One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: An NBFC’s recovery agents disclosing your loan details to family members and misusing your KYC photo via WhatsApp is a clear violation of RBI’s Fair Practices Code and digital lending guidelines. You can file a complaint with the NBFC’s grievance officer, escalate to the RBI Ombudsman, and seek compensation for harassment and deficiency in service. The Ombudsman can award compensation but no fixed amount exists; it depends on the severity of the breach and evidence.
Around early November 2024, Rohan Verma, a software professional from Nagpur, noticed something alarming. He had been diligently repaying a personal loan from Mahindra Finance for nearly two years. No defaults. No late payments. Then, while he was away on a work trip, a recovery agent visited his family home. The agent spoke directly with his elderly father, disclosing the loan amount, tenure, and financial details. Rohan got a frantic call. The next day, a different person messaged him on WhatsApp from a personal number. The message contained his own KYC verification photo — the one he had submitted during loan onboarding — along with a veiled threat that they knew about the visit and would “send a team again tomorrow.” Rohan had earlier sent a complaint to the NBFC’s nodal officer but received only a generic acknowledgment. Frustrated, he approached the Chamber of Advocate Sudhir Rao. Advocate Sudhir Rao and his office examined the screenshots, the timeline, and the NBFC’s internal grievance responses. They identified clear violations: unauthorized third-party disclosure breaching RBI’s Fair Practices Code, repurposing of KYC data contrary to the Digital Lending Guidelines, and possible sharing of personal data across multiple agents. The matter was escalated with a detailed legal notice demanding cessation of harassment, preservation of data, and appropriate compensation. The NBFC, now facing regulatory scrutiny, settled the matter with a written apology and a compensation of Rs. 75,000 — a result that earlier efforts alone hadn’t achieved. Here’s the thing, many such cases stall because the right regulatory angles aren’t pressed at the right time.Key Facts of the Case
- The borrower had a clean repayment history for over two years, with zero defaults on a personal loan from Mahindra Finance.
- A recovery agent visited the borrower’s permanent Nagpur residence while he was away, and disclosed full loan details to his father without consent.
- The next day, a different individual sent the borrower’s KYC verification photo via WhatsApp from a personal number, coupled with intimidation about another visit.
- The NBFC’s earlier grievance redressal merely acknowledged the complaint without substantive action.
- Screenshots with timestamps of the WhatsApp exchange, call logs, and the formal complaint trail were preserved as evidence.
- Advocate Sudhir Rao’s office argued that two distinct agents acting in coordination indicated broader unauthorized sharing of personal data, aggravating the breach.
The Direct Legal Answer
What is a realistic compensation range if I approach the RBI Ombudsman?
There is no fixed or guaranteed compensation range prescribed by the RBI Ombudsman. Awards depend on the gravity of the harassment, the deficiency in service, and the tangible mental agony caused. In similar matters, the Ombudsman has awarded between Rs. 25,000 and Rs. 1,00,000 depending on the evidence. But note: the Ombudsman’s powers are compensatory, not punitive. So, if you have documented proof like WhatsApp screenshots and a clean loan history, you stand a stronger chance of a meaningful award.
Does it matter that two different individuals were involved — one for the visit, one for the WhatsApp message?
Yes, it matters significantly. This strongly suggests your KYC data and personal financial information were shared across multiple recovery agents or agencies without your consent. That itself is an independent violation of RBI’s directions on digital lending and data privacy norms. Raise it as a separate ground: unauthorized sharing of personal data beyond the lender’s legitimate purpose. It can elevate the compensation quantum and prompt the Ombudsman to direct corrective systemic action.
Should I file a separate complaint with the Data Protection Board under the DPDP Act?
The Digital Personal Data Protection Act, 2023, is yet to be fully notified with its enforcement machinery. As of now, you cannot seek direct compensation from the Data Protection Board. However, the misuse of KYC documents can be raised under the Information Technology Act, 2000, and the RBI’s Master Directions on Digital Lending. The Ombudsman can look into data privacy breaches as part of deficiency in service. So, focus the complaint on RBI guidelines and consumer protection rather than a standalone DPDP claim at this stage.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Send a formal complaint to the NBFC’s Grievance Redressal Officer and Nodal Officer immediately. Cite specific RBI circulars — the Fair Practices Code and the Digital Lending Guidelines. Mark a copy to the RBI’s regional office. If the NBFC doesn’t resolve the matter within 30 days, escalate to the RBI Ombudsman. And here’s the crucial part: this category of case involves nuanced regulatory procedure. A general practitioner may not be fully familiar with the Ombudsman’s evidentiary expectations or the specific RBI circulars that make your complaint stick. Engage an advocate who regularly handles financial consumer disputes and Ombudsman complaints.
