Investigations · Consumer Finance

More Than 1,250 Borrowers Exposed, 701% a Year: The Loan Apps That E-mail Your Employer — and Put It in Writing

Updated 18 October 2026: what the Reserve Bank and the companies have since said.

13 August 2026 · Updated 18 October 2026· Oquilia Investigations

Every figure below is taken from the lender’s own sanction letter, Key Facts Statement or recovery e-mail. No figure is estimated, and no allegation of intent is made anywhere on this page.

Two things are happening at once in India’s short-tenure salary-advance market, and both are visible on the documents.

The first is arithmetic. A borrower is sanctioned one amount, receives a smaller amount after fees and GST are deducted at source, and repays against the larger amount over a term measured in days. When the cost is recalculated on the money that actually reached the bank account, the annualised figure can sit far above the rate the lender itself disclosed.

The second is disclosure. Recovery e-mails are being sent with borrower addresses in the open “To” field rather than blind copy, and to the addresses of a borrower’s employer. Counting only the events set out on this page — Subhlakshmi Finance (29 May 2026, ~190), Squid Loans (28 June, ~50; 11 July, ~80), SnapPaisa (130-plus), Zaylo Loan (1 August, 116-plus), Qualoan (5 August, ~295), Toofan Loan (8 June, 269), Salary Champion (12 August, 120-plus), and two undisclosed-count SalaryBolt e-mails (6 and 10 July) — more than 1,250 borrowers were exposed across ten documented e-mails.

Update, 18 October 2026: what the Reserve Bank and the companies have since said

After this article was first published, the borrower took his complaints to the Reserve Bank of India’s complaint system. Several have been closed. What follows is quoted from the RBI’s closure letters and from the companies’ own written replies. It records what those documents say and adds nothing to them.

Two RBI findings on contact with the employer (30 September 2026)

Ampire Finance Pvt Ltd (SalarySetu, SnapPaisa, F1SpeedLoan). The RBI's Consumer Education and Protection Cell (CEPC) recorded that the company "has acknowledged contacting the employer as per the loan agreement". It found that "a perusal of the Loan agreement reveals that there are no clauses which permit the RE to contact the employer for requesting assistance in contacting the employee/complainant/borrower or convey its message or to share his contact information. Therefore, the RE is in non-compliance of the agreed terms and conditions of the loan agreement and in non-compliance to extant regulatory guidelines". It recorded that "The action of the RE viz., unauthorized contact of the employer has been forwarded to the Department of Supervision, Central Office, RBI for necessary action". It also recorded the company's statement that "it has ceased further employee communication". Before the closure, on 8 September 2026, the company had written to the borrower, in the names of both SalarySetu and SnapPaisa: "the employer communication was initiated by our collection team".

Naman Finlease Pvt Ltd (Qualoan, Zaylo Loan, Funds Bull, Zepto Finance). The CEPC recorded that "The entity has stated that communication with the employer was undertaken for verification purposes as per loan agreement and has acknowledged the inadvertent disclosure of email addresses to multiple recipients due to human error." It went on: "We observed that the Disclosure clause of the agreement referred by the entity does not permit it to contact the employer and advised it not to contact the employers. We have also referred the matter to the Supervisory Department." In replies to the borrower on 2 September 2026, Qualoan said its e-mail to the employer "was sent solely for verification purposes", and Zaylo Loan said its recovery e-mail "was inadvertently sent with multiple recipients visible in the "To" field due to a human error by the concerned agent."

What other companies said in reply

Shivji Finance and Investments Pvt Ltd (SalaryBolt), 10 September 2026:“the concerned agents marked multiple IDs while sharing loan-related information, resulting in a breach of our data-privacy and confidentiality standards.” It said “the concerned agent is no longer associated with SalaryBolt”, that it had issued “a formal warning to the concerned collection team leader”, and: “We sincerely apologize for the data-privacy and process lapse”.

Aman Fincap Ltd (Paisa On Salary), 1 September 2026: “Use of personal email accounts and group emails exposing borrower details was inappropriate.” It said collection actions on the borrower’s loan account “have been paused pending review”.

