GPTLoan Scam: Stealing Contact Lists and Using Violent Debt Collection Under the Guise of AI Approval

Who Gets Targeted

Victims are primarily blue-collar workers, small vendors, and unbanked low-income individuals in India who are in urgent need of small-sum liquidity. Attracted by claims of 'instant AI approval' and 'zero collateral,' they download the app and grant permissions to access contacts, SMS, and photo galleries. Lacking financial literacy, they are unaware that these permissions will be used for subsequent extortion. Under threats from debt collectors, they are forced to pay 'penalties' far exceeding the original loan principal, trapping them in a cycle of debt.

骗局怎么运作

• Step 1: Listing and Distribution. Developers package GPTLoan as an AI-powered smart lending tool, list it on Google Play, and use targeted advertising via social media, Telegram groups, and SMS, claiming 'no credit score required, funds in as fast as 5 minutes' to lure those in urgent need of cash.
• Step 2: Harvesting Sensitive Permissions. Upon opening the app, users are required to register their phone numbers and grant permissions to access contacts, call logs, photo galleries, and location, under the pretext of 'credit assessment.' These permissions are immediately stolen and uploaded to overseas servers once the user clicks 'agree,' serving as leverage for future extortion.
• Step 3: Short-term, High-interest Lending. The app offers small loans ranging from 2,000 to 10,000 rupees with terms typically between 7 and 14 days. However, interest rates far exceed central bank regulations, and 'processing fees' and 'guarantee fees' are deducted upfront, leaving the user with only 60% to 70% of the requested amount, creating an inescapable debt trap.
• Step 4: Violent Collection After Default. Before the due date, the app attempts automatic deductions or demands transfers. Once a payment is overdue, collectors use the stolen contact list to mass-message the borrower's friends and family with insults and threats, or even use photoshopped nude images to force the victim to pay quickly to save face.
• Step 5: Sideloading Cycle After Removal. Once the app is removed from Google Play, developers share APK links via WhatsApp and Telegram, or re-list the app under a new name and icon, continuing to use the same tactics to deceive new users, forming an 'indestructible' gray industry chain.

红旗信号（看到这些快跑）

• 🚩 Demanding permissions irrelevant to lending, such as access to contacts, photo galleries, and SMS, and refusing to grant the loan if denied.
• 🚩 Lack of a physical company address, registration number, or RBI license information within the website or app.
• 🚩 Promotional claims that contradict financial regulations, such as 'no credit check,' 'guaranteed approval,' or 'zero interest.'
• 🚩 Vague terms regarding interest rates and fees, with no disclosure of annual percentage rates (APR) or repayment schedules.
• 🚩 Collection calls coming from private or international numbers, using abusive language and threatening to expose private information.
• 🚩 Demanding repayment via personal accounts, virtual currencies, or gift cards, and refusing to provide official payment receipts.
• 🚩 The app has a rating below 2 stars on the store and numerous user complaints about privacy theft, yet it continues to circulate in sideloading groups.

真实案例

• In 2026, ThePrint (India) exposed an extortion network with backend servers in China that used threatening tactics. The network defrauded thousands of victims of tens of millions of rupees through multiple loan apps; some victims were forced to sell their assets out of fear, and police have opened an investigation.
• In August 2026, the Indian Cyber Crime Coordination Centre (I4C) ordered Google to remove three malicious loan apps following an investigation. These apps were confirmed to have collected user contacts and location data without consent and were involved in extortion.
• According to 36Kr, Chinese loan apps operating overseas in India have faced a regulatory crackdown. Multiple institutions were removed from stores due to violent debt collection, resulting in billions in losses. Some of these apps used the guise of AI approval to mask illegal data collection activities.

Official Stance

• In 2026, the Reserve Bank of India (RBI) issued a warning on its official website, listing a series of unregistered illegal loan apps, advising users not to download them, and emphasizing that only RBI-licensed digital lending platforms are legal.
• In August 2026, the Indian government, through I4C, formally requested that Google Play remove three malicious loan apps and warned of the legal risks associated with sideloaded installations (reported by Medianama).
• On November 13, 2024, the Beijing Municipal Public Security Bureau's Cyber Police issued an alert exposing the tactics behind 'violent debt collection' in online lending, warning the public to be vigilant against non-compliant lending platforms requesting privacy permissions.

How to Protect Yourself

• ✅ Download apps only from official app stores and verify whether the developer holds an RBI registration or a local lending license. Avoid installing APKs from MMS, Telegram, or other unofficial channels.
• ✅ Always deny permissions for contacts, photo galleries, and SMS during installation; these are unreasonable for a loan app. If an app forces these permissions, uninstall it immediately.
• ✅ Keep all repayment receipts, chat logs, and call recordings. If you encounter threats, report them to the police immediately and file a complaint with the Indian National Cyber Crime Reporting Portal.
• ✅ If you have already granted permissions and a privacy breach occurs, notify your contacts, inform them that they may be targeted by scams, and prevent them from being victimized.