Between 1 July and 30 September 2026, Oquilia’s Digital Lending Enforcement Tracker recorded 12 official actions against lenders, lending apps and the networks behind them: five RBI penalties, three government takedown notices, three police cases and one Supreme Court judgment. Read together, they show two kinds of enforcement that rarely meet. Regulated lenders were penalised, mostly for taking more from borrowers than they were entitled to. The apps that threaten borrowers were pulled from Google Play by notices the public never sees.
RBI: three of five penalties were about borrowers’ money
RBI imposed five monetary penalties in the quarter whose findings concerned how lenders treat borrowers. In three, RBI found that money had been taken from borrowers, or kept from them:
- Bank of Baroda, Rs 63.60 lakh (3 July): RBI said the bank collected interest higher than the contracted rate in certain loan accounts. The order also covered KYC lapses.
- Hero Fincorp Limited, Rs 10 lakh (24 September): RBI said the company collected excess interest from certain loan accounts.
- KLM Axiva Finvest Limited, Rs 2.70 lakh (24 September): RBI said the company did not pay certain borrowers the surplus left after auctioning their pledged gold.
The other two were about what borrowers are told. Infinity Fincorp Solutions Private Limited (Rs 5.40 lakh, 7 August) did not disclose in its application forms and sanction letters how it decides which borrowers pay which interest rate, RBI said. Hinduja Leyland Finance Limited (Rs 6.20 lakh, 4 September) had no board-approved policy on pricing microfinance loans, according to RBI.
The pattern holds across the year. Of the 17 penalties of this kind RBI has imposed since January, seven involved money borrowers paid but should not have, or were owed and did not get: interest above the contracted rate, charges the rules do not allow on small loans, foreclosure charges without a matching clause in the loan agreement, and gold-auction surpluses not paid out. Four more were for not telling borrowers how their interest rate was set.
What the releases do not say
None of those seven releases says whether the borrowers got their money back. Each carries RBI’s standard statement that the penalty is based on deficiencies in regulatory compliance and does not pronounce on any transaction or agreement between the lender and its customers.
For a borrower, that matters. A penalty is not a refund. If you believe a lender charged you more than your loan agreement allows, the route is a written complaint to the lender first and, if it is rejected or not answered within 30 days, a complaint to RBI at cms.rbi.org.in.
How large the penalties were
The 17 penalties this year total about Rs 1.9 crore. The median is Rs 3.80 lakh, and the smallest was Rs 10,000. The two largest, on Bank of Baroda (Rs 63.60 lakh) and Bank of India (Rs 58.50 lakh), make up close to two-thirds of the total, and both orders also covered lapses outside lending conduct.
Loan apps: three notices, 14 apps
RBI’s penalties reach only the lenders it regulates. Apps operating without a registered lender behind them are dealt with by other agencies. In the quarter, the visible action against them came from the Indian Cyber Crime Coordination Centre (I4C), part of the Ministry of Home Affairs, which sent Google three notices to remove loan apps from the Play Store, according to press reports:
- 21 July: five apps, with three hours to comply, as reported by The Week. The apps were not named.
- 7 August: six apps — LoanOrbit, Hisab, Nexus Loan, One Fund, Credit Factor and Mobile Credit Prairie — as reported by Outlook Business, citing a notice reviewed by Moneycontrol. The apps were reported taken down by 12 August.
- 19 August: three apps — Horizon Cash Service, Money Score Monitor and Zelicredit — as reported by MediaNama, citing Moneycontrol, which reported that Google complied.
The reports describe the notices as alleging that the apps harvested users’ data, misrepresented interest rates or demanded inflated repayments. Those are the agency’s allegations as reported. The notices themselves have not been published.
The numbers Parliament was given
Those notices are the only visible record of loan apps removed this year, because the official totals do not separate loan apps out.
On 21 July, the Finance Ministry told the Rajya Sabha in a written reply that MeitY had so far blocked 87 illegal loan apps under Section 69A of the IT Act — the same figure the Lok Sabha was given in December 2025. On 11 August, a Lok Sabha question asked the Home Ministry how many fraudulent apps, including loan apps, had been blocked or removed in the last two years. The answer gave 3,718 mobile apps “including fraudulent loan apps” blocked by I4C up to 30 June 2026, with no separate figure for loan apps and no breakdown by year.
The July reply also noted that, under IT rules notified on 22 October 2025, sectoral regulators can now issue blocking directions themselves. None of RBI’s 2026 press releases announces one.
Police: three cases, one method
Three police actions in the quarter fit a pattern seen all year:
- Nagpur, 8 July: cyber police said they arrested a person in Bhopal alleged to have developed the “Mast Money” loan app, which police said took borrowers’ phone data and was used to threaten them into paying far more than they borrowed. Police estimated losses at about Rs 200 crore.
