Fraudulent Credit Report Enquiry? Steps to Remove It and File a Police Complaint

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: A fraudulent hard enquiry on your credit report isn’t harmless — it means someone tried to borrow money using your PAN. You must immediately dispute it with the credit bureau, file a cybercrime police complaint, and lock your Aadhaar biometrics. If the lender is uncooperative, a legal notice and escalation can get the entry removed and help identify the fraudster.

Late one evening in October 2026, a marketing professional in Nagpur logged into his CRIF High Mark credit report. He does this every few months — more out of quiet anxiety than any real need. That evening, he froze. There, under the enquiries section, was a hard enquiry from Bajaj Finance Limited for a ₹5,000 loan with a 6-month tenure. He had never applied. He had never even heard of the company in that context. The entry was dated 18 October 2026. It’s a small amount. But the fear that settles in is outsized. He knew someone had used his PAN to attempt a loan. The credit bureau had his phone number and email, so he filed a dispute online immediately, gave them the enquiry reference number, and expected a quick resolution. He also emailed the lender’s grievance officer. The reply was polite but useless: they claimed they couldn’t find any corresponding loan application and asked him to send his PAN, mobile number, email ID, and the full credit report — the very personal details that had likely been compromised. He refused. Why would he give them more data? The stalemate deepened. After two weeks of no progress, he approached the Chamber of Advocate Sudhir Rao. This wasn’t just about one rogue enquiry. The worry was that today ₹5,000, tomorrow ₹5 lakh. The office of Advocate Sudhir Rao, having handled several such identity theft matters, immediately understood the procedural gap. A strongly worded legal notice was sent to the lender citing their obligation under RBI’s KYC and credit reporting norms. A formal complaint was drafted and filed with the local cybercrime police station. Simultaneously, the client was guided to lock his Aadhaar biometrics. Within three weeks, the fraudulent enquiry was scrubbed from the credit report, and the police began tracing the IP address of the application. Advocate Sudhir Rao’s domain experience in cyber fraud and banking law proved decisive — earlier efforts had gone nowhere, but a coordinated legal strategy got the outcome.

Key Facts of the Case

• A hard loan enquiry from Bajaj Finance Limited appeared on the client’s CRIF High Mark credit report without his consent.
• The enquiry was for a ₹5,000 personal loan with a tenor of six months, dated 18 October 2026.
• The client never applied for any loan from that entity and had no prior relationship with it.
• The credit bureau’s dispute mechanism was initiated, but the lender failed to resolve the matter, instead asking for sensitive KYC documents.
• The client suspected identity theft — his PAN and personal details had been misused by an unknown fraudster.
• No loan was disbursed; only a hard enquiry had been reported, but the risk of future larger frauds was imminent.
• Advocate Sudhir Rao’s office used a combination of a legal notice, a cybercrime complaint, and Aadhaar locking to secure relief.

The Direct Legal Answer

Should I file a complaint with Cyber Crime?

Yes — and you should do it without delay. An unauthorized hard enquiry is evidence of identity theft and possibly attempted cheating. File a complaint under the Information Technology Act, 2000 (Sections 66C and 66D) and the Bharatiya Nyaya Sanhita (BNS), 2023 (Sections 318 for cheating and 336 for forgery). A prompt complaint can stop the fraudster before an actual loan is disbursed, and it creates a legal record that helps you dispute the entry with credit bureaus and lenders.

Steps to block such frauds from happening again?

Lock your Aadhaar biometrics immediately via the UIDAI portal. That alone blocks most e-KYC based instant loans. Freeze your credit reports with CIBIL, Experian, Equifax, and CRIF High Mark using their paid “credit lock” or “freeze” feature. Never share your PAN or KYC documents casually, and register a complaint with the Reserve Bank of India’s Ombudsman if a regulated entity fails to cooperate. More practically, review your credit report every quarter — it is now a hygiene step, not paranoia.

Can a PIL be filed regarding these frauds?

A Public Interest Litigation can be filed, but it will not help an individual victim quickly. PILs are for systemic reform. The real issue — instant loan apps and weak KYC by NBFCs — has already seen some judicial attention in cases like Vinay Prakash v. Union of India (related to Chinese loan apps), though specific PIL citations for credit bureau misuse are limited. For immediate protection, individual action is far more effective: lock your Aadhaar, freeze your credit report, and pursue criminal and regulatory complaints.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Do not hand over KYC documents to a lender you suspect has been used fraudulently. The enquiry reference number is enough for them to trace the transaction internally. If they insist on your details, it’s often a stalling tactic. Send a legal notice quickly. That changes the tone of the response. And here’s the thing — this type of matter requires an advocate who understands both IT law and banking regulation. A general practitioner may treat it as a simple complaint, but it involves RBI’s master directions on KYC, credit information company rules, and cybercrime procedure. Domain-specific experience makes a tangible difference.

