Loan Recovery Agent Threats and Morphed Images — Legal Remedies Under Indian Law

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Priya Nair, a working professional from Gomti Nagar, Lucknow, had availed a small personal loan through the CASHe app in early February 2025. Her repayment due date, as clearly displayed in the app, was still a day away. That's when the trouble started.

A person identifying himself as a recovery agent for CASHe began calling and messaging Priya repeatedly, demanding immediate payment. When she pushed back, citing the app's own schedule, things escalated fast. The agent threatened to blacklist her credit profile, contact her family members and employer, and used abusive, sexually explicit language over WhatsApp. Within hours, morphed obscene images purporting to feature Priya were sent to her personal number as a means of intimidation. Frightened and ashamed, she paid the loan amount early through the official app just to make it stop.

Priya and a close friend initially emailed the company's grievance officer and senior management with screenshots and recordings. The company acknowledged receipt but took no concrete action for over three weeks. At that point, her friend connected her with Advocate Sudhir Rao. A prior attempt by a general-practice lawyer had not produced any response from enforcement authorities. With domain-specific handling — simultaneous cybercrime complaints, a formal RBI grievance, and a consumer forum notice — the matter drew prompt regulatory attention, the agent was identified, and an FIR was registered within a structured legal timeline. Priya was not alone, and the law had clear answers.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Preserve all digital evidence immediately: Don't delete any messages, call logs, or images received. Take timestamped screenshots and back them up to a secure cloud account or email them to yourself. Digital evidence degrades in evidentiary value if tampered with or lost early in the process.

File complaints on multiple tracks simultaneously: Cybercrime complaints, RBI's Complaint Management System (CMS), and the National Consumer Disputes Redressal Commission (NCDRC) portal can all be approached in parallel. Waiting for one to respond before filing another costs you critical time.

And here's the thing — this category of case sits at the intersection of cybercrime law, financial regulation, and consumer rights. Procedural requirements at the cybercrime cell, the evidentiary thresholds for morphed-image offences, and the specific RBI Digital Lending Guidelines 2022 are areas where domain-specific experience genuinely matters. A general practitioner won't always identify which combination of forums and sections produces the fastest enforceable outcome.

Applicable Sections of Law

• Section 74 BNS (Assault or criminal force to woman with intent to outrage her modesty): Sending morphed obscene images to intimidate a woman directly attracts this provision alongside digital-medium provisions.
• Section 351 BNS (Criminal intimidation): Threatening to blacklist, contact the employer, or circulate images to coerce payment constitutes criminal intimidation.
• Section 318 BNS (Cheating): Falsely claiming a payment was due immediately to extract early payment amounts to cheating by deception.
• Section 66E and Section 67A of the Information Technology Act, 2000: Publishing or transmitting obscene or morphed sexually explicit material through electronic means is punishable under these provisions, which continue to operate alongside the BNS framework.

Punishment and Penalties

• Section 351 BNS (Criminal intimidation): Imprisonment up to two years, or fine, or both. If threat is of death or grievous hurt, imprisonment extends to seven years.
• Section 74 BNS: Imprisonment up to two years, with fine.
• Section 67A IT Act: First conviction — imprisonment up to five years and fine up to Rs. 10 lakhs. Subsequent conviction — imprisonment up to seven years and fine up to Rs. 10 lakhs.
• Nature of offences: Section 351 BNS is cognizable and non-bailable. Section 67A IT Act offences are cognizable and non-bailable. These are generally non-compoundable, meaning a private settlement does not automatically end prosecution.

Frankly, that last point surprises many people. They assume paying off the agent or reaching a private understanding closes the matter. It doesn't. Not here.

Jurisdiction — Where to File the Case

For cybercrime offences involving morphed images and digital threats, the complaint is filed at the Cyber Crime Police Station having jurisdiction over the location where the victim received the offending communication — in this type of case, the victim's city of residence. Alternatively, complaints can be registered online at cybercrime.gov.in, which routes the matter to the appropriate state cell.

The RBI Complaint Management System (cms.rbi.org.in) governs grievances against regulated lending entities. Consumer forums under the Consumer Protection Act, 2019 have pecuniary jurisdiction based on the value of services involved. Don't underestimate jurisdiction — filing in the wrong forum can result in your complaint being dismissed at the threshold.

What if Police Refuse to File FIR?

Refusal to register an FIR in a cognizable offence is itself unlawful, as affirmed in Lalita Kumari v. Government of UP, 2014 (SC). Here's what you can do:

• Submit a written complaint to the Superintendent of Police under Section 173(4) BNSS, with copies of all digital evidence annexed.
• File a private complaint before the concerned Judicial Magistrate under Section 175(3) BNSS, who can direct the police to investigate.
• Approach the High Court under its writ jurisdiction (Article 226 of the Constitution) seeking a direction to register FIR and investigate.
• File a complaint with the State Cyber Crime Cell directly if the local police station is unresponsive to digital offence complaints.

Now, before you act, know this: the Lalita Kumari ruling is binding on every police station in the country. Citing it by name, in writing, when you submit your complaint changes the tone of the interaction considerably.

