Which permissions a loan app should get, and which it should never get

While installing a loan app, most people click through the permission prompts without reading them and think about it later. That habit has to go. What an app asks of your phone is the clearest sign of whether it belongs to a legitimate lender or should be deleted at once. A genuine app needs very little. An unsafe app asks for everything, and the reasons behind it are seldom good.

Interest rates can be dressed up and a website can be made to look professional, but permissions are hard to hide. They show what the app intends to do with your phone. Regulated lenders face limits on what they may use, so their apps ask only for a few things tied to specific steps in the process. Apps operating outside these rules face no such limits, and their business runs on broad permissions. Reading the permissions takes thirty seconds and tells you more than any review page.

A legitimate app actually needs little. It needs the camera, to photograph documents or take a selfie for KYC verification, and this permission should be given once, not permanently. Location may be requested once, to verify an address or prevent fraud. That is all. A lender assesses your application on documents, bank details and your credit record. None of this sits in your photo gallery or contact list. If an app cannot explain, in terms of the step you are on, why it needs a permission, assume it does not need it.

These are the permissions no loan app should ask for. If they are requested, stop the installation there; there is no need for a second thought. Your contact list or phonebook, because it has no bearing on your ability to repay a loan. The photo gallery, media or stored files, which hold nothing a lender legitimately needs. The call log, which shows whom you speak to and when, and is useless for a loan. Also, camera, microphone or location access that is not given once but is permanent and always on.

People learn late why contacts are requested. Contacts are used for recovery through humiliation. There are examples of operators of illegal apps messaging family members, colleagues and old classmates about a borrower's loan when instalments were missed, sometimes with photos from the gallery edited as well. That is why the contact list and media folder are requested together. This permission is pressure collected before a single instalment has been missed.

If you have already granted a permission, go to your phone's settings and remove any permission the app does not need; most apps work on fewer permissions. Uninstalling the app stops further access, but data already collected is not deleted. For that, send the lender a written request. If you are being harassed, or people in your phonebook are being contacted, the matter should go to the police, and a complaint can also be made to the RBI on its portal for unauthorised entities. Do not take another loan from the same app to make the pressure stop, because that is exactly how the web of such apps works.