- Noida, 1 September: police said they arrested six people who allegedly threatened borrowers of private loan apps with edited obscene images, and put the money extorted at about Rs 25 lakh.
- Medchal-Malkajgiri, Telangana, reported 10 September: police registered a case against unidentified people claiming to represent the “Vardhan” loan app, who allegedly harassed a woman over a relative’s loan and sent her morphed images.
Across the eight police actions the tracker has recorded this year, in Delhi and five states, the method police describe is consistent: access to the borrower’s phone, then threats — in four cases, police described morphed or obscene images — and money moved through mule accounts, UPI or, in two cases, cryptocurrency. These are allegations. None of these cases has been tried.
Oquilia’s review of the Enforcement Directorate’s and the CBI’s 2026 press releases found none announcing action against a loan-app operation. That does not mean there was none: agencies do not announce every step.
Recovery conduct: the courts, and RBI’s new rules
The quarter’s most consequential ruling was not about an app. On 16 September, the Supreme Court held that Cholamandalam Investment and Finance Company Limited’s night-time repossession of a borrower’s truck, without the notice the loan agreement required, was arbitrary and violated Articles 14 and 21 of the Constitution. It awarded Rs 10 lakh in compensation, ordered the Rs 4.50 lakh sale price refunded with 6% interest, and directed RBI to “take effective steps to secure genuine compliance” with its recovery guidelines by NBFCs and banks alike. The Court observed that those guidelines had existed only on paper.
The judgment follows an April ruling of the Uttarakhand High Court, which held that RBI’s recovery guidelines are binding on lenders rather than advisory.
It also came six weeks after RBI rewrote those rules. On 6 August, RBI issued final directions on how lenders recover loans and engage recovery agents, covering every class of lender from commercial and co-operative banks to NBFCs and housing finance companies. According to RBI, they cover fair treatment of borrowers during recovery, the conduct of lenders’ staff and agents, due diligence, training and a code of conduct for recovery agents, and lenders that use technology to restrict a mobile device the loan paid for. They take effect on 1 January 2027; until then, the existing rules apply.
What to watch, October to December
- How RBI responds to the Supreme Court’s direction of 16 September on recovery practices, ahead of its new recovery directions taking effect on 1 January 2027.
- The Delhi High Court petition on borrowers’ data and digital lending apps, in which the court asked RBI in January to set out the action it has taken to enforce its Digital Lending Directions. Oquilia has not found a later order.
- Whether answers in Parliament’s winter session give a count of loan apps blocked, rather than all fraudulent apps together.
How this was compiled
Every count above comes from the rows of the Digital Lending Enforcement Tracker dated 1 July to 30 September 2026, or from the two parliamentary answers and the RBI release linked above, and each tracker row links to its source. The full data downloads as CSV. RBI rows are dated by RBI’s press release. The I4C notices are not public and are recorded as reported. Police actions are often reported only locally, so that part of the record is incomplete.
Where to complain — official channels only
- A lender charged you more than your agreement allows: complain to the lender in writing, then to RBI at cms.rbi.org.in if there is no reply within 30 days or you are not satisfied.
- An app or entity lending without RBI registration: sachet.rbi.org.in.
- Threats, morphed images or messages to your contacts: cybercrime.gov.in, or call 1930.
- Charges you were never told about: the National Consumer Helpline on 1915, or e-Daakhil.
Sources and attribution
The facts on this page come from public records: RBI press releases, judgments of courts, written answers given in Parliament, and police and agency actions as reported. Where this page describes a finding of RBI or a court, it is a finding. Where it describes an arrest, an FIR or a takedown notice, it is an accusation, not a determination of guilt. RBI states that its penalties are based on deficiencies in regulatory compliance and do not pronounce on any transaction or agreement with customers.
A note on names
No individual is named on this page. Companies and apps are named only as they appear in public orders, official releases or the reports cited. Where a name resembles that of an unrelated business, nothing here refers to that unrelated business.
Right of reply
Every entity named on this page is invited to respond. If any figure, date, name or description is inaccurate, write to us with the correcting document and we will publish the correction, or the response in full, alongside this article, without charge and without editing its substance.
No recovery agents, and no fee to complain
No regulator or police force charges a borrower to file a complaint, and no private service can make a lender refund money on your behalf. Use the official channels named above. Oquilia takes no fee from readers, offers no recovery service, and refers no one to any legal practice.
Source
Oquilia's enforcement tracker; RBI releases; Parliament answers of 21 July and 11 August 2026; Supreme Court, 16 September 2026
