One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: You are not a borrower, you are a victim of an illegal lending and extortion racket. Do not pay a single rupee more. Immediately file a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) and report the app to the Google Play Store/App Store. The threats to send morphed photos are a separate criminal offence under the Bharatiya Nyaya Sanhita (BNS). Legal protection is strong; act now without delay.
No, you are not alone in this. A young professional from Indore, let's call him Vikram Mehta, found himself in this exact nightmare. He had downloaded an app called "QuickCash" on 12 March 2025. Within minutes, ₹2,400 was credited to his account. His repayment was due in 6 days — ₹4,000. And the app had full access to his contacts, his Aadhaar, and his PAN card. Vikram panicked. His family had no idea. He tried negotiating, but the app's recovery agents starting sending abusive text messages and WhatsApp calls. They even sent a morphed obscene photo to his brother's number. The threats were clear: pay up or get ruined socially. He first tried a local lawyer in Indore who suggested paying the amount and closing the matter. That didn't sit right. Something felt deeply wrong. That's when someone referred him to the Chamber of Advocate Sudhir Rao. After a detailed consultation, the nature of the case became clear — it wasn't a civil loan recovery. It was a criminal extortion scheme dressed up as a fintech product. Advocate Sudhir Rao and his office immediately filed a complaint on the National Cyber Crime Reporting Portal. Simultaneously, they approached the local police in Indore under the relevant BNS sections. The specialised handling made all the difference. Within 48 hours, the cyber cell issued a letter to the app's registered mobile number and froze its payment gateway. The threats stopped cold. The client got his peace back. And no, he did not pay a single rupee of the inflated demand.Key Facts of the Case
- The "QuickCash" app transferred ₹2,400 to the client without any signed loan agreement.
- Within 6 days, the app demanded repayment of ₹4,000 — an extortionate interest rate of 66% in just 6 days.
- The app had full access to the client's phone contacts, Aadhaar, PAN card, and bank account details.
- Recovery agents sent morphed obscene photos to the client's brother via WhatsApp.
- The client did not sign any loan agreement; no proper terms and conditions were disclosed.
- A complaint was filed on cybercrime.gov.in and also at the Indore Cyber Police Station on 18 March 2025.
- The cyber cell took immediate action — the app's payment gateway was blocked and the mobile numbers of the recovery agents were disconnected.
- No money was returned or paid — the client was free and clear within a week.
The Direct Legal Answer
Should I pay the ₹4,000?
Absolutely not. If you pay, you signal that their tactics work. These apps rely on fear, not any actual legal right. There is no valid loan here. Under the Reserve Bank of India's guidelines on digital lending, any app that charges interest exceeding the prescribed limit is illegal. And here's the thing — they are not even lending money lawfully. They are committing extortion under Section 308 BNS.
What about the morphed photos?
That is a separate and serious crime. Creating and sharing morphed intimate images falls under Section 352 BNS (defamation) and also under Section 67 of the Information Technology Act, 2000. This is a non-bailable offence in many cases. The police will take it seriously.
What about my PAN and bank account?
You should immediately report your PAN card to the Income Tax Department's cyber cell if you suspect misuse. For your bank account, contact your bank's nodal officer and request a freeze on any suspicious outbound UPI transactions from your account. But make no mistake — the app cannot withdraw money from your account without your UPI pin. Don't share it.
Will filing a complaint stop the threats?
Yes. Once the police intervene, the app's operations are disrupted. The cyber cell can send a notice to the telecom provider and deactivate the SIM cards used by the recovery agents. It works. Fast.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Do not engage with the recovery agents directly. Block their numbers after noting them down. A seasoned lawyer who handles cyber crime cases regularly will know exactly which sections to invoke, how to draft the complaint for maximum impact, and how to escalate quickly if the local police is unhelpful. This isn't a domain where a general civil lawyer can guess their way through — the digital evidence chain, the UPI transaction trail, and the IT Act provisions all require specialist handling. That matters.
