A borrower fell behind on a loan taken through Qualoan, an app operated by Naman Finlease Pvt Ltd. According to a documented borrower complaint, the next approach did not arrive on his phone. It arrived at his office. The complaint states that Qualoan emailed staff at his employer seeking "employment verification" over the unpaid loan, and the borrower says the message reached his workplace. Naman Finlease Pvt Ltd's account of the matter is not recorded here. What follows is the borrower's allegation, and the rules that apply if it is correct.
What an email to the office actually does
Most people who borrow from an app tell nobody. That is part of why they use one. It is private, it is quick, and it does not involve sitting across a desk from someone who knows you. A message to the workplace ends that privacy in a single click.
Consider what the borrower describes. A colleague opens an email about him, sent by a lender. Whatever the wording, the substance of that message is that a named employee has a loan and somebody is chasing him about it. The colleague now knows. If the email reached more than one person, they all know. Nobody has to write the word "default" for the meaning to land.
The harm is not only social. Employment is the one asset a borrower in this position still holds. It is the reason the loan was approved, and it is the only way the loan can be repaid. A borrower who believes his job is now exposed will do almost anything to stop the contact - including paying an amount he does not have, or taking a second loan from another app to clear the first. That is how one missed instalment becomes a chain of them. Pressure applied at the workplace works precisely because the cost of ignoring it looks higher than the cost of paying.
"Verification" is a mild word for what is being asked. A lender checks a borrower's employment when it is deciding whether to lend. A request that arrives after repayment has stopped is not doing the same work as one that arrives before the money is disbursed, whatever it is called on the subject line.
What the rules say
Naman Finlease Pvt Ltd is an RBI-registered NBFC. That registration is what makes the lending itself lawful. It is also what makes the company answerable, because a registered NBFC is bound by rules that an unregistered operator would simply ignore. Registration cuts both ways, and borrowers rarely realise it cuts in their favour too.
The RBI's Fair Practices Code is the provision that speaks to this directly. It bars a lender, and anyone recovering on its behalf, from contacting a borrower's employer, family or references in order to apply pressure. It bars recovery calls before 8 am and after 7 pm. It bars conduct that humiliates or intimidates a borrower or intrudes on their privacy. There is no exemption for a contact that is worded politely, and none for one presented as a verification. What the Code weighs is what the contact does to the borrower, not what the sender calls it.
The RBI's Digital Lending Guidelines of September 2022 add two points that matter here. The first is that digital lending must run through a regulated entity, and that entity remains responsible for the conduct of every app, agent and service provider acting in its name. A lender cannot outsource recovery and then treat the outsourced conduct as somebody else's problem. The second is that borrower data may be collected and used only on a need basis, with the borrower's explicit consent, and only for the purpose that consent was given for. Contact details handed over to obtain a loan are not a standing permission to approach the people around the borrower when the loan goes unpaid.
If personal data was passed to a third party outside the purpose the borrower agreed to, a further question arises under the Digital Personal Data Protection Act, 2023. That Act requires a company holding personal data to process it only for the purpose for which consent was obtained, and makes it answerable to the Data Protection Board for how it handles that data. Whether the emails described fall within that is a matter for the Board on the evidence, not for us to declare.
One thing this complaint does not allege, and we will not imply it: there is no threat recorded in it. No abuse, and no intimidation of the sort that would engage the criminal law. The allegation is narrower than that, and narrower is stronger. It is that a lender placed a borrower's unpaid loan in front of the people he works with.
If this has happened to you
None of the following costs anything, and none of it needs a lawyer.
- Get the original email, not a description of it. Ask the colleague or the HR contact who received it to forward you the message with its full headers, and keep that copy. A screenshot of the inbox helps; the original with headers is far stronger, because it carries the sending address and the exact date and time. Write down who received it and when you were told.
- Put your own account in writing at work, once. A short, factual note to your manager or HR - that you have a personal loan, that it is a dispute between you and the lender, and that you did not authorise the lender to contact anyone at your workplace - takes the story out of the lender's hands and into yours. Keep a copy. State the position; do not apologise for owing money.
- Complain to the RBI, naming the NBFC. Start at sachet.rbi.org.in and name the NBFC written into your loan agreement, not only the app. If the NBFC has not resolved your complaint within 30 days, escalate to the RBI Ombudsman at cms.rbi.org.in. Attach the email.