Agarwal Assignments Pvt Ltd (LoanWithin), 7 October 2026: “We also sincerely apologise for the contents and tone of the subsequent email sent to you.” and “Upon receiving communication regarding the matter, we immediately terminated the concerned executive.” The RBI closed the complaint on 13 October 2026 on that reply. On 15 October 2026, two days later, a WhatsApp message signed “Loan within” told the borrower: “Our executive will visit your home add office location and also call on your reference No.” That message was put to the company in writing on 16 October 2026.

Devmuni Leasing & Finance Ltd (Loan112).Closing the borrower’s complaint on 14 October 2026, the CEPC recorded that the company “acknowledged a deviation in the recovery communication dated 23 July 2026 and stated that a warning letter had been issued to the concerned executive.”

Two per cent a day, on Loan112’s own statement

Loan112’s own statement of account, sent to the borrower on 3 October 2026, records:

• a sanctioned principal of Rs 1,20,000;
• a Rs 12,000 processing fee and Rs 2,160 GST deducted, so Rs 1,05,840 was paid out;
• interest of Rs 1,200 a day to the repayment date (Rs 22,800);
• then, for sixty days, both “overdue interest” of Rs 1,200 a day (Rs 72,000) and “penal charges” of Rs 1,200 a day (Rs 72,000).

The total is Rs 2,86,800, which is 2.71 times the sum paid out. The two daily charges together come to 2% of the principal a day, or 730% a year. The company’s Key Fact Statement discloses one charge for delayed payment, “Penal charges, if any, in case of delayed payment”, at “1% per day”, and no “overdue interest”. These figures were put to the company in writing on 16 October 2026.

Two things that decided complaints in this file

1. Answer the RBI on time.While an Ombudsman complaint is running, the RBI’s office may e-mail you the company’s reply and ask for your comments by a stated date. In the two cases followed here, that date was three days later. If no comments arrive, the complaint can be closed on the company’s reply alone. Watch your inbox and spam folder, and reply from the e-mail address you registered the complaint with.
2. Upload proof that your earlier complaint reached the company. In one complaint followed here, the company told the RBI it had never received the borrower’s earlier notice, and the RBI noted that the uploaded papers contained only transcript copies. Upload the delivered e-mail itself, showing its date and the address it went to, or the postal tracking record.

“Arrest warrant”, “salary attachment”, “garnishee”: what a recovery letter cannot do

Some recovery letters warn of an arrest warrant, of attachment of salary, or of a “garnishee” order to the borrower’s employer. Each of these is an order of a court. A court makes it only in proceedings before it. Attachment of salary and garnishee orders come after a claim has been decided, when its execution is sought under Order XXI of the Code of Civil Procedure, 1908. A letter from a lender, a collection agency or a lawyer cannot make any of these orders. Keep the letter, and complain to the lender’s grievance officer and then to the RBI at cms.rbi.org.in.

What the lenders’ own documents disclose

Ampire Finance Pvt Ltd — SalarySetu, SnapPaisa, F1SpeedLoan

At least three e-mails reached the workplace of a single salaried professional, between them addressed to fourteen of his colleagues. Five went on 16 July 2026 and five more on 10 August 2026 — the second approach by the same company, and one of several made to that employer by lenders. The 10 August e-mails disclosed his employee code, employer, designation and work location to named recipients who are not parties to any loan. A separate e-mail the same day set out, in writing, that contacting his employer and his references were consequences of non-payment.

Naman Finlease Pvt Ltd — Qualoan, Zaylo Loan, Funds Bull, Zepto Finance

Zepto Finance is a brand of Naman Finlease Pvt Ltd and is unconnected with any other business trading under a similar name. The 5 August 2026 Qualoan e-mail put roughly 295 borrowers’ addresses in the open “To” field — the single largest exposure documented here.

Can a loan app e-mail your employer or call your office?

RBI Direction RBI/DOR/2025-26/362 addresses this directly. Chapter III-A, Paragraph 9 requires borrower information to be treated as confidential. Paragraphs 98 to 100 govern recovery conduct, including contact with third parties. Chapter III-B, Paragraph 29requires the all-inclusive Annual Percentage Rate to be disclosed in the Key Facts Statement — which is why a stated rate that excludes a fee deducted at source matters.

