PaisaOnSalary Emailed His Colleagues About His "Default", a Bengaluru Borrower Says

A salaried borrower in Bengaluru fell behind on a loan from PaisaOnSalary, an app operated by Aman Fincap Ltd. According to a documented borrower complaint, the lender then emailed the people he works with. On his account, that email told his colleagues he was in "default" and set out his employment details. The pressure to repay, he alleges, was not applied to him. It was applied to the room he sits in every day. PaisaOnSalary's account of the matter is not recorded here, and what follows is the borrower's documented allegation, not a finding against the company.

What an email like that costs the person it names

A small personal loan is one of the few financial facts a working adult can keep to himself. Most people who take one do not tell their manager, their team, or the colleague at the next desk. That privacy is the whole reason the loan felt survivable.

An email to those colleagues removes it in a second, and there is no way to get it back. A message sent to a workplace does not stay in one inbox. It is read, forwarded, discussed at lunch, and remembered at appraisal time. The borrower cannot correct the record without confirming it. He cannot ask for the email to be unread. The next time he is passed over for something, he will not know whether this was the reason.

There is a sharper problem underneath. For a salaried borrower, the job is the only thing that makes repayment possible at all. Conduct that puts his standing at work at risk is conduct that puts his income at risk, and with it his ability to pay the very debt being chased. A borrower who is quietly behind by one instalment can be made unemployable by one email. That is not a route to recovery. It is a route to a much larger default, borne by a person who was already short of money.

And it does not end with one message. A borrower who has seen a lender reach his workplace once must assume it can happen again for as long as any balance is outstanding. That expectation is itself the instrument. It is what makes a frightened person borrow again, from another app, to clear the first.

The rule on contacting your workplace

The RBI's Fair Practices Code and its recovery rules for NBFCs do not name the employer, but they come close to settling this. A lender and its agents may not use intimidation or harassment of any kind against any person to recover a debt, or acts meant to humiliate a borrower publicly or to intrude on the privacy of family members, referees and friends. Your colleagues are not parties to your loan agreement. They owe the lender nothing, they consented to nothing, and there is no legitimate recovery purpose in telling them what you owe. A demand routed through them is not a demand for payment. It is an application of shame, which is precisely what the Code exists to stop.

The RBI's digital lending rules, in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025, close the obvious escape route. Lending through an app must run through a regulated entity, and that regulated entity remains answerable for the conduct of the service providers and recovery agents acting in its name. A lender cannot outsource recovery and then treat the resulting conduct as somebody else's behaviour. The same Directions require that borrower data be collected only on a need basis, with the borrower's explicit consent, and they specifically bar lending apps from harvesting a phone's contact list and call logs. The direction of the rule is unmistakable: the people in a borrower's life are not collateral.

Those Directions also require the regulated entity and its lending service provider to appoint a nodal grievance redressal officer for exactly this kind of complaint, and allow a borrower to escalate to the RBI Ombudsman if it is not resolved within thirty days. That gives a borrower a named route, a clock and an escalation, instead of an app support chat that goes nowhere.

The data question sits on top of the recovery question

Telling a person's colleagues that he is in "default", and giving them his employment details, is a disclosure of his personal data to people who had no business receiving it. Under the Digital Personal Data Protection Act, 2023, whose duties on companies take effect on 13 May 2027, personal data may be processed only for the purpose the person consented to. Nobody applying for a small loan consents to having that loan announced at work. The Act treats a company holding such data as a Data Fiduciary, and that status carries duties it cannot write out of its own agreement.

Section 8(5) requires reasonable security safeguards against a personal data breach, and the Schedule to the Act sets the penalty for failing that duty at up to Rs 250 crore. Section 8(6) separately requires the Data Fiduciary to notify both the Data Protection Board and every affected person when a breach occurs, with a penalty of up to Rs 200 crore. These duties and the penalties for breaching them apply from 13 May 2027, eighteen months after the government notified the Act's commencement on 13 November 2025, so they do not apply to a disclosure made before then. For one made after that date, whether it crosses those lines will be for the Data Protection Board to decide on the evidence, and a single borrower can put that complaint in motion.

If your workplace has been contacted about your loan

None of this requires a lawyer, and none of it costs anything.