Never delete the WhatsApp chat or call logs. Preserve metadata, screenshots, and any voicemail recordings. This digital trail often decides whether the Ombudsman awards compensation or just directs a bland apology.
Applicable Sections of Law
The primary regulatory framework here is not a single statute but a combination of RBI directions and consumer law. The RBI’s Fair Practices Code mandates that recovery agents maintain decency, not disclose loan details to third parties, and not intimidate borrowers. The Digital Lending Guidelines issued in September 2022 strictly prohibit the misuse of KYC data and require that recovery agents identify themselves. Under the Consumer Protection Act, 2019, such harassment constitutes “deficiency in service” and “unfair trade practice” under Section 2(11) and 2(47) respectively. The Information Technology Act, 2000, specifically Section 43A and the SPDI Rules, 2011, impose obligations on entities handling sensitive personal data, and a breach can lead to damages. Additionally, the banking ombudsman’s authority flows from the Reserve Bank of India Act, 1934, and the Ombudsman Scheme, 2021.
Jurisdiction — Where to File the Case
Your first forum is the NBFC’s internal grievance mechanism. If that fails, the RBI Ombudsman has jurisdiction over complaints against NBFCs for deficiency in service, including recovery agent misconduct. The Ombudsman’s office in your region — say, RBI Nagpur — can entertain the complaint if the NBFC’s registered office or the cause of action falls within its territorial limits. If the Ombudsman’s order isn’t satisfactory, or if you want to claim higher compensation beyond Rs. 20 lakhs, you can approach the District Consumer Disputes Redressal Commission under the Consumer Protection Act. Pecuniary jurisdiction: up to Rs. 50 lakhs at District Commission, up to Rs. 2 crores at State Commission. For a data privacy breach standalone, a civil suit for damages before a civil court remains an option, but that is lengthy.
Limitation Period
Under the RBI Ombudsman Scheme, a complaint must be filed within one year from the date the NBFC rejects your grievance or fails to reply. The clock starts after you receive the reply or after 30 days of you lodging the complaint with the NBFC, whichever is earlier. If you choose the consumer forum, the limitation period under the Consumer Protection Act, 2019, is two years from the date the cause of action arose — in this case, the date of the harassing visit and WhatsApp message. Missing these timelines can be fatal. Courts may condone delay if you show sufficient cause, but don’t count on it. Act swiftly.
Interim Reliefs Available
In consumer forum proceedings, you can seek interim relief under Section 38 of the Consumer Protection Act, 2019, which empowers the Commission to pass ad-interim orders to prevent further harassment. Typically, you can ask for an order directing the NBFC to immediately cease all recovery communications with your family members or through unverifiable agents. In a civil suit for damages over data misuse, you could move an application under Order 39 Rule 1 and 2 CPC for a temporary injunction restraining the NBFC from further sharing your KYC documents with third parties. Interim reliefs matter because they stop ongoing harm while the main complaint is pending, giving you immediate breathing room.
If You Are the Victim
- Do not panic or pay any unauthorized recovery demand under pressure.
- Immediately take screenshots of the WhatsApp messages, note the unsaved phone number, and record call details.
- Inform the NBFC’s Grievance Redressal Officer in writing, attaching all evidence.
- If the NBFC does not act within 30 days, or if the harassment escalates, approach the RBI Ombudsman online.
- Preserve your clean repayment record and bank statements — this undercuts any defence that the recovery was due to default.
Documents You Must Keep Ready
- Aadhaar and PAN card for identity proof.
- Loan agreement and sanction letter from the NBFC.
- Screenshots of the WhatsApp conversation with timestamps, showing the KYC photo and threatening messages.
- Call log details or call recording, if any, with the recovery agents.
- Copy of the formal complaint sent to the NBFC’s Grievance Redressal Officer and Nodal Officer.
- Any reply or acknowledgment received from the NBFC.
- Bank statements or repayment receipts proving a clean payment history.
- Written communication from the RBI, if you already escalated.
What Evidence Is Required?
- Primary evidence: the original WhatsApp chat screenshot, showing the phone number and the KYC picture, is the strongest piece.
