Qualoan Allegedly Emailed a Borrower's Workplace and Called It 'Employment Verification'

A borrower fell behind on a loan taken through Qualoan, an app operated by Naman Finlease Pvt Ltd. According to a documented borrower complaint, the next approach did not arrive on his phone. It arrived at his office. The complaint states that Qualoan emailed staff at his employer seeking "employment verification" over the unpaid loan, and the borrower says the message reached his workplace. Naman Finlease Pvt Ltd's account of the matter is not recorded here. What follows is the borrower's allegation, and the rules that apply if it is correct.

Update, 18 October 2026: what the Reserve Bank and the companies have since said

Naman Finlease Pvt Ltd (Qualoan, Zaylo Loan, Funds Bull, Zepto Finance). The CEPC recorded that "The entity has stated that communication with the employer was undertaken for verification purposes as per loan agreement and has acknowledged the inadvertent disclosure of email addresses to multiple recipients due to human error." It went on: "We observed that the Disclosure clause of the agreement referred by the entity does not permit it to contact the employer and advised it not to contact the employers. We have also referred the matter to the Supervisory Department." In replies to the borrower on 2 September 2026, Qualoan said its e-mail to the employer "was sent solely for verification purposes", and Zaylo Loan said its recovery e-mail "was inadvertently sent with multiple recipients visible in the "To" field due to a human error by the concerned agent."

What an email to the office actually does

Most people who borrow from an app tell nobody. That is part of why they use one. It is private, it is quick, and it does not involve sitting across a desk from someone who knows you. A message to the workplace ends that privacy in a single click.

Consider what the borrower describes. A colleague opens an email about him, sent by a lender. Whatever the wording, the substance of that message is that a named employee has a loan and somebody is chasing him about it. The colleague now knows. If the email reached more than one person, they all know. Nobody has to write the word "default" for the meaning to land.

The harm is not only social. Employment is the one asset a borrower in this position still holds. It is the reason the loan was approved, and it is the only way the loan can be repaid. A borrower who believes his job is now exposed will do almost anything to stop the contact - including paying an amount he does not have, or taking a second loan from another app to clear the first. That is how one missed instalment becomes a chain of them. Pressure applied at the workplace works precisely because the cost of ignoring it looks higher than the cost of paying.

"Verification" is a mild word for what is being asked. A lender checks a borrower's employment when it is deciding whether to lend. A request that arrives after repayment has stopped is not doing the same work as one that arrives before the money is disbursed, whatever it is called on the subject line.

What the rules say

Naman Finlease Pvt Ltd is an RBI-registered NBFC. That registration is what makes the lending itself lawful. It is also what makes the company answerable, because a registered NBFC is bound by rules that an unregistered operator would simply ignore. Registration cuts both ways, and borrowers rarely realise it cuts in their favour too.

The RBI's Fair Practices Code and its recovery rules are the provisions that speak to this. They do not name the employer. They bar a lender, and anyone recovering on its behalf, from intimidation or harassment of any kind against any person to recover a debt, including acts meant to humiliate a borrower publicly or to intrude on the privacy of family members, referees and friends. They bar recovery calls before 8 am and after 7 pm. There is no exemption for a contact that is worded politely, and none for one presented as a verification. What the Code weighs is what the contact does to the borrower, not what the sender calls it.

The RBI's digital lending rules, in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025, add two points that matter here. The first is that digital lending must run through a regulated entity, and that entity remains responsible for the conduct of every app, agent and service provider acting in its name. A lender cannot outsource recovery and then treat the outsourced conduct as somebody else's problem. The second is that borrower data may be collected and used only on a need basis, with the borrower's explicit consent, and only for the purpose that consent was given for. Contact details handed over to obtain a loan are not a standing permission to approach the people around the borrower when the loan goes unpaid.

If personal data was passed to a third party outside the purpose the borrower agreed to, a further question will arise under the Digital Personal Data Protection Act, 2023 once its duties on companies take effect on 13 May 2027, eighteen months after the government notified the Act's commencement. From then, that Act requires a company holding personal data to process it only for the purpose for which consent was obtained, and makes it answerable to the Data Protection Board for how it handles that data. Whether conduct like the emails described falls within that will be a matter for the Board on the evidence, not for us to declare.

One thing this complaint does not allege, and we will not imply it: there is no threat recorded in it. No abuse, and no intimidation of the sort that would engage the criminal law. The allegation is narrower than that, and narrower is stronger. It is that a lender placed a borrower's unpaid loan in front of the people he works with.

If this has happened to you

None of the following costs anything, and none of it needs a lawyer.