- Report the disclosure of your data. File at cybercrime.gov.in or call 1930. Put it in one plain sentence: a lender disclosed your borrowing to your employer without your consent.
- Check who actually lent to you. An app is a front end; the lender is the NBFC named in your agreement. Look that name up on the RBI's register at sachet.rbi.org.in. If your paperwork names no registered entity at all, that is worth reporting on its own.
- Do not pay to make it stop. Paying a disputed or inflated demand to end the pressure does not unsend an email your colleagues have already read, and it establishes that pressure applied at your workplace produces money.
Why we are naming the company
An allegation is not a finding, and we have not treated it as one. What is on the record is a documented borrower complaint and the borrower's account of where the email landed. We publish it because a person deciding whether to install this app is entitled to read the complaint before they borrow, not after.
Qualoan is also not the only app run by Naman Finlease Pvt Ltd. Zayloloan, Funds Bull and Zepto Finance operate from the same company. A reader who has taken a view on one of those names has effectively taken a view on all four, and most borrowers have no way of knowing that. We do not link to Qualoan, or to any of them, and we will not: sending a reader who is already short of money one click closer to a loan app would defeat the only purpose this article has.
Right of reply: Naman Finlease Pvt Ltd has a standing invitation to respond. Any correction, denial, or evidence about the email described here will be published in full and unedited alongside this piece. Write to editor@oquilia.com.
Evidence · redacted copy to be published
Screenshot of an email alleged to have been sent by Qualoan to a borrower's employer seeking employment verification
Your rights, and how to report
The lenders in this series are RBI-registered NBFCs, bound by the RBI's Fair Practices Code: no recovery calls before 8 am or after 7 pm, no contacting your employer, family or references to pressure you, no abuse or threats, and the all-in APR must be disclosed in the Key Facts Statement. Read the full plain-English guide on Oquilia's loan-harassment help page.
To report a lender: start at RBI Sachet, escalate unresolved complaints to the RBI Ombudsman (CMS) after 30 days, and report threats, harassment or data misuse at the National Cyber Crime portal or on 1930. Keep every screenshot, email and call log - that record is your evidence.
More from this investigation
- SnapPaisa: the alleged '1 PM' office-email threat
- PaisaInTime: ~16 missed calls in 9 minutes
- Chinmay Finlease's Lendit: a 36.5% 'flat' rate and a 3-day rollover
Frequently asked questions
Is a Qualoan loan legal in India?
Qualoan is operated by Naman Finlease Pvt Ltd, an RBI-registered NBFC, so the lending itself is lawful. The conduct alleged in a documented borrower complaint is a separate question: the complaint states that Qualoan emailed staff at the borrower's employer seeking "employment verification" over an unpaid loan, and that the message reached his workplace. Naman Finlease Pvt Ltd's account is not recorded here. If a lender does that, the RBI's Fair Practices Code is the provision that applies - it bars a lender and anyone recovering on its behalf from contacting a borrower's employer, family or references to apply pressure, and there is no exemption for a contact presented as a verification. The RBI's Digital Lending Guidelines of September 2022 add that borrower data may be used only on a need basis, with explicit consent, and only for the purpose consent was given for. If this happens to you, get the original email with its full headers from whoever received it, complain to the RBI at sachet.rbi.org.in naming the NBFC in your loan agreement rather than only the app, escalate to the Ombudsman at cms.rbi.org.in if it is unresolved after 30 days, and report the disclosure of your data at cybercrime.gov.in or on 1930.
Can a loan app call my office or family?
No. Under the RBI Fair Practices Code, recovery agents may not contact your employer, family or references to pressure you, may not call before 8 am or after 7 pm, and may not use abuse or threats. Approaching your workplace or contacts to shame you over a loan falls outside lawful recovery, whatever an app's agreement says.
How do I report a loan app to the RBI?
Start at RBI Sachet (sachet.rbi.org.in). If the NBFC does not resolve your complaint within 30 days, escalate to the RBI Ombudsman through the Complaint Management System. For threats or data misuse, use the National Cyber Crime portal (cybercrime.gov.in) or call 1930, and keep all screenshots and statements.
Source
Lenders' own Key Facts Statements, agreements and recovery emails; RBI Register of NBFCs; documented borrower complaints