A salaried borrower in Bengaluru fell behind on a loan from PaisaOnSalary, an app operated by Aman Fincap Ltd. According to a documented borrower complaint, the lender then emailed the people he works with. On his account, that email told his colleagues he was in "default" and set out his employment details. The pressure to repay, he alleges, was not applied to him. It was applied to the room he sits in every day. PaisaOnSalary's account of the matter is not recorded here, and what follows is the borrower's documented allegation, not a finding against the company.
What an email like that costs the person it names
A small personal loan is one of the few financial facts a working adult can keep to himself. Most people who take one do not tell their manager, their team, or the colleague at the next desk. That privacy is the whole reason the loan felt survivable.
An email to those colleagues removes it in a second, and there is no way to get it back. A message sent to a workplace does not stay in one inbox. It is read, forwarded, discussed at lunch, and remembered at appraisal time. The borrower cannot correct the record without confirming it. He cannot ask for the email to be unread. The next time he is passed over for something, he will not know whether this was the reason.
There is a sharper problem underneath. For a salaried borrower, the job is the only thing that makes repayment possible at all. Conduct that puts his standing at work at risk is conduct that puts his income at risk, and with it his ability to pay the very debt being chased. A borrower who is quietly behind by one instalment can be made unemployable by one email. That is not a route to recovery. It is a route to a much larger default, borne by a person who was already short of money.
And it does not end with one message. A borrower who has seen a lender reach his workplace once must assume it can happen again for as long as any balance is outstanding. That expectation is itself the instrument. It is what makes a frightened person borrow again, from another app, to clear the first.
The rule on contacting your workplace
The RBI's Fair Practices Code for NBFCs does not leave this to interpretation. Recovery must not humiliate or intimidate the borrower, and a lender and its agents may not contact a borrower's employer, family or references to apply pressure. Your colleagues are not parties to your loan agreement. They owe the lender nothing, they consented to nothing, and there is no legitimate recovery purpose in telling them what you owe. A demand routed through them is not a demand for payment. It is an application of shame, which is precisely what the Code exists to stop.
The RBI Digital Lending Guidelines of September 2022 close the obvious escape route. Lending through an app must run through a regulated entity, and that regulated entity remains answerable for the conduct of the service providers and recovery agents acting in its name. A lender cannot outsource recovery and then treat the resulting conduct as somebody else's behaviour. The same guidelines require that borrower data be collected only on a need basis, with the borrower's explicit consent, and they specifically bar lending apps from harvesting a phone's contact list and call logs. The direction of the rule is unmistakable: the people in a borrower's life are not collateral.
Those guidelines also require the regulated entity and its lending service provider to appoint a nodal grievance redressal officer for exactly this kind of complaint, and allow a borrower to escalate to the RBI Ombudsman if it is not resolved within thirty days. That gives a borrower a named route, a clock and an escalation, instead of an app support chat that goes nowhere.
The data question sits on top of the recovery question
Telling a person's colleagues that he is in "default", and giving them his employment details, is a disclosure of his personal data to people who had no business receiving it. Under the Digital Personal Data Protection Act, 2023, personal data may be processed only for the purpose the person consented to. Nobody applying for a small loan consents to having that loan announced at work. The Act treats a company holding such data as a Data Fiduciary, and that status carries duties it cannot write out of its own agreement.
Section 8(5) requires reasonable security safeguards against a personal data breach, and the Schedule to the Act sets the penalty for failing that duty at up to Rs 250 crore. Section 8(6) separately requires the Data Fiduciary to notify both the Data Protection Board and every affected person when a breach occurs, with a penalty of up to Rs 200 crore. If a disclosure of the kind alleged here occurred, whether it crosses those lines is for the Data Protection Board to decide on the evidence. That is the correct forum, and it is one a single borrower can put in motion.
If your workplace has been contacted about your loan
None of this requires a lawyer, and none of it costs anything.
- Get the original email, not a description of it. Ask the colleague who received it to forward the message with its full headers intact, and to keep their copy. A screenshot of the body is useful; the headers are what prove who sent it and when. Note the date, the time and every recipient. Do not ask anyone to delete it.
- Tell your employer yourself, first and briefly. This is unfair, and it is still the right move. A short factual note to your manager or HR - that you have a personal loan, that the lender has contacted staff, that you are reporting it - puts your version on the record before the rumour does.
- Write to the lender once, in writing. Withdraw any consent to contact third parties, state that recovery communication must come to you alone, and ask for the name of the nodal grievance redressal officer. Send it by email so you hold a timestamped copy. That copy starts the thirty-day clock.
