Loan apps that blackmail with contacts and photos: what to do

A loan that arrives in five minutes can turn into months of calls, doctored pictures and messages to your boss and your relatives. This guide explains how loan app blackmail works, what it does to people, and what to do on your Android phone and your Windows PC. You are not the first person this has happened to, and the harm can be stopped and, over time, repaired.

What happened to the people behind the numbers

In October 2023 the BBC World Service Eye investigation described a scheme running through instant loan apps in India and in other countries in Asia, Africa and Latin America. Its reporters found that many of these apps harvest your contacts, photos and ID cards, and pass them to call centres whose agents are trained to shame borrowers into paying, sometimes even after they have paid.

One of the people the BBC spoke to was Bhoomi Sinhaa, a property lawyer in Mumbai and a widow raising her teenage daughter. At the end of 2021 she borrowed about 47,000 rupees (around $565) from several apps while she waited for work expenses to be paid. A large part of each loan was deducted as charges, and repayment came due in seven days. She borrowed from another app to cover it, then another, and ended up with 69 apps and a debt of about two million rupees.

The recovery agents called up to 200 times a day, she told the BBC, and threatened to message all 486 contacts in her phone. Even after she had paid everything back, one app kept calling. It then sent a crudely photoshopped naked image of her to everyone in her phone book. She began having panic attacks. She said the shame was worse than the threats.

What changed things for her, according to the BBC, was people. Her daughter stayed with her. She filed a police report, changed her phone number, and told friends, family and colleagues to ignore the calls and messages, after which they all but stopped. Her sisters, her boss and an online community of other loan-app victims supported her, and she decided to fight back.

The BBC also counted at least 60 people in India who died by suicide after loan-app harassment, most in their 20s and 30s. One was Kirni Mounika, a 24-year-old civil servant who, police found, had borrowed from 55 apps. What upset her father most, he told the BBC, was that she had not told him: "We could have easily arranged the money." Telling one trusted person is often what breaks the pressure.

The same pattern appears in Mexico. In August 2022 the Thomson Reuters Foundation, in a story carried by Reuters, told the story of Pedro Figueroa, an IT specialist who used a pseudonym out of fear of reprisals. He borrowed 10,000 pesos (about $500) from an app called Jose Cash, received 5,500, and had seven days to repay at an annual rate of 360 percent. Within a week, abusive WhatsApp messages started, and a poster with his face edited onto a false criminal accusation was sent to his contacts and social media. He borrowed from other apps to pay down the first, and in three months owed $75,000 across 27 apps. "Panic, fear and shame came over me," he told the reporters.

A Mexican advocacy group counted more than 2,230 victims of fraudulent loan apps between June 2021 and January 2022. The consumer finance regulator, CONDUSEF, had received more than 700 reports of loan-app doxxing but told Reuters it had no authority over lenders that are not registered financial institutions.

How a loan app turns your phone into leverage

The loan is the bait. Your address book and your photo library are the real collateral.

The first step is the install. Reuters reported that the moment Figueroa installed Jose Cash he granted it access to his contacts list, call history, camera, location, SMS messages, social media accounts and browsing history. To get the loan he also uploaded his address, a picture of his national ID and his bank account number.

The second step is the squeeze: fees taken up front, a week to repay, a rate that makes repayment hard. That is how people end up borrowing from a second and third app.

The third step is the call centre. In undercover footage, a manager at a recovery firm near Delhi explained the method to the BBC: if a borrower misses a payment, staff start hassling them, then their contacts. "The customer then pays because of the shame," he said. "You'll find at least one person in his contact list who can destroy his life." Another executive, filmed by the BBC, said of the data his staff can reach: "it's like he's naked in front of us."

The fourth step is the disappearing act. Reuters found 29 loan apps with millions of downloads on Google Play that had been reported to the authorities for extortion, fraud, privacy violations and abusive practices. When Jose Cash was removed from view, the identical product appeared under another name, SuenoCredy, with the same unique app ID, privacy policy and contact. A privacy expert quoted by Reuters said the operators leave no names or addresses and use VPNs.

What "doxxed" means, and why it works

Doxxing, also written doxing, means searching for and publishing private information about a person without their consent, usually to punish or pressure them. A 2018 peer-reviewed paper in the International Journal of Environmental Research and Public Health defines it in nearly those words. Google's help page describes it as people sharing your private information to harm you.

In a loan app case, being doxxed means your debt, your photo, a fake accusation or an edited image is sent to the people whose opinion matters most to you. The weapon is the fear of what they will think. Seen as a tactic with a business model behind it, rather than a verdict on you, that fear gets a little easier to act against.

What the app can reach, and how to switch it off

The table lists permissions an app can request, with Google's descriptions, and what each gives a predatory lender.