Separately, Section 72A of the Information Technology Act 2000 addresses disclosure of personal information in breach of a lawful contract, punishable with imprisonment of up to three years. The CERT-In Directions of 28 April 2022 require certain cyber incidents to be reported within six hours; whether any company here reported is not knowable from the documents and nothing is alleged.

There is no public portal yet for complaints to the Data Protection Board. Do not send complaints there; use the channels listed on this page.

Where to complain — official channels only

• cybercrime.gov.in — the National Cyber Crime Reporting Portal
• cms.rbi.org.in — RBI Complaint Management System (grievance to the lender first, then RBI)
• sachet.rbi.org.in — RBI’s Sachet portal
• incident@cert-in.org.in — CERT-In, for the data-exposure element

Preserve the original e-mail with full headers before you complain, and take the recipient list as a screenshot. If your address appeared in someone else’s recovery e-mail, that e-mail is evidence in your own hands.

FAQ

Is SalarySetu legal?
SalarySetu is a brand of Ampire Finance Pvt Ltd, recorded at Sl. 434 of the Reserve Bank of India's register. Registration status is a matter for the Reserve Bank alone. On 30 September 2026, closing a borrower's complaint, the RBI's Consumer Education and Protection Cell recorded that Ampire's loan agreement contained no clause permitting it to contact the borrower's employer, that the company was "in non-compliance of the agreed terms and conditions of the loan agreement and in non-compliance to extant regulatory guidelines", and that "unauthorized contact of the employer" had been forwarded to the RBI's Department of Supervision.

How do I make a Qualoan complaint?
Qualoan is a brand of Naman Finlease Pvt Ltd (Sl. 5115). Complain to the lender’s grievance officer first, then escalate on cms.rbi.org.in. For the 5 August open-copy e-mail, add cybercrime.gov.in and incident@cert-in.org.in.

How do I file a Toofan Loan complaint?
Toofan Loan is a brand of Satisfaction Commercial Pvt Ltd. The 8 June 2026 e-mail to 269 borrowers is documentary evidence; keep it with headers intact and file on cms.rbi.org.in and cybercrime.gov.in.

Salary Champion loan — is the disclosed APR what it costs?
Richman Fincap Ltd disclosed 503.94% on a Rs 44,000 sanction, of which Rs 6,956 was deducted, leaving Rs 37,044. Any figure that excludes deductions at source is not the cost on the money you received.

Can a loan app call my office?
Paragraphs 98 to 100 of RBI/DOR/2025-26/362 govern recovery conduct and third-party contact, and Chapter III-A Paragraph 9 requires confidentiality. Record the numbers, the times and the count.

A loan app e-mailed my employer. What do I do?
Preserve the e-mail and its full headers. Send a written objection to the lender’s grievance officer, then file on cms.rbi.org.in and cybercrime.gov.in. Do not delete anything.

How do I stop loan app harassment?
Written grievance to the lender, then RBI CMS, then the cyber-crime portal. Evidence first, complaint second — apps and senders often stop once a written record exists.

How do I file an RBI complaint against a loan app?
Raise it with the lender’s grievance officer, wait for the prescribed period or a rejection, then file on cms.rbi.org.in. sachet.rbi.org.in is the parallel channel for unregulated-entity reports.

What changed, 18 October 2026.Removed a sentence about the borrower’s employment and corrected a statement about the Data Protection Board. Replaced ‘the fourth made to that employer by any lender’ with ‘one of several made to that employer by lenders’, and ‘Three e-mails’ with ‘At least three’: records reviewed after 13 August show more approaches than this article first counted, so all counts here are minimums as at 13 August 2026. Added the update of 18 October 2026, and revised the no-adjudication note to reflect the RBI closure letters it quotes.

Right of reply

Every company named on this page is invited to respond. If any figure, date, count or description here is inaccurate, write to us with the correcting document and we will publish the correction, or the response in full, alongside this article without charge and without editing its substance.

No adjudication

Except for the Reserve Bank of India closure letters quoted on this page, no court, tribunal, ombudsman or regulator has adjudicated any of the conduct described here; those letters are quoted exactly and are not characterised further. Nothing here asserts that any company acted unlawfully, beyond what the quoted RBI letters themselves record, or asserts any intent, motive, knowledge or state of mind. The registration status of any lender is a matter for the Reserve Bank of India alone. Each described act is stated with its date and sourced to the company's own document.