A small loan, approved in minutes, with no paperwork. Then the repayment date arrives and the calls begin — not only to you, but to your mother, your employer and everyone else in a contact list the app copied the day you installed it. Doctored photographs. Messages calling you a thief, sent to people you work with.
This is one of the most common consumer complaints in Pakistan today, and the important thing to understand is that the harassment is a much bigger legal problem for them than the loan is for you.
First: is the lender even licensed?
Lending as a business is regulated. A licensed lender is either a bank or a development finance institution regulated by the State Bank of Pakistan, or a Non-Banking Finance Company licensed by the SECP. Many of the apps behaving worst are neither.
Check the SECP register for the company behind the app and the SBP's lists. An unlicensed operator conducting lending business is committing a regulatory offence before you get anywhere near the harassment — and that fact belongs at the top of your complaint.
The harassment is the offence
Whatever you owe, the conduct is separately unlawful. The Prevention of Electronic Crimes Act, 2016 covers most of it:
- Section 20 — offences against the dignity of a natural person. Sending false or defamatory messages about you to your contacts.
- Section 21 — offences against modesty, where photographs have been morphed or sexualised. This is very common in these campaigns and it is the gravest charge available.
- Section 24 — cyberstalking, for the repeated calls and messages.
- Section 16 — unauthorised use of identity information, for using your photograph and CNIC in messages to third parties.
- Section 3 and 4 — unauthorised access to and copying of data, for harvesting a contact list and gallery beyond anything the loan required.
Add the Penal Code where it fits: criminal intimidation (section 506) and extortion (sections 383 to 389) where they demand more than is owed under threat.
What to do, in order
- Stop paying anything beyond the actual principal and lawful markup. Paying a threat buys a bigger threat.
- Preserve everything. Call logs with dates and times, every message, every screenshot sent to a contact, the app's permission list, the loan agreement or in-app terms, and the record of what you actually received and repaid.
- Warn your contacts. One short message — "a loan app is sending false messages about me, please ignore them, I am dealing with it legally" — removes most of the app's leverage in a single stroke. Their entire method depends on your shame.
- Revoke the app's permissions and uninstall it. Revoke contacts, storage, photos and SMS access in your phone settings first, then remove the app.
- Report to the FIA Cybercrime Wing, in writing, with the evidence. Lead with the harassment and the data misuse, not with the debt.
- Complain to the regulator. SECP if it is or claims to be an NBFC; the State Bank and the Banking Mohtasib if a bank or a licensed institution is behind it. Regulated entities are answerable for the conduct of the recovery agents they hire.
- Report the app to Google Play or the App Store for policy violation. Store policies on personal loan apps prohibit exactly this contact-harvesting behaviour, and removal is often the fastest practical relief.
Do you still owe the money?
Usually yes, as to the principal you actually received. Harassment does not cancel a genuine debt. But two things are worth knowing.
First, the amount demanded is frequently not the amount owed. Compute it yourself: what was disbursed to your account, what you have repaid, and what markup the agreement actually permits. Processing fees deducted up front, penalties invented after the fact and rolled-over "extensions" produce figures with no basis in the contract.
Second, a civil debt is not a crime. Threats to have you arrested for non-payment of a personal loan are, in the ordinary case, simply false.
Where a genuine balance exists, offer to repay it in writing, through a bank channel, against a receipt. That letter is excellent evidence that you were never a defaulter refusing to pay — you were a borrower being extorted.
The civil claim
Where real damage has been done — a job lost, a marriage prospect broken, a reputation destroyed among colleagues — a suit for defamation under the Defamation Ordinance, 2002, with damages and an injunction, runs alongside the criminal complaint. Publication to third parties is the element these campaigns hand you on a plate: they did it deliberately and there are witnesses.
Before you install the next one
- Read the permissions. A lender does not need your contacts, your gallery or your messages. An app that demands them is building a harassment tool, not assessing credit.
- Verify the licence before you borrow, not after.
- Compute the real cost. A "5% fee" on a fourteen-day loan is not 5% a year.
- Prefer a regulated bank or microfinance institution. Slower, and answerable to someone.
This article describes general remedies under Pakistani law and is not advice on any particular loan or complaint. Whether a lender is licensed, and which regulator has jurisdiction, must be checked in your own case. If you are being threatened, contact the FIA Cybercrime Wing and speak to an advocate — and tell someone you trust.