Rights of the Accused

If you are the person accused in such a matter, Indian law guarantees you the following protections:

• Right against self-incrimination: Under Article 20(3) of the Constitution, no accused person can be compelled to be a witness against themselves.
• Right to legal representation: Article 22 guarantees the right to consult and be defended by an advocate of your choice from the point of arrest.
• Right to be produced before Magistrate: Every arrested person must be produced before a Magistrate within 24 hours of arrest under Article 22(2) and Section 58 BNSS.
• Right to copy of FIR: The accused or their advocate is entitled to a copy of the FIR on request.
• Right to know grounds of arrest: Grounds must be communicated at the time of arrest under Article 22(1).

Bail Provisions

Offences under Section 351 BNS and Section 67A IT Act are non-bailable, meaning bail is not a matter of right and must be applied for before a court.

• Anticipatory bail: If arrest is anticipated, an application under Section 482 BNSS before the Sessions Court or High Court should be filed promptly.
• Regular bail: After arrest, regular bail is applied for under Section 480 or Section 483 BNSS before the Magistrate or Sessions Court depending on the stage.
• Typical bail conditions: Surrendering passport, reporting to the police station periodically, and refraining from contacting the complainant are common conditions.

Bail strategy in cybercrime matters depends heavily on the severity of the digital evidence recovered. Getting anticipatory bail in place before the FIR leads to arrest is often the smarter procedural move. Don't wait to see what happens.

Quashing of FIR / Case

The High Court holds inherent powers under Section 528 BNSS to quash an FIR where the complaint discloses no prima facie cognizable offence, where continuation of proceedings amounts to abuse of process of court, or where the parties have genuinely settled in compoundable matters.

But make no mistake — offences under Section 67A IT Act are not compoundable. A private compromise between the agent and the victim will not, by itself, result in quashing. The High Court retains discretion and will scrutinise whether the FIR was registered mala fide or whether the allegations, even if true, do not constitute the offence charged. This is a strategic call that requires careful evaluation of the specific facts before approaching the court.

If You Are the Victim

• Do not pay any further amounts under duress. Payment made under coercion can itself be evidenced as extortion, strengthening your case.
• Preserve all call recordings, WhatsApp screenshots, and images received — do not forward them to third parties, as this could create secondary complications.
• File a cybercrime complaint immediately at cybercrime.gov.in, attaching all preserved digital evidence.
• Simultaneously raise a grievance on the RBI CMS portal against the lending company for violating RBI's Digital Lending Guidelines, 2022, which prohibit intimidation, obscene communication, and contacting third parties.
• Approach a consumer forum if the lending company fails to respond or take disciplinary action against the agent within the statutory timeframe.

Documents You Must Keep Ready

• Aadhaar card and PAN card (identity proof)
• Loan agreement or digital lending contract as shown in the app
• Screenshots of the app showing the actual due date of repayment
• WhatsApp chat exports with timestamps (use the in-app export function)
• Screenshots or downloads of morphed images received (secured, not shared)
• Call recordings if available, with date and time metadata
• Email correspondence with the company's grievance officer, including delivery receipts
• Payment confirmation showing the early payment made under duress

What Evidence Is Required?

• Primary digital evidence: WhatsApp chats, call recordings, and received images constitute primary electronic evidence under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.
• Certification under Section 63 BSA: A certificate authenticating electronic records may be required when producing digital evidence before court — your advocate will arrange this.
• Bank statement: Showing the payment transaction date, confirming it was made before the actual due date.
• App screenshots: Showing the loan due date as displayed by the lender's platform.
• Grievance email trail: Demonstrating that the company was informed and failed to act.
• Witness statement: A friend or family member who witnessed the communications can provide a supporting affidavit.

How the Police Behave in Such Cases

Cybercrime cells in most major cities are better equipped today than they were five years ago, but response still varies significantly. Police may initially treat this as a civil loan dispute rather than a criminal matter, particularly if they're unfamiliar with the RBI Digital Lending Guidelines. Expect requests for voluminous documentation before registration. Some stations may suggest mediation with the company first.

And here's why that's a problem — mediation at this stage only delays the evidence trail. Having an advocate present the complaint in proper legal form, with statutory provisions cited, materially improves the probability of prompt FIR registration rather than a mere general diary entry.

Timeline of Legal Process

• Week 1-2: Cybercrime complaint filed online or in person; RBI CMS grievance raised; company issued legal notice.
• Week 2-4: Cybercrime cell acknowledges and begins preliminary enquiry; RBI forwards to the regulated entity's nodal officer.
• Month 1-2: FIR registered (if not, escalation to SP or Magistrate); police begin investigation, seek call data records and device forensics.
• Month 2-4: Chargesheet filed before Magistrate (within 60 days for non-bailable offences under Section 193 BNSS, extendable to 90 days).
• Month 4-6: Cognizance taken; charges framed; trial commences.
• 6 months to 2 years: Trial, examination of witnesses, arguments, judgment.
• Post-judgment: Appeal before Sessions Court or High Court if required.

How Long Will the Investigation Take?

For non-bailable cybercrime offences, police must file a chargesheet within 60 days of arrest under Section 193 BNSS, extendable to 90 days by the Magistrate. Where no arrest is made immediately, the investigation can extend to 3 to 6 months depending on digital forensic workload and cooperation from the service provider in furnishing records. Pushing for early evidence preservation orders helps prevent data deletion by the platform.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.