- Call detail records from your telecom provider to establish calls from unsaved numbers around the date of intimidation.
- Copy of your loan repayment schedule or NOC from the NBFC to show no default — this negates the NBFC’s possible justification.
- Emails and their delivery receipts proving you lodged the grievance.
- Witness statement from your father or family member who received the visit and disclosure.
- Secondary evidence: a written transcript of the WhatsApp voice notes, if any, certified by you.
- Metadata of the KYC image, if accessible, to show when and how it was forwarded — though this may need forensic help.
How Courts Typically Approach Such Cases
Consumer commissions treat violations of RBI guidelines seriously, especially when recovery agents overstep and harass family members. The commission will first examine whether the NBFC followed its own Fair Practices Code. If not, deficiency in service is almost a given. It then assesses compensation based on mental agony, the degree of intrusion, and the lender’s conduct after the complaint. Commissions tend to be less generous if the borrower was in default, but a spotless repayment record drastically shifts the balance in your favour. And the coordination between two agents using personal data? That often prompts a sterner view, with directions to the NBFC to tighten data access controls.
Timeline of Legal Process
- File formal complaint with NBFC: 30 days for NBFC to respond under RBI norms.
- If unresolved, file with RBI Ombudsman: the Ombudsman aims to dispose of complaints within 90 days, though complex cases may stretch to 120 days.
- If the Ombudsman’s order is not acceptable, appeal to the Appellate Authority under the scheme within 30 days.
- Alternatively, file consumer complaint before District Commission: admission hearing within 21 days, then notice to opposite party, written version in 30 days, evidence, and arguments. A contested matter can take 8–14 months from filing to final order depending on the commission’s workload.
- Execution of any compensation order may take additional 3–6 months if the NBFC delays payment.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Yes, and it often is. After a well-drafted legal notice, many NBFCs prefer to settle rather than face an Ombudsman order that becomes public. The settlement can include a written apology, an undertaking to cease unlawful recovery practices, and a compensation payment. At the Ombudsman stage, the officer can mediate an amicable resolution. If the matter reaches a consumer commission, the forum may refer it to mediation under Section 37 of the Consumer Protection Act, 2019. For data privacy aspects, a compromise deed with confidentiality clauses can wrap up the dispute. Settling early saves time, but never agree to a settlement that doesn’t include a clear data deletion or non-disclosure commitment from the NBFC.
Common Mistakes People Make
- Deleting the WhatsApp chat or blocking the number without taking screenshots — once gone, the primary evidence is lost.
- Filing a police complaint without first exhausting the NBFC’s grievance mechanism; the police may treat it as a civil matter and not act, wasting precious time.
- Engaging an advocate who doesn’t regularly handle RBI Ombudsman or financial consumer disputes — such a practitioner may file a generic consumer complaint missing the specific RBI circulars that secure a quick Ombudsman ruling.
- Ignoring the data privacy angle. The misuse of KYC photos isn’t just harassment; it’s a separate regulatory breach that can strengthen your compensation claim if argued properly.
- Speaking directly to the recovery agents or agreeing to meet them unaccompanied — this often leads to further coercion or loss of evidence.
- Waiting too long to act. The limitation clock ticks from the date of harassment, and delay can render your complaint time-barred.
FAQs People Normally Have
Will the RBI Ombudsman protect my identity during the complaint process?
Yes, the Ombudsman’s proceedings are confidential. Your personal details won’t be disclosed in any public order unless you explicitly consent. The forum is designed to protect consumer privacy.
Can I file a criminal case for intimidation along with the Ombudsman complaint?
Technically, if the WhatsApp messages contain threats of harm, you could file a police complaint for criminal intimidation under Section 351 of the Bharatiya Nyaya Sanhita, 2023. But in practice, unless the threat is grave, the police may not register an FIR. Simultaneous civil and criminal remedies are allowed, though it’s wise to proceed with the Ombudsman first for quicker relief.
What if the NBFC says the agents were not their direct employees?
An NBFC can’t escape liability by outsourcing recovery to third-party agencies. RBI guidelines hold the lender responsible for the conduct of its recovery agents, whether in-house or contracted. So the NBFC remains accountable.
Can I get the Ombudsman to order deletion of my KYC data from the agents?
The Ombudsman can certainly direct the NBFC to ensure that all unauthorized third parties delete your personal data and confirm compliance. It’s a common corrective direction in such cases.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India