dpdpr.in
Am I covered?

A relative gave my number to their lender and now I get the recovery calls

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"My cousin took a loan and gave my number. The agents keep calling me, even late at night."

The situation in a citizen's own words, paraphrased from public reports. No names or personal details.

You are not responsible for someone else's loan. RBI's recovery rules apply to every call: no calls before 8 AM or after 7 PM, and no harassment of family or friends. Write to the lender's grievance officer and keep a log of calls.

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Your rights

  • Right to be free of harassment in recovery. RBI (12 August 2022): no intimidation, no public humiliation, no intruding on the privacy of your family, referees and friends, no threatening or anonymous calls, no calls before 8 AM or after 7 PM. For NBFCs the same rule now sits in para 100 of RBI's NBFC Responsible Business Conduct Directions, 2025.
  • Right to have the lender answer for its agents. RBI says the lender is responsible for the actions of its recovery agents. NBFC agents must keep customer information strictly confidential (para 99).
  • Right to a reply within 30 days, then the RBI Ombudsman, who can award compensation (up to Rs 30 lakh for loss plus Rs 3 lakh for harassment and costs).
  • Right to compensation for deficiency in service. Under the Consumer Protection Act, 2019 you can claim compensation before a Consumer Commission. File within 2 years.
  • Right to police help. The police must take your complaint about threats, stalking or harassment. You can also report online at cybercrime.gov.in.
  • DPDP rights from 13 May 2027. You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)).

How to fight it, step by step

One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to If it is fake.

  1. Save the evidence before you block or delete anything.
    What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
    What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
    What you get back: A record that cannot later be denied.
    How long to wait: Do this the same day.
  2. Complain to the lender in writing through its official app, website or branch.
    What to write: Letter 2 below, naming the dates, times and people contacted.
    What to attach: Call logs and messages your relatives received, with their written note of what was said.
    What you get back: A complaint number.
    How long to wait: 30 days.
  3. Send one written follow up to the lender's grievance officer.
    What to write: Your complaint number, the date you complained, and: "I have had no reply (or an incomplete reply). Please reply in writing within 7 days, or I will escalate to the RBI Ombudsman."
    What to attach: Your first complaint and its acknowledgement.
    What you get back: Proof that you gave the company a fair chance. Regulators and Commissions ask for this.
    How long to wait: 7 days, then go to the next step.
  4. Complain to the RBI Ombudsman on cms.rbi.org.in (for RBI regulated lenders).
    What to write: The harassment, your complaint number, and what you want.
    What to attach: Your complaint, any reply, evidence.
    What you get back: An RBI complaint number.
    How long to wait: Within 90 days after the lender's 30 days ran out or its last reply.
  5. If the app is not linked to an RBI regulated lender, report it on RBI's Sachet portal and on cybercrime.gov.in.
    What to write: App name, how you found it, what it did.
    What to attach: Screenshots.
    What you get back: A reference number.
    How long to wait: Do this at once.
  6. File a police complaint, or ask for an FIR.
    What to write: A signed complaint to the officer in charge of your local police station, or online at cybercrime.gov.in. Say what happened, when, the numbers used, and that you or your family are being threatened or harassed over a loan.
    What to attach: Printouts of your screenshots and a copy on a pen drive. Your ID proof.
    What you get back: An FIR copy, or at least a written acknowledgement of your complaint. Online, you get an acknowledgement number.
    How long to wait: Do this at once if you feel unsafe. Do not wait for the company.
  7. Call the National Consumer Helpline on 1915, or file on consumerhelpline.gov.in.
    What to write: The company's name, your complaint number with it, what went wrong, and what you want (for example: action against the person, written confirmation, compensation).
    What to attach: Your complaint, the company's replies, and screenshots.
    What you get back: A docket number. The helpline takes your complaint up with the company. It is free and comes before a court case.
    How long to wait: Give it a few weeks. If nothing changes, go to the Consumer Commission.
  8. File a consumer case for deficiency in service on e-Jagriti.
    What to write: Who you are, the company, what service you used, what went wrong, the loss and distress caused, and the compensation you claim.
    What to attach: Everything above: evidence, letters, replies, helpline docket.
    What you get back: A case number and hearing dates. You can argue the case yourself. The District Commission hears cases where the value of what you paid is up to Rs 50 lakh, the State Commission up to Rs 2 crore, and the National Commission above that (2021 Rules).
    How long to wait: File within 2 years of the problem.
  9. Get a lawyer if the stakes are high.
    What to write: Nothing yet. Take your full file to the lawyer.
    What to attach: All of the above.
    What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
    How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.