• Get the original email, not a description of it. Ask the colleague or the HR contact who received it to forward you the message with its full headers, and keep that copy. A screenshot of the inbox helps; the original with headers is far stronger, because it carries the sending address and the exact date and time. Write down who received it and when you were told.
• Put your own account in writing at work, once. A short, factual note to your manager or HR - that you have a personal loan, that it is a dispute between you and the lender, and that you did not authorise the lender to contact anyone at your workplace - takes the story out of the lender's hands and into yours. Keep a copy. State the position; do not apologise for owing money.
• Complain to the NBFC, then the RBI. Complain in writing to the grievance redressal officer of the NBFC written into your loan agreement, not only the app. If the NBFC has not resolved your complaint within 30 days, escalate to the RBI Ombudsman at cms.rbi.org.in. Attach the email.
• Report the disclosure of your data. File at cybercrime.gov.in or call 1930. Put it in one plain sentence: a lender disclosed your borrowing to your employer without your consent.
• Check who actually lent to you. An app is a front end; the lender is the NBFC named in your agreement. Look that name up on the RBI's register at sachet.rbi.org.in. If your paperwork names no registered entity at all, that is worth reporting on its own.
• Do not pay to make it stop. Paying a disputed or inflated demand to end the pressure does not unsend an email your colleagues have already read, and it establishes that pressure applied at your workplace produces money.

Why we are naming the company

An allegation is not a finding, and we have not treated it as one. What is on the record is a documented borrower complaint and the borrower's account of where the email landed. We publish it because a person deciding whether to install this app is entitled to read the complaint before they borrow, not after.

Qualoan is also not the only app run by Naman Finlease Pvt Ltd. Zayloloan, Funds Bull and Zepto Finance operate from the same company. A reader who has taken a view on one of those names has effectively taken a view on all four, and most borrowers have no way of knowing that. We do not link to Qualoan, or to any of them, and we will not: sending a reader who is already short of money one click closer to a loan app would defeat the only purpose this article has.

Right of reply: Naman Finlease Pvt Ltd has a standing invitation to respond. Any correction, denial, or evidence about the email described here will be published in full and unedited alongside this piece. Write to editor@oquilia.com.

Your rights, and how to report

The lenders in this series are RBI-registered NBFCs, bound by the RBI's Fair Practices Code and recovery rules: no recovery calls before 8 am or after 7 pm, no intimidation or harassment of anyone to make you pay, no public humiliation or intrusion on the privacy of your family, referees or friends, no abuse or threats, and the all-in APR must be disclosed in the Key Facts Statement. Read the full plain-English guide on Oquilia's loan-harassment help page.

To report a lender: complain in writing to its grievance redressal officer first, escalate to the RBI Ombudsman (CMS) if there is no reply or no resolution within 30 days, check the lender's registration (and report an unregistered app) on RBI Sachet, and report threats, harassment or data misuse at the National Cyber Crime portal or on 1930. Keep every screenshot, email and call log - that record is your evidence.

More from this investigation

• SnapPaisa: the alleged '1 PM' office-email threat
• PaisaInTime: ~16 missed calls in 9 minutes
• Chinmay Finlease's Lenditt: a 36.5% 'flat' rate and a 3-day rollover

Frequently asked questions

Is a Qualoan loan legal in India?

Qualoan is operated by Naman Finlease Pvt Ltd, an RBI-registered NBFC, so the lending itself is lawful. The conduct alleged in a documented borrower complaint is a separate question: the complaint states that Qualoan emailed staff at the borrower's employer seeking "employment verification" over an unpaid loan, and that the message reached his workplace. Naman Finlease Pvt Ltd's account is not recorded here. If a lender does that, the RBI's Fair Practices Code and its recovery rules are the provisions that apply - they do not name the employer, but they bar a lender and anyone recovering on its behalf from intimidating or harassing anyone, or humiliating a borrower publicly, to recover a debt, and there is no exemption for a contact presented as a verification. The RBI's digital lending rules, now in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025, add that borrower data may be used only on a need basis, with explicit consent, and only for the purpose consent was given for. If this happens to you, get the original email with its full headers from whoever received it, complain in writing to the grievance redressal officer of the NBFC named in your loan agreement rather than only the app, escalate to the Ombudsman at cms.rbi.org.in if it is unresolved after 30 days, and report the disclosure of your data at cybercrime.gov.in or on 1930.

Can a loan app call my office or family?

Not to pressure you. The RBI's recovery rules do not name employers, but they bar recovery agents from intimidating or harassing anyone, from acts meant to humiliate you publicly or to intrude on the privacy of your family, referees and friends, from calling before 8 am or after 7 pm, and from abuse or threats. Approaching your workplace or contacts to shame you over a loan falls outside lawful recovery, whatever an app's agreement says.

How do I report a loan app to the RBI?

Complain in writing to the NBFC's grievance redressal officer first. If it does not resolve your complaint within 30 days, escalate to the RBI Ombudsman through the Complaint Management System (cms.rbi.org.in). Use RBI Sachet (sachet.rbi.org.in) to check that the lender is registered and to report an app run by an unregistered entity. For threats or data misuse, use the National Cyber Crime portal (cybercrime.gov.in) or call 1930, and keep all screenshots and statements.