Investigations · Consumer Finance
More Than 1,250 Borrowers Exposed, 701% a Year: The Loan Apps That E-mail Your Employer — and Put It in Writing
· Oquilia Investigations
Every figure below is taken from the lender’s own sanction letter, Key Facts Statement or recovery e-mail. No figure is estimated, and no allegation of intent is made anywhere on this page.
Two things are happening at once in India’s short-tenure salary-advance market, and both are visible on the documents.
The first is arithmetic. A borrower is sanctioned one amount, receives a smaller amount after fees and GST are deducted at source, and repays against the larger amount over a term measured in days. When the cost is recalculated on the money that actually reached the bank account, the annualised figure can sit far above the rate the lender itself disclosed.
The second is disclosure. Recovery e-mails are being sent with borrower addresses in the open “To” field rather than blind copy, and to the addresses of a borrower’s employer. Counting only the events set out on this page — Subhlakshmi Finance (29 May 2026, ~190), Squid Loans (28 June, ~50; 11 July, ~80), SnapPaisa (130-plus), Zaylo Loan (1 August, 116-plus), Qualoan (5 August, ~295), Toofan Loan (8 June, 269), Salary Champion (12 August, 120-plus), and two undisclosed-count SalaryBolt e-mails (6 and 10 July) — more than 1,250 borrowers were exposed across ten documented e-mails.
What the lenders’ own documents disclose
| Company | Brand | What its own document discloses | Cost on the money actually received | What it did (dated) |
|---|---|---|---|---|
| Ampire Finance Pvt Ltd(RBI Sl. 434; register records a former name, “Maulesh Investments”; registered Ahmedabad, operating from Delhi; RBI-registered contact address is a personal Gmail) | SalarySetu, SnapPaisa, F1SpeedLoan | Sanctioned Rs 85,000; fee Rs 4,250 + GST Rs 765 = Rs 5,015 deducted; 39-day single repayment; own disclosed APR 411.79% | Rs 79,985 received; repayment fixed against the full Rs 85,000 | 16 Jul 2026: e-mailed five HR and staff addresses at the borrower's employer. 2 Aug 2026: a second written cease-and-desist served on it. 10 Aug 2026: e-mailed five named addresses at the employer disclosing employee code, employer, designation and work location. Same day, a Rs 99,000 “final reminder” listing as consequences “Communication with your employer regarding the pending loan repayment” and “Contacting the references provided by you”. SnapPaisa: one recovery e-mail exposed 130-plus borrowers in open copy |
| Naman Finlease Pvt Ltd (Sl. 5115, CIN U70101DL1997PTC088735) | Qualoan, Zaylo Loan, Funds Bull, Zepto Finance | Zaylo: sanctioned Rs 85,000; about Rs 10,030 deducted; own KFS APR 458.59% | Net Rs 74,970; 539.04% | 2 Jun 2026: e-mailed four addresses at the borrower's employer an “Employment Verification and Message Forwarding Request”. 1 Aug 2026: Zaylo e-mail exposed 116-plus addresses in open copy. 5 Aug 2026: recovery e-mail to approximately 295 borrowers, every address in the open “To” field |
| Kasar Credit and Capital Pvt Ltd (Sl. 3930) | Salary On Time | Sanctioned Rs 1,00,000; fee Rs 10,000 + GST Rs 1,800 deducted at source; repayment Rs 1,17,000; term 17 days; interest 1% per day; penal 2% per day (730% a year); disclosed APR 486.67% | Net Rs 88,200; 701.08%— 214.41 percentage points above its own disclosed figure | Its KFS names a personal Gmail as the Nodal Grievance Officer's contact |
| Satisfaction Commercial Pvt Ltd | Toofan Loan | Sanctioned Rs 1,15,000; Rs 10,856 deducted | Net Rs 1,04,144 | 8 Jun 2026: recovery e-mail sent to 269 borrowers with every address visible in the To/Cc fields; one recipient then replied to the whole list, compounding the exposure |
| Richman Fincap Ltd (Sl. 6551) | Salary Champion | Sanctioned Rs 44,000; Rs 6,956 deducted; disclosed APR 503.94% | Net Rs 37,044 | 12 Aug 2026: recovery e-mail sent from a personal Gmail account with 120-plus borrower addresses visible in the open “To” field |
| Vanshika Micro Credit | Dhanwalle | Loan Rs 76,000; fee Rs 7,600; repayment Rs 1,06,400 over 40 days; 1% per day; penal double. Prints “Annual Percentage Rate 365.00” — 1% × 365, which excludes the fee deducted. States no loan account number | Net Rs 68,400; 506.94% | 27 Jul 2026, 13:20–14:48: one recipient received 45 calls from two numbers associated with the brand; six were answered and the caller used abusive language |
| Subhlakshmi Finance | — | — | — | 29 May 2026: roughly 190 borrowers exposed in open copy |
| Squid Loans | — | — | — | 28 Jun 2026: roughly 50 exposed. 11 Jul 2026: roughly 80 exposed. Two events |
| SalaryBolt | — | — | — | 6 and 10 Jul 2026: mass open-copy recovery e-mails; a fellow borrower then replied to the whole list |
Ampire Finance Pvt Ltd — SalarySetu, SnapPaisa, F1SpeedLoan
Three e-mails reached the workplace of a single salaried professional, between them addressed to fourteen of his colleagues. Five went on 16 July 2026 and five more on 10 August 2026 — the second approach by the same company, and the fourth made to that employer by any lender. The 10 August e-mails disclosed his employee code, employer, designation and work location to named recipients who are not parties to any loan. A separate e-mail the same day set out, in writing, that contacting his employer and his references were consequences of non-payment.