What people tried and what worked

  • Telling agents to stop did not resolve it in the reports we read. A written complaint to the lender, then the RBI Ombudsman, is the route that creates a record.

Based on reports on public forums. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route.

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Step 1: stay safe and find out who it is

  1. Do not share an OTP, PIN, password or card number.
  2. Ask for their name, company, role and ID. Write it down.
  3. Hang up and call the company on a number you find yourself, on its official website or app.
  4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below).

If it is genuine: hold the company accountable

Which rules this may break

  • RBI, 12 August 2022: applies to banks, NBFCs, co-operative banks and others. No intimidation or harassment, no intruding on the privacy of the borrower's family members, referees and friends, no inappropriate messages on mobile or social media, no threatening or anonymous calls, no calls before 8:00 a.m. or after 7:00 p.m.
  • RBI NBFC Responsible Business Conduct Directions, 2025: paras 98 to 100 repeat these rules for NBFCs: training on customer privacy, strict confidentiality, and no intruding on the privacy of family, referees and friends.
  • RBI Digital Lending Directions: lending apps must not access your contacts or call logs.
  • RBI Outsourcing Directions, 2025 (banks): the bank is responsible for recovery agents and the confidentiality of customer data they hold.
  • Crimes: threats, abuse or morphed photos are police matters.

What the company must do, and by when

  • Give you a complaint number and reply within 30 days.
  • Name the recovery agency handling your account, if you ask.
  • Stop the harassment and act against the agent. RBI says violations will be viewed seriously.
  • Stop contacting your relatives and friends about your loan.
  • From 13 May 2027: tell you who your data was shared with (DPDP section 11).

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, [Bank, NBFC or lending app name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My loan account number: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the lender. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, recovery agent, lending service provider or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, [Bank, NBFC or lending app name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, recovery agent, lending service provider, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. The name of the recovery agency and the agent, and the date you assigned my account to them.
RBI's instructions of 12 August 2022 say lenders and their recovery agents must not intrude on the privacy of a borrower's family members, referees and friends, must not make threatening or anonymous calls, and must not call before 8:00 a.m. or after 7:00 p.m. The lender is responsible for its recovery agents.

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within 30 days. If I do not hear from you, I will escalate to the RBI Ombudsman.

Name:
Registered mobile number:
Date:

Evidence to keep

  • Screenshots of calls and messages with numbers, dates and times.
  • Order, booking, policy or account numbers.
  • Your complaint numbers and the company's replies.
  • A note of what the caller knew or did.

More in the evidence checklist.

Can you sue? What realistically happens

  • Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
  • IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
  • Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
  • Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
  • Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

  1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
  2. Call 1930 if money was lost, then file on cybercrime.gov.in.
  3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Complain to the bank first, then the RBI Ombudsman

Complain to the bank first, then the RBI Ombudsman

From 1 July 2026 the Reserve Bank Integrated Ombudsman Scheme, 2026 applies. It is free. It covers banks, many NBFCs, non bank wallets and prepaid cards, and credit information companies. You must complain to the bank or company first.

Keep this ready before you start:

  • Your name, mobile number, email and full postal address.
  • Name of the bank or company, and the branch if relevant.
  • The complaint number and date of your complaint to the bank, and a copy of it.
  • Account, card, loan or transaction details.
  • Transaction date and reference number.
  • The bank's reply, if any.
  • A short account of what happened, your loss, and what you want (refund, correction, compensation).
  • Supporting documents.
  1. Complain to the bank in writing. Use its official app, website complaint form, email, or a letter at the branch.
  2. Get a complaint number or written acknowledgement. Save it with the date.
  3. Wait 30 days (or longer if RBI, NPCI or card network rules give a longer time for your type of issue).
  4. If there is no reply in that time, or you are not happy with the reply, you can go to the RBI Ombudsman.
  5. Do it within 90 days from the end of that waiting time, or from the bank's last reply, whichever is later. Under the 2021 scheme this was one year; under the 2026 scheme it is 90 days.
  6. Open cms.rbi.org.in. The portal shows a security check first.
  7. Choose to file a new complaint. Fill the details asked: your details, the bank, your earlier complaint number, the transaction and what you want. We have not described each screen because we could not open the portal to check it; follow the labels shown.
  8. Upload your complaint to the bank, the bank's reply and your evidence.
  9. Submit. Write down the complaint number shown. Save it with your mobile number. You need both to track.
  10. To track or withdraw, go to the Track a complaint tab on cms.rbi.org.in.
  11. Other ways to file: email to [email protected], or post a signed complaint form to Centralised Receipt and Processing Centre, Reserve Bank of India, Central Vista, Sector 17, Chandigarh 160017.
  12. For help, call the RBI Contact Centre on 14448. The voice menu works 24x7. Staff answer 8 AM to 10 PM, Monday to Saturday, in English, Hindi and ten regional languages. You cannot file a complaint by phone.
  13. If the Ombudsman passes an Award in your favour, send the bank a letter accepting it within 30 days. The bank must then comply.
  14. If you disagree with an Award, you can appeal to the Appellate Authority within 30 days of receiving it.

Checked on 1 November 2026 against: RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs), RBI: text of the Integrated Ombudsman Scheme, 2026, RBI Complaint Management System (CMS).

File a complaint on cybercrime.gov.in

File a complaint on cybercrime.gov.in

The National Cyber Crime Reporting Portal takes complaints about online fraud, hacking, fake profiles, harassment and more. Your complaint goes to the police of your State or Union Territory. The screen names below come from the portal's FAQ and the Ministry of Home Affairs citizen manual. The portal can change. If a screen looks different, follow the words on the screen.

Keep this ready before you start:

  • Date and time of the incident.
  • Incident details in your own words. The portal checklist asks for at least 200 characters and no special characters such as # $ @ ^ * ` ~ | !
  • A photo or scan of a national ID (Voter ID, Driving Licence, Passport, PAN or Aadhaar) in .jpg, .jpeg or .png, not more than 5 MB.
  • For money fraud: bank or wallet name, 12 digit transaction ID or UTR, date and amount.
  • Evidence files such as screenshots, not more than 10 MB each.
  • If known: the other person's mobile number, email, bank account, website link or social media handle.
  1. Open cybercrime.gov.in in a browser.
  2. Click File a complaint.
  3. Read the message. Tick I Accept.
  4. Click Report Other Cyber Crime. (For sexual content involving women or children, use the women and child section instead.)
  5. Type your name in User Name. Type your mobile number.
  6. Click Get OTP. Type the OTP you receive. It is valid for 30 minutes.
  7. Fill the security answer. Click Submit.
  8. In Incident details, choose the Category of complaint. For money loss choose Online Financial Fraud. For fake profiles or harassment choose Online and Social Media Related Crime.
  9. Choose the Sub-Category that fits best.
  10. Enter the approximate date and time. If you are late, fill Reason for delay in reporting.
  11. Choose Where did the incident occur? (for example a phone call, SMS, WhatsApp, a website or an app).
  12. Upload your evidence files.
  13. Write what happened in the details box. Say who contacted you, from which number, what they said, what you shared or paid, and when.
  14. Click Save and Next.
  15. Add suspect details if you have them: name, mobile number, bank account, UPI ID or website. Click Save & Next.
  16. Fill your own details and address. Choose your State, District and Police Station.
  17. Upload your ID proof. Click Save & Preview.
  18. Check everything. Tick I Agree. Click Confirm & Submit.
  19. Write down the Complaint ID shown on screen. You also get it by SMS and email. It is a complaint number, not an FIR number.
  20. Click Download PDF and save the file in a safe folder.
  21. To check progress later, log in the same way and click Check Status.
  22. If you get no action, or are not happy with what the police did, contact the cyber crime grievance officer of your State or Union Territory listed on the portal. You can also visit your local police station with the PDF and ask for an FIR.

Checked on 1 November 2026 against: National Cyber Crime Reporting Portal: FAQ, National Cyber Crime Reporting Portal: checklist before filing, I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930.

Related guides

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

On this page
  1. Your rights
  2. How to fight it
  3. What people tried
  4. Step 1: verify
  5. If genuine
  6. Letters
  7. Can you sue?
  8. Data Protection Board
  9. If fake
  10. Sources