Permission	What Android says it does	What a harassing lender can do with it
Contacts	Access your contacts	Copy every name and number, then message or call them
Photos and videos	Access photos and videos on your device	Take your pictures, or edit your face into fake images
Files	Access all files on your device	Collect ID scans, documents, screenshots
SMS	Send and check SMS messages	Read bank and one-time codes, and see who you talk to
Call logs	Read and write your phone call log	See who you call most, so they can pick the worst person to contact
Camera	Take pictures and record videos	Capture a selfie or ID photo during sign-up
Location	Access your device's location	Show you that they know where you are

Google's own rules say none of this is needed to lend money. Its Play policy prohibits personal loan apps from accessing sensitive data such as photos and contacts, and names permissions they may not request, including READ_CONTACTS, READ_MEDIA_IMAGES and READ_EXTERNAL_STORAGE. It also bars personal loans that must be repaid in full within 60 days, and in the United States loans with an annual rate of 36 percent or higher. In India, only apps on the Reserve Bank of India's list of digital lending apps may submit personal loan apps to Google Play.

These rules cover Google Play listings, and Reuters found apps that broke Google's policies. An app asking for your contacts is a warning sign whatever the store says.

Revoking a permission stops new reads. It does not pull back what was already uploaded, which is why the steps below also cover your contacts, evidence and account.

What it does to a person's mind

Panic is the word that keeps coming up in these accounts, and it is a body response to threat, not a sign that you are weak.

Bhoomi Sinhaa told the BBC she began having panic attacks and could not concentrate at work. Pedro Figueroa described panic, fear and shame arriving together. Both were threatened daily, both feared losing standing with the people closest to them, and both borrowed more to make it stop. Fear narrows thinking: when every call might be the next threat, it can feel as if there is only one way out.

Research on being doxxed backs up what these accounts suggest, although none of it was done on loan-app borrowers. A 2018 study of 2,120 secondary school students in Hong Kong found that 15 to 31 percent reported some piece of their personal information being disclosed without consent, including photos or videos (31.4 percent) and mobile phone numbers (15.1 percent). Almost every type of disclosed information was linked to more depression, anxiety and stress, most strongly phone numbers, private conversations and embarrassing photos or videos. The associations were modest, and the study covered adolescents, so it shows direction, not how any one person will feel.

The authors explain that exposed names, numbers and pictures raise worries about identity theft, harassment, safety and the judgment of an unknown audience. Those are reasonable responses to a real threat, not a flaw in you.

Shame keeps people silent, and silence is what the lender relies on: the BBC noted that most victims are too ashamed to speak. Telling one person, and then your contacts, takes away the lever.

If it is happening to you: the first hour on Android

Do these in order. You do not need to finish all of them today.

1. Do not borrow from another app to pay this one. Both the BBC and Reuters cases grew from one loan into dozens this way.
2. Take screenshots before you delete anything. Capture the threatening messages, the numbers they come from, the call log, the app name and its Play Store page, and any payment receipts. Keep copies somewhere the app cannot reach, such as a folder on your PC or an email to yourself.
3. Remove the permissions. Open Settings, tap Apps, tap the loan app (tap See all apps if you cannot find it), tap Permissions, then choose Don't allow for Contacts, Photos and videos, Files, SMS, Call logs and Location. Menu names differ slightly between phone makers, and Google notes that some of these steps work only on Android 11 and up.
4. Check what else has the same access: Settings, Security & Privacy, Privacy, Permission manager, then Contacts and Photos and videos.
5. Uninstall the app. In the Google Play Store tap your profile icon at the top right, then Manage apps & devices, then Manage, select the app and tap Uninstall. You can also use Settings, Apps, then the app and Uninstall.
6. Report the app in Google Play. Open the app's page in the Play Store, tap More, tap Flag as inappropriate, pick a reason and tap Submit.
7. Warn your contacts yourself, once, before the lender does. A short message is enough (example below).
8. Block the numbers that harass you. If the calls continue, consider a new SIM or number, as Bhoomi Sinhaa did, and tell the people who need the new one.
9. Tell one person you trust what is going on, today.

A message to contacts can be as short as this: "If you get a message or call about me from an unknown number, ignore it and do not reply. A loan app is sending threats and fake pictures to people in my phone book. Please block the number and tell me if you get anything."

If the debt is real, you may still owe the lender. But the BBC reported that one app kept harassing Bhoomi after she had paid in full and claimed she was lying, so paying under threat does not reliably end the abuse. A regulator or a lawyer can tell you what you really owe.

Windows, and your Google account

Loan apps run on the phone, but your PC helps in three ways: it is a safe place for evidence, it may be linked to your phone, and it is where you can check your Google account in a full browser.

If you ever linked your Android phone to Windows, Microsoft's Phone Link lets the PC read texts, calls and photos from the phone. To remove the link on Windows 11, follow Microsoft's steps:

• Open Phone Link on the PC, go to Settings, then Devices, open the overflow menu next to your phone and choose Remove.
• Open Windows Settings, then Bluetooth & devices, then Mobile devices, then Manage devices, and click Remove if your phone is listed.
• On the phone, open Link to Windows and sign out. On many Android phones it is under Settings, then Connected Devices, then Link to Windows; in the downloaded app it is Settings (upper right), then Accounts, then Sign out.

