How to Check if a Loan App Is Genuine in India: 7-Step Verification Checklist

India has a loan-app problem, and it is not subtle. Google has repeatedly purged lending apps from the Indian Play Store for failing to prove a partnership with a regulated lender, state police cybercrime units run standing investigations into extortion-based "instant loan" rackets, and the RBI has had to build an entire regulatory framework — the Reserve Bank of India (Digital Lending) Directions, 2025 — partly because of how bad the fake-app ecosystem got.

Here is the single most important thing to understand before you install anything: RBI does not approve apps. It registers lenders. There is no such thing as a loan app that is itself "approved by RBI" — anyone claiming that is either confused or lying to you. A genuine loan app is a distribution channel (RBI calls it a Digital Lending App, or DLA) operated by, or partnered with, a Regulated Entity (RE) — a bank or an RBI-registered NBFC. The app is just glass. The lender behind the glass is what gets regulated.

So verification is really one question asked seven ways: can I trace this app back to a real, currently-registered lender, and does the flow behave the way RBI forces real lenders to behave? Here is the checklist we use ourselves before listing any lender's product.

Step 1: Find the regulated lender behind the app

Open the Play Store listing and the app's own website. A genuine app names its lending partner(s) — the actual legal entity, like "XYZ Finance Private Limited (RBI-registered NBFC)" — in the store description, the app footer, the loan agreement, and the Key Fact Statement. The Digital Lending Directions, 2025 require this disclosure to be prominent, not buried.

Practical test: if you cannot find the legal name of a bank or NBFC within two minutes of looking, uninstall. "We work with leading financial institutions" without naming one is not a disclosure; it is a dodge.

Step 2: Cross-check that lender on RBI's official lists

Go to rbi.org.in and find the List of NBFCs (RBI publishes and updates it as a downloadable list). Match the exact legal name from Step 1 — not the brand name. "QuickPaisa" is a brand; the RBI list will show something like "QP Fincap Private Limited".

Two things to check:

Check	Where	What a pass looks like
Lender is registered	RBI "List of NBFCs"	Exact legal name appears, with a Certificate of Registration
Registration is alive	RBI's list of cancelled CoRs	Name does not appear on the cancelled list

RBI also maintains a separate list of NBFCs whose Certificates of Registration have been cancelled. A surprising number of predatory apps ride on the corpse of a cancelled NBFC. Check both lists.

If the partner is a bank, verify it on RBI's list of banks the same way.

Step 3: Reverse-check on the lender's own website

The Directions, 2025 require REs to publish, on their own websites, the list of their Digital Lending Apps and their Lending Service Providers (LSPs). So do the check in reverse: visit the NBFC's corporate website and confirm the app you downloaded is actually listed there.

This catches a common fraud pattern — a fake app that names a real NBFC without any actual relationship. The NBFC's site won't list it. RBI also now publishes a directory of DLAs on its website as reported by REs; note that inclusion there is based on RE submissions, not an RBI endorsement — but absence of a well-known app is a useful red flag.

Step 4: Demand the Key Fact Statement before you sign anything

Every genuine digital loan must present a Key Fact Statement (KFS) before execution of the loan contract: sanctioned amount, all fees, the all-inclusive APR, repayment schedule, penal charges, and the grievance redressal officer's contact. Charges not in the KFS cannot be collected from you.

Behavioural test: a genuine flow shows you the KFS and gives you time to read it before e-sign. A predatory flow demands documents, selfie, and permissions first, and shows pricing never or after the fact. If there is no KFS, there is no loan you should take. (Our guide on reading a KFS covers the line items in detail.)

Step 5: Audit the app's permissions

This is where fake apps expose themselves fastest. Under the Digital Lending Directions, 2025, a DLA cannot access your phone contacts, call logs, or media/file storage. It may take one-time, need-based access to camera, microphone, or location for KYC — with your explicit consent — and nothing more.

Before granting anything, check the permission requests:

• Contacts access → hard stop. No legitimate lending app in India may ask for this. Contact scraping exists for one purpose: harassing your family during collections.
• All-files / gallery access → hard stop. Same logic; that's how morphed-photo extortion starts.
• Camera for a live selfie during KYC → normal.
• One-time location during KYC → normal.

On Android: Settings → Apps → [app] → Permissions. Do this after install but before onboarding.

Step 6: Follow the money

RBI's rule is direct flow: disbursal must come straight from the lender's bank account to yours — no pass-through wallets, no third-party pool accounts (with narrow exceptions like co-lending arrangements between REs). Repayment likewise goes to the RE's account.

Concrete red flags:

• You're asked to pay a "processing fee", "GST", "insurance", or "file charge" via UPI before disbursal. Genuine lenders deduct fees from the disbursed amount or bill them in the KFS — they do not collect ₹1,999 on a personal UPI ID to "release" your ₹10,000. This is the signature of advance-fee fraud; there is no loan.
• Disbursal arrives from an individual's account or a random current account instead of the named NBFC.
• Repayment instructions point to a personal UPI handle or change from message to message.

Step 7: Check the grievance machinery and Sachet

A genuine app publishes its Grievance Redressal Officer — name, email, phone — in the app and on the website, because RBI requires it, along with a 30-day resolution obligation before you can escalate to the RBI Ombudsman.

Then do two searches:

1. Sachet (sachet.rbi.org.in) — RBI's portal for reporting unregistered entities. Search the app/company name; complaints from other borrowers show up here.
2. The app name plus words like "harassment", "fraud", "fake" — five minutes of reading recent reviews (sort by newest; ignore the five-star wall) tells you what the marketing won't.

Quick-reference red flag table

Signal	Verdict
No named bank/NBFC partner anywhere	Fake or non-compliant — avoid
Asks for contacts or gallery access	Illegal under the 2025 Directions — avoid
Any fee via UPI before disbursal	Advance-fee fraud — avoid, report
APK shared on WhatsApp/Telegram, not on an official store	Avoid
No KFS / no APR shown before e-sign	Non-compliant — avoid
Repayment to a personal UPI ID	Fraud pattern — avoid, report
Named NBFC appears on RBI's cancelled-CoR list	Avoid, report on Sachet

Where KredBaba fits (and honest limits)

KredBaba is a Lending Service Provider (LSP) — we help you discover and compare products from RBI-registered lenders. We are not a lender: we don't lend our own money, hold your funds, or collect repayments, and no LSP can guarantee approval on any lender's behalf. Every product we list is traceable to a named RE, and you should still run this checklist yourself — including on us. Verification you did with your own hands beats any badge on any website, ours included.

Two minutes on the RBI list, one look at the permissions screen, and one rule — never pay to receive a loan — filters out the overwhelming majority of predatory apps. Sabse pehle lender ka naam dhoondo; naam nahi mila, toh loan bhi nahi.