- Complain to the RBI. Begin at sachet.rbi.org.in, and escalate to the Ombudsman through cms.rbi.org.in if there is no resolution in thirty days. Say plainly what happened: a lender disclosed your loan to your colleagues to force payment.
- Report the disclosure of your data. File at cybercrime.gov.in or call 1930. Attach the forwarded email. Describe it as the disclosure of your personal and employment information to third parties without your consent.
- Check who the lender actually is. An app is not an NBFC. Find the entity named in your loan agreement and look it up on the RBI's register at sachet.rbi.org.in. If your paperwork names no registered lender at all, that fact belongs in your complaint.
- Do not pay a disputed amount to make it stop. Paying under this kind of pressure does not unsend an email to your office, and it establishes that pressure works on you. Dispute the amount if you dispute it, and keep paying what you genuinely owe through a traceable channel.
Why we are naming the company
We are careful about what this article claims. What is recorded here is a documented borrower complaint, and we describe it as an allegation throughout, because that is what it is. We have not seen PaisaOnSalary's answer, and an allegation is not a finding. What we can say without qualification is that conduct of the kind alleged - reaching a borrower through his colleagues - is conduct the RBI's own Fair Practices Code does not permit, and that a borrower who experiences it has real and free routes to complain.
We name PaisaOnSalary and Aman Fincap Ltd because a person searching that name at eleven at night, deciding whether to install the app, deserves to find this before he decides. We do not link to the app or to its listing, and we will not. Sending a reader who is already short of money one click closer to a lender would defeat the only purpose this piece has.
Right of reply: Aman Fincap Ltd has a standing invitation to respond. Any correction, denial, or account of its recovery practice will be published in full and unedited alongside this article. Write to editor@oquilia.com.
Evidence · redacted copy to be published
Screenshot of an email alleged to have been sent by PaisaOnSalary to a borrower's workplace colleagues disclosing his default
Your rights, and how to report
The lenders in this series are RBI-registered NBFCs, bound by the RBI's Fair Practices Code: no recovery calls before 8 am or after 7 pm, no contacting your employer, family or references to pressure you, no abuse or threats, and the all-in APR must be disclosed in the Key Facts Statement. Read the full plain-English guide on Oquilia's loan-harassment help page.
To report a lender: start at RBI Sachet, escalate unresolved complaints to the RBI Ombudsman (CMS) after 30 days, and report threats, harassment or data misuse at the National Cyber Crime portal or on 1930. Keep every screenshot, email and call log - that record is your evidence.
More from this investigation
- Qualoan: the alleged 'employment verification' email
- SnapPaisa: the alleged '1 PM' office-email threat
- PaisaInTime: ~16 missed calls in 9 minutes
Frequently asked questions
Can a loan app email my colleagues about a loan?
No. Under the RBI's Fair Practices Code, a lender and its recovery agents may not contact your employer, colleagues, family or references to pressure you into paying, and recovery must not humiliate or intimidate you. Your colleagues are not parties to your loan agreement and consented to nothing. Telling them what you owe is not a step towards recovery; it is pressure applied through your workplace, and no clause in an app's agreement makes it permissible. PaisaOnSalary, an app operated by Aman Fincap Ltd, is alleged in a documented borrower complaint to have emailed a salaried Bengaluru borrower's colleagues, disclosing his "default" and his employment details. That is an allegation, not a finding, and the company's account is not recorded here. If it happens to you: get the original email forwarded to you with its full headers, write once to the lender withdrawing consent to contact third parties and asking for its nodal grievance redressal officer, complain at sachet.rbi.org.in and escalate to the RBI Ombudsman at cms.rbi.org.in after thirty days, and report the disclosure of your personal data at cybercrime.gov.in or on 1930.
Can a loan app call my office or family?
No. Under the RBI Fair Practices Code, recovery agents may not contact your employer, family or references to pressure you, may not call before 8 am or after 7 pm, and may not use abuse or threats. Approaching your workplace or contacts to shame you over a loan falls outside lawful recovery, whatever an app's agreement says.
How do I report a loan app to the RBI?
Start at RBI Sachet (sachet.rbi.org.in). If the NBFC does not resolve your complaint within 30 days, escalate to the RBI Ombudsman through the Complaint Management System. For threats or data misuse, use the National Cyber Crime portal (cybercrime.gov.in) or call 1930, and keep all screenshots and statements.
Source
Lenders' own Key Facts Statements, agreements and recovery emails; RBI Register of NBFCs; documented borrower complaints