The sequence, stated without inference: those e-mails were sent on the dates given. The borrower was later asked to leave his job. No court or regulator has determined that there is any connection between the two, and none is asserted here.
Naman Finlease Pvt Ltd — Qualoan, Zaylo Loan, Funds Bull, Zepto Finance
Zepto Finance is a brand of Naman Finlease Pvt Ltd and is unconnected with any other business trading under a similar name. The 5 August 2026 Qualoan e-mail put roughly 295 borrowers’ addresses in the open “To” field — the single largest exposure documented here.
Can a loan app e-mail your employer or call your office?
RBI Direction RBI/DOR/2025-26/362 addresses this directly. Chapter III-A, Paragraph 9 requires borrower information to be treated as confidential. Paragraphs 98 to 100 govern recovery conduct, including contact with third parties. Chapter III-B, Paragraph 29requires the all-inclusive Annual Percentage Rate to be disclosed in the Key Facts Statement — which is why a stated rate that excludes a fee deducted at source matters.
Separately, Section 72A of the Information Technology Act 2000 addresses disclosure of personal information in breach of a lawful contract, punishable with imprisonment of up to three years. The CERT-In Directions of 28 April 2022 require certain cyber incidents to be reported within six hours; whether any company here reported is not knowable from the documents and nothing is alleged.
The Digital Personal Data Protection Act 2023 is not yet in force and there is no Data Protection Board. Do not send complaints there.
Where to complain — official channels only
- cybercrime.gov.in — the National Cyber Crime Reporting Portal
- cms.rbi.org.in — RBI Complaint Management System (grievance to the lender first, then RBI)
- sachet.rbi.org.in — RBI’s Sachet portal
- incident@cert-in.org.in — CERT-In, for the data-exposure element
Preserve the original e-mail with full headers before you complain, and take the recipient list as a screenshot. If your address appeared in someone else’s recovery e-mail, that e-mail is evidence in your own hands.
FAQ
Is SalarySetu legal?
SalarySetu is a brand of Ampire Finance Pvt Ltd, recorded at Sl. 434 of the Reserve Bank’s register. Registration status is a matter for the Reserve Bank alone. Whether particular conduct complies with RBI/DOR/2025-26/362 has not been adjudicated by any court or regulator.
How do I make a Qualoan complaint?
Qualoan is a brand of Naman Finlease Pvt Ltd (Sl. 5115). Complain to the lender’s grievance officer first, then escalate on cms.rbi.org.in. For the 5 August open-copy e-mail, add cybercrime.gov.in and incident@cert-in.org.in.
How do I file a Toofan Loan complaint?
Toofan Loan is a brand of Satisfaction Commercial Pvt Ltd. The 8 June 2026 e-mail to 269 borrowers is documentary evidence; keep it with headers intact and file on cms.rbi.org.in and cybercrime.gov.in.
Salary Champion loan — is the disclosed APR what it costs?
Richman Fincap Ltd disclosed 503.94% on a Rs 44,000 sanction, of which Rs 6,956 was deducted, leaving Rs 37,044. Any figure that excludes deductions at source is not the cost on the money you received.
Can a loan app call my office?
Paragraphs 98 to 100 of RBI/DOR/2025-26/362 govern recovery conduct and third-party contact, and Chapter III-A Paragraph 9 requires confidentiality. Record the numbers, the times and the count.
A loan app e-mailed my employer. What do I do?
Preserve the e-mail and its full headers. Send a written objection to the lender’s grievance officer, then file on cms.rbi.org.in and cybercrime.gov.in. Do not delete anything.
How do I stop loan app harassment?
Written grievance to the lender, then RBI CMS, then the cyber-crime portal. Evidence first, complaint second — apps and senders often stop once a written record exists.
How do I file an RBI complaint against a loan app?
Raise it with the lender’s grievance officer, wait for the prescribed period or a rejection, then file on cms.rbi.org.in. sachet.rbi.org.in is the parallel channel for unregulated-entity reports.
Right of reply
Every company named on this page is invited to respond. If any figure, date, count or description here is inaccurate, write to us with the correcting document and we will publish the correction, or the response in full, alongside this article without charge and without editing its substance.
No adjudication
No court, tribunal, ombudsman or regulator has adjudicated any of the conduct described on this page. Nothing here asserts that any company acted unlawfully, or asserts any intent, motive, knowledge or state of mind. The registration status of any lender is a matter for the Reserve Bank of India alone. Each described act is stated with its date and sourced to the company’s own document.