When a Stranger's Loan Shows Up on Your Credit Report
It usually starts with something small and unsettling: a loan collection call for an account you never opened, a sudden drop in your CIBIL score, or a credit card application rejected for reasons that make no sense given your repayment history. When you pull your credit report to investigate, you find an unfamiliar personal loan, a consumer durable loan, or even a credit card you never applied for, sanctioned in your name using your PAN card details. This is not a clerical error most of the time. It is identity theft, and unfortunately it has become increasingly common as digital lending has expanded and data leaks from smaller platforms have put PAN, Aadhaar, and mobile numbers into circulation on the grey market.
The good news is that Indian regulation gives you a clear, enforceable path to get such loans removed from your credit history and to stop being chased for repayment. The process requires documentation and persistence, but it is not something you have to fight alone or absorb financially. This guide walks through exactly what to do, in the right order, starting the moment you spot the fraudulent entry.
Step 1: Confirm the Fraud With a Fresh Credit Report
Before contacting anyone, pull fresh reports from all four bureaus operating in India, CIBIL, Experian, Equifax, and CRIF High Mark, because a fraudulent loan may be reported to one bureau and not immediately reflected on another. Note down the exact lender name, account number, loan amount, date of sanction, and the branch or digital lending app listed. This becomes your reference sheet for every subsequent communication. If you use the Credit Score Simulator periodically, a sudden unexplained score drop is often the first practical signal that something is wrong, even before you manually check the full report.
Step 2: Write to the Lender Immediately
Contact the lender's grievance redressal officer or nodal officer in writing, by email and registered post if possible, stating clearly that the loan was not taken by you, that you did not sign any loan agreement, and that you are formally disputing the debt. Attach a copy of your PAN card, Aadhaar, and a self-declaration or affidavit if the lender's process requires one. Ask for a written acknowledgment and a reference or complaint number. As per RBI's digital lending guidelines, every regulated lender, including NBFCs and bank-partnered digital lending apps, is required to have a functioning grievance mechanism and must respond within a defined timeline, typically 30 days.
Step 3: File a Cybercrime Complaint
A loan opened using stolen PAN and Aadhaar details is a financial cybercrime, and you should file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 national cybercrime helpline. This creates an official record with a complaint number that strengthens your case with both the lender and the credit bureau, and in cases involving forged KYC documents or a compromised digital lending app, it can trigger a law enforcement investigation into the actual perpetrator. It is worth also filing a local police FIR, particularly if the loan amount is significant, since some lenders require a police complaint copy before closing the dispute internally.
Step 3.5: Understand Why This Keeps Happening
Most PAN-based loan fraud traces back to one of a few sources: a data breach at a smaller fintech lender, a KYC document shared carelessly for an unrelated purpose like a SIM card or rental agreement, or outright identity theft using a scanned PAN copy circulating online. Understanding the source matters because it tells you whether you need to change your mobile number linked to KYC, report the leak, or simply monitor more closely going forward. For a broader understanding of how such fraud typically unfolds and how to prevent recurrence, the earlier guide on identity theft and fraudulent loans on your PAN card covers preventive habits worth adopting immediately.
Step 4: Raise a Formal Dispute With the Credit Bureau
Simultaneously, raise a dispute directly on the credit bureau's website. CIBIL, Experian, Equifax, and CRIF High Mark all have online dispute resolution portals where you select the specific account, mark it as "not mine" or "fraudulent," and upload your identity documents along with the lender complaint reference number. The bureau is required to investigate with the reporting lender and update the record, generally within 30 days, though complex cases can take longer if the lender is slow to respond.
| Step | Where to File | Typical Timeline |
|---|---|---|
| Dispute with lender | Bank/NBFC grievance officer | Response expected in 30 days |
| Cybercrime complaint | cybercrime.gov.in or 1930 helpline | Complaint registered immediately, investigation timeline varies |
| Bureau dispute | CIBIL, Experian, Equifax, CRIF portals | Investigation and correction, typically 30 days |
| Escalation if unresolved | RBI Banking Ombudsman via cms.rbi.org.in | Filed after 30 days of no response from lender |
Step 5: Escalate to the RBI Banking Ombudsman
If the lender fails to resolve your complaint within 30 days, or resolves it unsatisfactorily, you can escalate to the RBI Banking Ombudsman through the RBI's centralized complaint management system at cms.rbi.org.in. This scheme covers scheduled commercial banks, urban cooperative banks, NBFCs, and digital lending platforms operating under RBI's regulatory umbrella, and it is free to file. The Ombudsman can direct the lender to correct the credit report and, in some cases, award compensation for the harassment or financial loss caused by the erroneous entry. If you're unfamiliar with the filing process itself, the detailed walkthrough in how to file an RBI Banking Ombudsman complaint online lays out the exact portal steps and documentation checklist.
What If Recovery Agents Start Calling You?
It is common for recovery calls to continue even while a dispute is pending, since not every lender pauses collection activity immediately upon receiving a complaint. Keep a record of every call, including date, time, and content, because harassment outside permitted hours or abusive conduct is itself a violation of the RBI's Fair Practices Code for loan recovery. If this happens to you, the article on RBI's loan recovery agent harassment rules and how to complain explains your rights and the specific complaint channel for recovery-related misconduct, which is separate from the identity fraud dispute itself.
Protecting Yourself Going Forward
Once the fraudulent entry is resolved, take preventive steps so it doesn't recur. Lock or freeze your credit report through your bureau's consumer portal so no new lender can pull it without your explicit consent. Avoid sharing scanned PAN or Aadhaar copies over WhatsApp or unverified apps, and always check whether a lending app is RBI-registered before submitting KYC documents, a step covered in the guide to RBI-registered instant loan apps in India. Reviewing your credit report every quarter, rather than only after something goes wrong, remains the single most effective habit for catching fraud early, before it snowballs into a collections nightmare or a rejected loan application of your own when you genuinely need credit through the personal loan marketplace.