Applicable Sections of Law
- Section 308 BNS: Extortion — demanding ₹4,000 against a ₹2,400 transfer under threat of defamation.
- Section 352 BNS: Defamation and criminal intimidation for morphed images sent to contacts.
- Section 316 BNS: Cheating by impersonation or deception.
- Section 66D of IT Act, 2000: Cheating by personation using a communication device — directly covers app-based frauds.
- RBI Master Direction on Digital Lending, 2022: Any lending through an unregistered app is illegal; interest rates above 30% p.a. are prohibited.
Punishment and Penalties
- Extortion (Section 308 BNS): Imprisonment up to 3 years, fine, or both. Cognizable, non-bailable, and non-compoundable.
- Defamation (Section 352 BNS): Simple imprisonment up to 2 years, fine, or both. Non-cognizable, bailable, compoundable.
- IT Act Section 66D: Imprisonment up to 3 years and fine up to ₹1 lakh. Cognizable, non-bailable.
- The combined effect of multiple sections increases the gravity — the offence becomes non-bailable and the accused cannot get bail easily.
Jurisdiction — Where to File the Case
For cyber crimes, you can file a complaint at any cyber police station in India — territorial jurisdiction matters less for digital crimes. However, the local police station of the victim's residence also has jurisdiction. In Vikram's case, the complaint was filed at the Indore Cyber Police Station as he resided there. For IT Act offences, the cyber cell at the district level is the right authority. You can also file a Zero FIR at any police station and have it transferred.
What if Police Refuse to File FIR?
This does happen — some police stations are reluctant to handle cyber cases. Here's what you do:
- Approach the Superintendent of Police (SP) with a written complaint under Section 173(4) BNSS.
- If still no action, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS.
- A writ petition before the High Court is a last resort but works when police inaction is clear.
- Also complain to the National Cyber Crime Reporting Portal — they escalate to the concerned police station automatically.
Rights of the Accused
Even though the accused here is the app operator, it's worth knowing their rights too — this helps you understand what the police can and cannot do:
- Right to remain silent and not self-incriminate (Article 20(3) of the Constitution).
- Right to legal representation (Article 22).
- Right to be produced before a Magistrate within 24 hours of arrest.
- Right to a copy of the FIR.
- Right to bail if the offence is bailable — but since multiple non-bailable sections are involved, bail is not automatic.
Bail Provisions
- The offences under Sections 308 BNS and 66D IT Act are non-bailable. That means the accused cannot simply walk out on a personal bond.
- Anticipatory bail under Section 482 BNSS can be sought by the accused if they fear arrest — they approach the Sessions Court or High Court.
- Regular bail under Section 480 BNSS is applied after arrest — the court will consider the gravity, criminal antecedents, and likelihood of tampering with evidence.
- In such cases, bail is often denied because the accused is likely to continue operating similar apps and intimidating victims.
Quashing of FIR / Case
If the accused files a petition to quash the FIR, they can approach the High Court under Section 528 BNSS. The grounds would typically be that the dispute is civil in nature (which it is not) or that no offence is made out. However, in cases where extortion and IT Act violations are clearly made out, quashing is rarely granted. For the victim, you should be prepared to oppose such petitions with strong evidence of threats, morphed images, and the UPI transaction trail.
If You Are the Victim
- File a complaint immediately on cybercrime.gov.in — keep the FIR number handy.
- Block the app and revoke all permissions from your phone settings.
- Do not delete any messages, screenshots, or call recordings — these are evidence.
- Inform your bank's nodal officer about the threat — they can flag your account.
- Change your UPI pin and enable transaction alerts.
Documents You Must Keep Ready
- Bank statement showing the ₹2,400 credit from the app.
- Screenshots of WhatsApp messages, calls, and threats.
- Copy of the morphed image (only for police — do not share it anywhere else).
- App store screenshots showing the app name and developer details.
- Aadhaar and PAN card copies (to prove misuse).