Next, check the Google account on that phone at myaccount.google.com, using Google's steps for a compromised account:

• Choose Security & sign-in, then Review security events under Recent security events, and mark anything you do not recognise as not you.
• Choose Your devices, then Manage devices, and sign out any device you do not recognise.
• Open myaccount.google.com/permissions and remove apps with access to your account that you do not need.
• Turn on 2-Step Verification, and change the password if the loan app or anyone else may have seen it.
• If you use Google Photos, check that no albums are shared with people you did not choose.

This matters because an app with SMS access may have seen your codes. A few minutes here closes a second route in.

Reporting it and getting images taken down

Report to the police or cybercrime service in your country. It may feel pointless: Bhoomi Sinhaa heard nothing after filing hers. Even so, a report gives you a record if your employer or bank asks questions later. A Mexican advocacy group told Reuters it had helped victims file more than 170 police reports.

• India: the National Cyber Crime Reporting Portal, cybercrime.gov.in, which also offers an anonymous report option. Victims of financial cyber fraud can call the 1930 helpline.
• United States: ic3.gov for internet crime, tips.fbi.gov for threats, and identitytheft.gov if your ID documents were used.
• United Kingdom: actionfraud.police.uk. If the person in the images is under 18, use CEOP.
• Under 18 and an image is being shared: takeitdown.ncmec.org.
• Intimate or fake intimate images of an adult: stopncii.org. It creates a digital fingerprint on your own device, the image itself is not uploaded, and participating platforms look for matches. It cannot remove images from the whole internet, only from the platforms in its partner list.

To get doxxing pages out of search results, use Google's request form. Google says you can ask it to remove a URL that shows your personal information together with threats or calls for harassment, or a large amount of aggregated personal data with no legitimate purpose. Google can only remove results from Google Search; to remove the page itself you have to contact the site's owner. You will need the exact web addresses and, ideally, screenshots.

Staying out of the next one

• If a lending app asks for contacts, photos, files or SMS, close it. Google's own policy says personal loan apps may not access them.
• Treat a seven-day repayment window or an annual rate in the hundreds of percent as a red flag; Reuters recorded 360 percent.
• Check the lender is licensed with your national regulator. Google asks developers in India, Kenya, Nigeria and other markets to prove registration, and you can use the same lists, such as the Reserve Bank of India's digital lending apps list or the Central Bank of Kenya's directory.
• Set Pause app activity if unused for apps you rarely open (Settings, Apps, the app) so permissions are removed on their own.
• Search for your own name and phone number now and then, and use Google's Results about you tool to ask for removal of contact details that appear.

If you need to talk to someone now

If you are thinking about harming yourself, or you are worried about someone else, please reach out now. You do not have to explain everything. In the United States, call or text 988, the Suicide & Crisis Lifeline. In the UK and Ireland, call Samaritans free on 116 123. Anywhere else, call your local emergency number or ask someone nearby to stay with you. If you are in India, the BBC lists support services on its Action Line page at bbc.co.uk/actionline.

What you are going through can pass. In the BBC's account, Bhoomi Sinhaa's story turned when her daughter, her sisters and her boss knew, and when she told the people around her what was happening.

Frequently asked questions

What does doxxed mean?

Being doxxed, or doxed, means that private information about you, such as your phone number, photos, address or contact list, is found and published or sent to others without your consent, usually to pressure or punish you. Google describes it as people sharing your private information to harm you.

Can a loan app really send messages to everyone in my contacts?

Only if it has permission to read your contacts. The BBC and Reuters both reported that predatory apps harvest the contact list at install and use it later. Google's Play policy bans personal loan apps from accessing contacts and photos, but apps still break rules, so check and revoke the permission.

Does deleting the app stop the harassment?

Not by itself. Uninstalling stops new access, but data already copied stays with the operators, and the calls can continue. Reporting, warning your contacts and, if needed, changing your number reduced the harassment in the account the BBC described.

How do I report a loan app on Google Play?

Open the app's page in the Play Store, tap More, then Flag as inappropriate, choose a reason and submit. Google also offers a form for reporting developer policy violations and a route for illegal content.

What if they send fake or private pictures of me?

Keep screenshots, tell the people receiving them what is happening, and report to the police. For intimate images of an adult, stopncii.org can create a digital fingerprint on your device so participating platforms can look for matches. For search results, you can ask Google to remove doxxing pages.

Is loan app blackmail illegal?

In the cases reported, authorities treated it as crime. Indian police charged call-centre operators with extortion, intimidation and abetment of suicide, according to the BBC, and a Mexican lawyer told Reuters the tactics break laws against digital harassment and defamation. Laws differ by country, so report locally.

Who can I talk to if I am scared or ashamed?

A trusted friend or relative first, then a crisis service. In the US call or text 988; in the UK and Ireland call Samaritans on 116 123. Many victims said the shame was worse than the debt, and telling someone was the turning point.