• Get the original email, not a description of it. Ask the colleague who received it to forward the message with its full headers intact, and to keep their copy. A screenshot of the body is useful; the headers are what prove who sent it and when. Note the date, the time and every recipient. Do not ask anyone to delete it.
• Tell your employer yourself, first and briefly. This is unfair, and it is still the right move. A short factual note to your manager or HR - that you have a personal loan, that the lender has contacted staff, that you are reporting it - puts your version on the record before the rumour does.
• Write to the lender once, in writing. Withdraw any consent to contact third parties, state that recovery communication must come to you alone, and ask for the name of the nodal grievance redressal officer. Send it by email so you hold a timestamped copy. That copy starts the thirty-day clock.
• Complain to the RBI. Escalate to the Ombudsman through cms.rbi.org.in if there is no resolution in thirty days. Say plainly what happened: a lender disclosed your loan to your colleagues to force payment.
• Report the disclosure of your data. File at cybercrime.gov.in or call 1930. Attach the forwarded email. Describe it as the disclosure of your personal and employment information to third parties without your consent.
• Check who the lender actually is. An app is not an NBFC. Find the entity named in your loan agreement and look it up on the RBI's register at sachet.rbi.org.in. If your paperwork names no registered lender at all, that fact belongs in your complaint.
• Do not pay a disputed amount to make it stop. Paying under this kind of pressure does not unsend an email to your office, and it establishes that pressure works on you. Dispute the amount if you dispute it, and keep paying what you genuinely owe through a traceable channel.

Why we are naming the company

We are careful about what this article claims. What is recorded here is a documented borrower complaint, and we describe it as an allegation throughout, because that is what it is. We have not seen PaisaOnSalary's answer, and an allegation is not a finding. What we can say without qualification is that conduct of the kind alleged - reaching a borrower through his colleagues - is conduct the RBI's own Fair Practices Code does not permit, and that a borrower who experiences it has real and free routes to complain.

We name PaisaOnSalary and Aman Fincap Ltd because a person searching that name at eleven at night, deciding whether to install the app, deserves to find this before he decides. We do not link to the app or to its listing, and we will not. Sending a reader who is already short of money one click closer to a lender would defeat the only purpose this piece has.

Right of reply: Aman Fincap Ltd has a standing invitation to respond. Any correction, denial, or account of its recovery practice will be published in full and unedited alongside this article. Write to editor@oquilia.com.

Your rights, and how to report

The lenders in this series are RBI-registered NBFCs, bound by the RBI's Fair Practices Code and recovery rules: no recovery calls before 8 am or after 7 pm, no intimidation or harassment of anyone to make you pay, no public humiliation or intrusion on the privacy of your family, referees or friends, no abuse or threats, and the all-in APR must be disclosed in the Key Facts Statement. Read the full plain-English guide on Oquilia's loan-harassment help page.

To report a lender: complain in writing to its grievance redressal officer first, escalate to the RBI Ombudsman (CMS) if there is no reply or no resolution within 30 days, check the lender's registration (and report an unregistered app) on RBI Sachet, and report threats, harassment or data misuse at the National Cyber Crime portal or on 1930. Keep every screenshot, email and call log - that record is your evidence.

More from this investigation

• Qualoan: the alleged 'employment verification' email
• SnapPaisa: the alleged '1 PM' office-email threat
• PaisaInTime: ~16 missed calls in 9 minutes

Frequently asked questions

Can a loan app email my colleagues about a loan?

No. The RBI's Fair Practices Code and its recovery rules do not name employers, but a lender and its recovery agents may not intimidate or harass anyone to make you pay, humiliate you publicly, or intrude on the privacy of your family, referees and friends. Your colleagues are not parties to your loan agreement and consented to nothing. Telling them what you owe is not a step towards recovery; it is pressure applied through your workplace, and no clause in an app's agreement makes it permissible. PaisaOnSalary, an app operated by Aman Fincap Ltd, is alleged in a documented borrower complaint to have emailed a salaried Bengaluru borrower's colleagues, disclosing his "default" and his employment details. That is an allegation, not a finding, and the company's account is not recorded here. If it happens to you: get the original email forwarded to you with its full headers, write once to the lender withdrawing consent to contact third parties and asking for its nodal grievance redressal officer, complain to that officer in writing and escalate to the RBI Ombudsman at cms.rbi.org.in if it is not resolved in thirty days, and report the disclosure of your personal data at cybercrime.gov.in or on 1930.

Can a loan app call my office or family?

Not to pressure you. The RBI's recovery rules do not name employers, but they bar recovery agents from intimidating or harassing anyone, from acts meant to humiliate you publicly or to intrude on the privacy of your family, referees and friends, from calling before 8 am or after 7 pm, and from abuse or threats. Approaching your workplace or contacts to shame you over a loan falls outside lawful recovery, whatever an app's agreement says.

How do I report a loan app to the RBI?

Complain in writing to the NBFC's grievance redressal officer first. If it does not resolve your complaint within 30 days, escalate to the RBI Ombudsman through the Complaint Management System (cms.rbi.org.in). Use RBI Sachet (sachet.rbi.org.in) to check that the lender is registered and to report an app run by an unregistered entity. For threats or data misuse, use the National Cyber Crime portal (cybercrime.gov.in) or call 1930, and keep all screenshots and statements.