A loan app safety checklist for Indian borrowers sharing Aadhaar, PAN, and bank details

Every time you tap "allow" on a loan app requesting your Aadhaar number, PAN card, selfie, or bank account details, you hand over the keys to your financial identity. Thousands of Indian borrowers lose money or personal data each year to unregulated apps that look legitimate on the surface. mPokket created this safety checklist so you can evaluate any digital lender, including mPokket itself, before you share a single document.

Digital lending in India grew rapidly after 2020, but so did reports of predatory apps. The RBI issued comprehensive digital lending guidelines (RBI, 2022) to protect borrowers. Despite these rules, many unregistered apps still operate on app stores.

Borrowers searching for an instant personal loan often feel pressured by urgency. A medical bill, a month end cash crunch, or an internship expense can push someone to skip basic checks. This checklist removes that guesswork.

mPokket designed this framework for salaried employees, freshers, self employed professionals, housewives, and gig workers. Anyone sharing Aadhaar, PAN, or bank details with a loan app in India can use it.

Use the decision matrix below to score any loan app before you upload documents. Each criterion maps to a verifiable action you can take in under five minutes.

Score each criterion as pass or fail. If any single item fails, pause the application and investigate further before proceeding.

Digital KYC is the process where a loan app verifies your identity using Aadhaar OTP, PAN verification, and a live selfie. The RBI permits this method for regulated lenders. Here is what a legitimate KYC flow looks like.

First, the app asks for your Aadhaar number and sends an OTP to your Aadhaar linked mobile number through UIDAI. You enter the OTP inside the app. No legitimate app will ask you to share the OTP over a phone call or WhatsApp message.

Second, you enter your PAN card number. The app cross verifies it against government databases. This step confirms your tax identity and helps the lender assess basic eligibility.

Third, you take a live selfie. The app matches it against your Aadhaar photo using facial recognition. This prevents someone else from applying with your documents.

mPokket follows this exact three step digital KYC process. The entire verification can finish within minutes when your Aadhaar is linked to your current mobile number.

For an instant personal loan in India, most RBI compliant apps require Aadhaar card, PAN card, a selfie, and bank account details. Some lenders may also ask for a bank statement or salary slip depending on the loan amount and borrower profile.

Self employed borrowers might need to provide GST returns, Udyam registration, or client invoices as alternative income proof. Freshers and interns may use their stipend receipts or offer letters.

The RBI's digital lending guidelines require every lender to issue a Key Fact Statement before loan acceptance. This document must clearly state the annual percentage rate, processing fee, any other charges, the repayment schedule, and the total amount payable.

If a loan app shows you only the loan amount and EMI without disclosing the interest rate or total cost, that is a serious red flag. Transparent lenders like mPokket display all charges upfront so borrowers can make informed decisions.

Compare the stated APR with the effective cost. Some apps advertise low interest rates but add high processing fees that inflate the real borrowing cost. Calculate the total repayment amount and divide by the principal to understand your true cost.

Before installing any loan app, review the permissions it requests. A legitimate loan app needs camera access for your selfie and storage access for document uploads. It does not need access to your contacts list, photo gallery, call logs, or SMS inbox.

The RBI explicitly prohibits loan apps from accessing borrower contact lists or using personal data for collection or harassment purposes (RBI, 2022). If an app demands these permissions, uninstall it immediately.

Check the app's privacy policy for details on data storage, retention period, and third party sharing. A compliant lender will state how long your data is stored and under what conditions it may be shared.

A safe loan app offers multiple repayment options. Look for UPI repayment, debit card payment, autopay setup, and the ability to prepay or foreclose without hidden charges.

mPokket, for example, supports UPI loan repayment and autopay EMI options. Borrowers can choose flexible repayment modes that fit their cash flow. The app sends due date reminders so you never miss a payment accidentally.

Before accepting any loan, confirm the following repayment details: EMI amount, due date, late payment penalty, prepayment or foreclosure charges, and the total number of instalments. All of these should appear in your Key Fact Statement.

If you suspect a loan app is operating without RBI authorization, report it. File a complaint on the RBI's Sachet portal or contact the app store to flag the listing. Document all communications with screenshots.

If a lender or its recovery agent contacts your family, friends, or colleagues, this violates the RBI's Fair Practices Code. You can escalate such complaints to the RBI Ombudsman for digital lending.

Borrowers who have already shared documents with a suspicious app should monitor their bank accounts closely, change passwords, and consider placing a fraud alert with their bank.

Indian borrowers deserve full transparency before sharing sensitive identity documents with any loan app. Use this checklist every time you evaluate a new lender. mPokket publishes this framework because informed borrowers make better decisions, and better decisions build a healthier digital lending ecosystem for everyone.