I4C Flags Six Loan Apps for Harvesting User Data, Orders Google Takes Them Down

The Indian Cybercrime Coordination Centre (I4C), functioning under the home ministry, has ordered Google to remove six loan applications from the Play Store after finding them involved in fraudulent lending practices.

In a notice dated August 7, reviewed by Moneycontrol, I4C said it had identified six apps being used to target Android users looking for quick loans. Google was given three hours from the issuance of the notice to remove or disable access to the specified URLs. As of August 12, the apps have been taken down.

The six applications named in the notice are LoanOrbit, Hisab, Nexus Loan, One Fund, Credit Factor and Mobile Credit Prairie.

How the Apps Allegedly Operated

According to I4C, the applications posed as legitimate loan providers, promising quick approvals and low interest rates. Once loans were disbursed, users were allegedly charged "exorbitant interest rates" on the principal amount.

The notice further stated, "Once downloaded, the transnational criminals are harvesting sensitive information like personal identifiable information (PII) viz, Aadhaar card details, financial details, accessing contacts, gallery, camera, etc."

I4C also noted that these apps were being promoted through Google's advertising ecosystem on the Play Store, stating that the "malicious loan applications are promoted through Digital Advertisement on the Google Play Store."

Under the provision referenced by I4C, intermediaries are required to remove or disable access to unlawful content within three hours of receiving actual knowledge through a court order or a "reasoned intimation" from an authorised government officer.

"Google is hereby notified to remove and disable access to the concerned URLs within 3 hours of the issue of this communication without vitiating the evidence in any manner," the notice said.

The notice cited Section 3(1)(b)(viii) of the IT Rules, Sections 43, 66 and 66D of the IT Act, and Section 318(4) of the Bharatiya Nyaya Sanhita as relevant provisions in the case.

The action reflects continued scrutiny by cybercrime authorities of digital lending apps that lure users with promises of quick credit while gaining access to their personal and financial data.