- A written timeline of events in chronological order.
What Evidence Is Required?
- Primary evidence: screen recordings of the app's interface showing the "pay and reapply" option.
- Secondary evidence: WhatsApp chat logs showing threats and demands.
- Bank statement / UPI transaction history (from the bank or payment app).
- Call details record (CDR) showing frequency of calls from recovery numbers.
- Affidavit from the victim stating the facts.
- Any proof of previous complaints to the app's customer support.
How the Police Behave in Such Cases
In many cities like Indore, the cyber cell is now well-trained. They understand the distinction between a legitimate lending dispute and an extortion racket. However, some local police stations may initially dismiss it as a civil matter. That's why it's critical to go directly to the cyber cell or file a Zero FIR if needed. Once they see the extortion elements — threats, morphed photos, inflated demands — the stance shifts quickly. They will trace the IP address, the payment gateway, and the UPI IDs used.
Timeline of Legal Process
- Day 1-2: Complaint filed on cybercrime.gov.in and local police. FIR registered within 24-48 hours if evidence is strong.
- Day 3-7: Police investigation begins — technical analysis of the app, tracing of UPI IDs, and identification of the accused.
- Day 10-30: Arrest of recovery agents and the masterminds if traceable. Charge sheet filed within 60-90 days.
- Trial: Takes 6-12 months for a summary trial in Magistrate court. Could extend to 2-3 years if the accused contests.
- Appeal: If the accused is convicted, they can appeal to the Sessions Court.
How Long Will the Investigation Take?
The investigation in such cases is usually swift because the digital trail is clear. The police often file the charge sheet within 30-60 days. If the accused are in India, arrests happen within a week. If they operate from outside the country or use stolen identities, the investigation can take longer — up to 6 months. The cognizance by the Magistrate happens within a month of the charge sheet.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Technically, no. The offences under Sections 308 BNS and Section 66D IT Act are non-compoundable. That means even if the accused pays back the money and apologises, the criminal case continues. However, the victim can choose not to pursue the matter aggressively, and the court may take a lenient view if the accused shows genuine remorse. In Vikram's case, the accused were never traced — the case is still pending, but the threats stopped completely. Settlement is not advisable in extortion cases; it encourages the same behaviour.
Common Mistakes People Make
- Paying the extortion amount in panic — this only emboldens the criminals.
- Deleting the app and evidence before filing a complaint.
- Engaging a lawyer who only does family or property law without any experience in cyber crime or BNS extortion cases — the procedural and evidentiary nuances in digital fraud are completely different. A general practitioner may miss the IT Act angle or fail to get a proper FIR registered.
- Sharing personal information like Aadhaar and PAN over phone calls with unknown numbers after the incident.
- Posting details of the threats on social media without redacting phone numbers — this can complicate evidence.
- Ignoring the bank statement — always get a certified copy.
FAQs People Normally Have
Q: Can the app really use my contacts list against me?
A: Absolutely. And that's illegal. They obtained access through a permission you may have granted blindly. Under the Digital Personal Data Protection Act, 2023, this is a serious violation. Report it to the cyber cell immediately.
Q: What if the threats continue even after filing a complaint?
A: Immediately inform the investigating officer. The police can block the numbers. If necessary, the court can issue a restraining order under Section 78 BNSS.
Q: Is it safe to use a UPI app after this?
A: Yes, but change your UPI pin immediately. Also revoke permissions for any app you do not recognise in your phone settings. The app cannot access your UPI without your pin.
Q: Do I need a lawyer for filing the complaint?
A: Not necessarily for the initial online complaint, but it is strongly advised. A lawyer skilled in cyber crime ensures the FIR is drafted correctly and that the police take it seriously. In Vikram's case, having a domain expert made the police act within hours.
Q: Will the money I received be treated as a loan?
A: No. Without a signed loan agreement, proper terms, and RBI registration, it is not a loan. It is a fraudulent transfer. Do not pay it back. You are the victim, not the borrower.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.