Applicable Sections of Law

A fraudulent loan enquiry using someone’s identity attracts criminal liability under the Bharatiya Nyaya Sanhita (BNS) 2023 and the Information Technology Act 2000. Key sections that apply:

• Section 318(4) BNS: Cheating by personation — impersonating another to obtain a loan.
• Section 336 BNS: Forgery of electronic records — creating a false loan application.
• Section 66C IT Act: Punishment for identity theft — using another’s electronic signature, password, or unique identification feature.
• Section 66D IT Act: Cheating by personation using computer resources.

Additionally, the RBI’s Master Direction on KYC and the Credit Information Companies (Regulation) Act 2005 impose duties on lenders to verify consent before pulling a credit report.

Punishment and Penalties

Identity theft and cheating by personation are serious offences under BNS. Section 318(4) BNS carries imprisonment of either description for a term which may extend to seven years, plus a fine. Section 336 BNS (forgery of electronic records) can attract imprisonment up to ten years and a fine. Under the IT Act, Section 66C is punishable with imprisonment up to three years and a fine, while Section 66D carries up to three years imprisonment and a fine. Most offences are cognizable and non-bailable when the amount involved is significant or where the fraud is part of an organized scheme. However, for a first-time offence involving a ₹5,000 enquiry with no actual loss, courts may consider bail favourably. The offences are compoundable only with the permission of the court where the victim and accused reach a settlement — and the RBI may separately impose monetary penalties on the lender for KYC violations.

Jurisdiction — Where to File the Case

The victim can file a criminal complaint at the cybercrime police station having territorial jurisdiction over the place where the victim resides or where the offence was discovered (the location where the credit report was accessed). Since the fraud involves an online act, the Information Technology Act grants wide jurisdiction. The complaint can also be filed before the local Judicial Magistrate under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita (BNSS). In addition, a complaint with the National Cyber Crime Reporting Portal (cybercrime.gov.in) is useful to create an official record. If the lender is a regulated entity, a complaint to the RBI Ombudsman can be filed online irrespective of location, and that can be faster than a criminal trial for getting the credit report corrected.

What if Police Refuse to File FIR?

If the police station refuses to register an FIR for a cognizable offence like identity theft, you have clear remedies under BNSS. The steps are:

• Submit a written complaint to the Superintendent of Police (SP) under Section 173(4) BNSS. The SP must investigate or direct an investigation.
• If the SP also does nothing, file a private complaint directly before the Judicial Magistrate under Section 175(3) BNSS. The Magistrate can order the police to investigate.
• In the rarest of cases, approach the High Court under writ jurisdiction for a mandamus directing registration of the FIR.
• Simultaneously, escalate the matter to the RBI Ombudsman against the lender — this doesn’t need an FIR and can often yield the removal of the fraudulent enquiry faster.

Rights of the Accused

In cases of fraudulent credit report enquiries, the accused — once identified — has all constitutional and statutory rights. Key rights include:

• Right against self-incrimination under Article 20(3) of the Constitution.
• Right to legal representation and to be defended by an advocate of choice under Article 22(1).
• Right to be produced before a Magistrate within 24 hours of arrest, excluding travel time.
• Right to a copy of the FIR and to be informed of the grounds of arrest.
• Right to bail as per the provisions of BNSS, and to file for anticipatory bail under Section 482 BNSS if the offence is non-bailable.

Bail Provisions

Offences under Section 318 BNS and Section 66C/66D IT Act are generally non-bailable, but courts often grant bail on conditions given the non-violent nature of the crime. The accused can apply for anticipatory bail under Section 482 BNSS before arrest, showing that there is no likelihood of fleeing and that cooperation with investigation is assured. Regular bail can be sought under Sections 480 and 483 BNSS. Bail strategy typically involves demonstrating that no actual loan was disbursed, no money was lost, and that the accused is not a flight risk. In such cyber frauds, courts also impose conditions like surrendering passport, marking presence, and not tampering with evidence.

Quashing of FIR / Case

The High Court can quash an FIR using its inherent powers under Section 528 BNSS. Quashing is appropriate if the FIR, even on its face, does not disclose a prima facie offence, or if it is an abuse of the legal process — for example, if the complainant cannot show any loss or if the accused and victim reach a settlement. In identity theft cases, if the accused can demonstrate that they did not initiate the loan enquiry and it was a technical error or a third-party data breach, the Court may quash the proceedings. However, quashing is not a routine exit; it requires a strong showing that the criminal process is being misused.

If You Are the Victim

• Check all credit bureau reports immediately: CIBIL, Experian, Equifax, and CRIF High Mark.
• File a dispute with the bureau online and save the dispute reference number. This creates a timeline.
• Lock your Aadhaar biometrics using the mAadhaar app or UIDAI website — this stops most instant loan e-KYCs.
• File a cybercrime complaint on the National Cyber Crime Reporting Portal and at your local police station. Get an acknowledgment.
• Send a formal legal notice to the lender’s nodal officer, demanding deletion of the enquiry and details of the applicant.

