "This list comprises apps that are linked to regulated entities and comply with the RBI's Digital Lending Guidelines, through which borrowers now have a resource to verify whether a lending app is legitimate, which helps distinguish them from unregulated or fraudulent platforms."
Advertisement
This has been further reinforced by RBI by sharing a whitelist of 442 unique digital lending apps with the Ministry of Electronics and Information Technology (MeitY). Based on this list, around 3,500 lending apps were reviewed, leading to the removal of over 2,200 apps from the Google Play Store. Google has also revised its onboarding policy to ensure that only lending apps affiliated with licensed banks or NBFCs can be listed on its app platform.
Gaps in Enforcement Remains
Despite these measures, unregulated loan apps are still accessible via unofficial sources. Many imitate the names and branding of authorised apps, making it hard for borrowers to tell them apart. RBI has warned the public about such apps and advised verification through official sources.
Advertisement
In its notifications and public comments, the RBI has pointed out that many unauthorised apps request excessive permissions, such as access to contacts and photos, which can later be misused for coercive recovery tactics.
New Rules for Safer Lending
To tighten digital lending practices, the RBI issued revised Digital Lending Directions in May 2025. These rules require regulated lenders to provide borrowers with a Key Fact Statement (KFS) that outlines interest rates, repayment terms, processing fees and the annual percentage rate.
"Lenders must ensure transparency by sharing the KFS, privacy policies and loan terms through SMS or email upon execution of the loan," said Viswanath. She also noted that borrowers must be informed in advance, via SMS or email, about the identity of any authorised recovery agent before being contacted.
Advertisement
The guidelines mandate that lending apps must collect only essential personal data after obtaining clear and informed consent. All data must be stored on servers located in India. Loans must be disbursed directly to the borrower's bank account, and repayments must go directly to the regulated entity.
For loan aggregator platforms, the guidelines state that offers must be presented without bias, based on publicly disclosed ranking criteria, and without promoting specific products. All repayment obligations must be clearly shown to help borrowers make informed comparisons.
Awareness Still a Challenge
While regulations are in place, borrower awareness remains a concern, especially in smaller towns where digital lending is expanding. Viswanath gives utmost importance to financial literacy, especially in places where digital lending is expanding rapidly. "Borrowers must understand the importance of using only RBI-approved lending apps to mitigate their risk exposure," said Viswanath.
She added, "Borrowers should also be informed about their rights regarding grievance redressal... proper channels for raising complaints, including with the nodal grievance officers of the regulated lenders and lending service providers...since lending practices and procedures are a by-product of lender behaviour and complaints, with the regulations stemming from the same."
RBI has continued to urge users to avoid downloading apps from unofficial sources like APKs or social media links. It also advises borrowers to check whether the app is backed by a regulated entity and avoid platforms requesting excessive access to device data.
The whitelist of authorised digital lending apps is available on the RBI's website and is regularly updated based on data submitted by supervised entities. Borrowers are encouraged to refer to the list via the app before applying for any loan.