Documents You Must Keep Ready

• Copy of your PAN card and Aadhaar card.
• The full credit report (downloaded PDF) showing the disputed enquiry clearly.
• Screenshot of the dispute reference number from the credit bureau portal.
• All email communication with the lender and bureau.
• A written complaint draft detailing the sequence of events.
• Address proof and identity proof for filing the police complaint.
• Any previous loan statements to show normal credit behaviour.
• A notarised affidavit if the police require a sworn statement.

What Evidence Is Required?

• Primary evidence: the official credit report from a RBI-licensed credit bureau, digitally signed or with a reference number.
• Secondary evidence: screenshots of the dispute registration page, email chains, and SMS alerts if any.
• Affidavit of the victim stating they never applied for the loan — this carries weight in court.
• Server logs or IP address data from the lender (subpoenaed through court).
• Call detail records if the fraudster communicated with the victim.
• KYC documents of the fraudster, if available, to establish impersonation.
• Witness statements from family or colleagues confirming the victim’s whereabouts during the enquiry.

How the Police Behave in Such Cases

For cyber frauds involving small amounts and no immediate financial loss, police stations often treat the matter as low priority. They may try to dissuade you, saying “no money was taken, so why bother.” This is where a legal notice and proper drafting of the complaint helps — the language must show it’s a cognizable offence and that an FIR must be registered. In the initial stages, the police may ask the lender for more information rather than actively investigate. But once a formal FIR is lodged, the process gets moving. Having an advocate who regularly handles cybercrime cases makes a difference because they know how to push past the initial inertia and cite the correct legal provisions.

Timeline of Legal Process

• Filing dispute with credit bureau — 7 to 30 days for resolution.
• Filing cybercrime complaint and registration of FIR — ideally within 24-48 hours, but may take a week with pushback.
• Investigation by police — 60 to 90 days (can extend).
• Filing of chargesheet under Section 193 BNSS — within 60 days for offences punishable with less than 7 years, 90 days otherwise.
• Cognizance by Magistrate and framing of charges — 2-4 months after chargesheet.
• Trial — 6 months to 2 years depending on court workload.
• Appeal — if any, another 6-12 months.

How Long Will the Investigation Take?

Cybercrime investigations into identity theft and loan application fraud typically take around 60 to 90 days for a chargesheet, assuming the police have responsive cooperation from the lender and credit bureau. Delays happen if the IP addresses lead outside the state, requiring coordination with other police units. Realistically, expect 3-4 months before you see a chargesheet, and often, the fraudulent enquiry is removed from the credit report much earlier — within weeks once a legal notice is sent.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

In identity theft cases where no actual loan was disbursed and the loss is only an intrusive credit enquiry, settlement is possible. The victim can agree to drop the criminal complaint if the lender removes the enquiry and identifies the culprit so that future frauds are prevented. However, because the offence is non-compoundable under BNS, the court’s permission is required for compounding. Many such disputes end with a mutual settlement and a quashing petition before the High Court under Section 528 BNSS. Pre-litigation mediation is less common, but the RBI Ombudsman route effectively functions as an out-of-court mechanism to force the lender to correct the credit report.

Common Mistakes People Make

• Ignoring a small amount enquiry, assuming it’s harmless — that’s exactly what the fraudster counts on.
• Providing KYC documents to the lender when they ask for it, instead of insisting on investigation using the enquiry reference number alone.
• Not locking Aadhaar biometrics immediately, which leaves the door open for more fraudulent loans.
• Delaying the police complaint, which weakens the paper trail and makes it harder to trace the IP address or digital footprint.
• Engaging a lawyer who doesn’t regularly handle cyber fraud and banking matters — domain-specific procedural knowledge often determines whether the enquiry is removed in two weeks or drags on for months.
• Venting on social media with screenshots of the credit report — that can expose even more personal data and complicate any investigation.

FAQs People Normally Have

Can a hard enquiry itself affect my credit score? Yes, a single hard enquiry can drop your CIBIL score by a few points, but with a dispute and removal, the bureau can restore the score.

Do I need to visit the police station in person? For a cybercrime complaint, you can file online first, but for an FIR, physical presence is typically needed. Your advocate can accompany you.

How do I know if a loan was actually disbursed? Check your full credit report for any active loan accounts, not just the enquiry section. If no loan account appears, the disbursement likely didn’t happen.

Can I sue for damages? Yes, a civil suit for mental agony and loss of reputation is possible against the fraudster and, in some cases, the lender if they violated RBI norms.

Will the police trace the fraudster? Often yes, if the lender shares the IP address, device fingerprint, and KYC documents submitted during the application. That data is crucial.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.