In 2023, neck-deep in freelancing projects in his hometown in Rajasthan, Babu Lal stumbled upon the underbelly of India’s digital financial ecosystem. The internet, including app stores, were infested with shady looking loan apps. He began tracking them down individually. Eventually, he found so many that he set up a website to track them regularly across India’s two biggest marketplaces for downloading apps: Google’s Play Store, and more recently, Apple’s iOS App Store.
Google and Apple are very strict about who gets to operate an app in their marketplace. ‘I’ve been an app developer myself so I know how strict their review processes can be,’ Babu Lal says. ‘Even creating a developer account [that publishes an app for people to download and use] used to be a difficult process that could take 10–15 days. App review is not easy at all. Everything has to be properly documented, with all disclaimers in place.’
But after a little more digging, he realized he was wrong. More loan apps turned up in the top lists of both app stores. None of them had proper disclaimers or developer information in place. And many of them were impersonating other, often legitimate companies, that had nothing to do with financial services.
Here’s a demo. Run a search for the word ‘loan’ in your phone’s app store. Scroll through the results to see what apps pop up. Babu Lal and I ran this exercise on a September afternoon in 2024, sharing our screens on a Google Meet call. ‘You must recognize some of these logos,’ he asked me. Indeed, there were many familiar names – INDMoney, ICICI, Navi, and other well-known, legacy and startup finance names. But among the legit names were unknown apps, such as LoanLava. What’s worse: many of these were ranked higher in search results than well-known banking names, such as ICICI. What does this tell us about the loan scammers’ abilities?
‘These applications are getting as many downloads as the legitimate ones like PhonePe [owned by Flipkart],’ Babu Lal pointed out. It has a 4.3 rating, and is rated by 322 people. ‘As a user, everything looks legitimate.’ We looked up the website of LoanLava’s developer. The website revealed LoanLava was developed by an RBI-registered non-banking financial services company named Intlow Leasing and Financial Services Pvt. Ltd. Everything about the website, down to its onboarding process for loan seekers to its privacy policy statement, looked polished and professional.
So, where lay the scam?
Babu Lal and I ran a search for Intlow, the supposed developer of the app. As a business reporter, I am used to looking up information on all sorts of private, small companies in India, all of whom must be registered with the Ministry of Corporate Affairs. As a freelance app developer taking on contracts from startups, Babu Lal frequently used online resources like Zaubacorp to check the legitimacy of his potential clients too. Together, we discovered that Intlow was indeed a legitimate company, registered in 1996. Per the information available from its registration documents in Zaubacorp and Tofler, Intlow was a serious enterprise, with paid-up share capital [initial money to start a company’s operations] of more than Rs 1 crore. Clearly, this was not some fly-by night operation.
So far, we could smell something fishy, but could not pinpoint what exactly was shady about this setup.
Then Babu Lal pointed out that none of the Google search results for the company yielded any official website, ‘They do not have any online presence. Except for the one website linked to the LoanLava app.’ Perhaps they ran operations offline and did not need a website?
One piece of information we had not yet explored was that Intlow was a registered non-banking financial company or NBFC. Updated lists of licensed NBFCs are publicly available – a Google search is enough. ‘As you can see, Intlow is an NBFC,’ Babu Lal pointed out, as we scrolled down a list of RBI-registered such companies from 2018. ‘This is an endless list of such companies in India, it’s not as if there are only 100–200 such firms in India. I estimate 10,000 NBFCs in India were flagged as “high-risk” in just 2018.’ Bingo! Intlow was one of them. And they probably didn’t even know their name – already listed as being high-risk – was being misused by an illegal loan app.
Also read: Credit card is not for impromptu Bali trips. Use it to invest in yourself
A closer look
On closer look, there were clear signs of just how much of a scam LoanLava really was. Much of the website’s text and image looked AI-generated or copied from other websites. Example: A note introducing the company was nearly identical to the legal descriptions of formal companies listed under the Ministry of Corporate Affairs and by the aggregators of the ministry’s data. Some blocks of text, seemingly written into the website, turned out to be screenshots, potentially copied from another website and dumped onto this one. The privacy policy was generic enough to potentially be copied from someone else, too.
It was safe to assume that the scammers had hijacked the ‘Intlow’ name and used it to lend legitimacy to their own app.
‘They’re not even making an effort to really make a credible-appearing website,’ Babu Lal points out. ‘In a way that’s good, it makes it easier to catch these fake websites.’ Perhaps, he added, the scammers behind such apps are too stupid, or lazy, to pay attention to the details. Or they simply didn’t need to. ‘Why bother with the effort to make it all look genuine when people are not doubting it?’
Even more galling was the fact that LoanLava had launched on the Apple App Store that very month. Within a couple of weeks, it was already ranked 16 in its category, received hundreds of reviews, and fixed a high average rating. Besides, the app was on its second version already, meaning Apple’s people had reviewed LoanLava and its developer at least twice more after initially approving their developer account.
According to Babu Lal, there was no easy way for him to reach out to Intlow and alert them to the misuse of their name by a loan app. But this was not an isolated case. Over the months of his journey down the loan app rabbit hole, Babu Lal found several similar loan apps appropriating the names of legitimate financial companies. Sometimes, he posted screenshots of these apps on his LinkedIn and X profiles, hoping to alert the management of these companies that a scammy loan app was being run using their names.
There are several reasons for raising such an alert. One, if an existing company knows its name is being misused, it will likely fight hard to have the fake loan app taken down. Scammers can reach many more people if they can fool their victims by using the names of legitimate businesses. This tactic can fool even those who are more aware and guarded than an average person.
‘Even if we assume that 100 people downloaded an app, and only 5 percent are disbursed a loan or complete their [financial] profile, still the number of potential victims is about 8,000–9,000,’ Babu Lal estimates. ‘And this is the impact of just one app!’
Two, legitimate financial companies could get blacklisted on these major app stores, meaning they may be unable to launch apps in the future or their existing apps may be banned or negatively impacted. Imagine if you are a customer used to managing money through a banking and finance app and its developer’s name crops up in a list of fraudulent loan apps. Not only could you become a victim of that app, any action against that loan app could mean losing access to your regular money management tool as well. Over time, these incidents can erode our trust in digital forms of managing our money and lives.
Three, the way these little-known loan apps rise in the rankings of various app stores shows us that app store algorithms are vulnerable to exploitation. Fraudulent loan apps that Babu Lal has discovered and flagged since 2023 nearly always zoom to the top of all app store rankings mere days after they are launched. Ordinarily, this can take many months for a new app, if it ever even becomes that successful. It also requires a developer to spend plenty of money on marketing the app and using ads to convince people to click and download the app. Only a tiny majority of all the apps in the world ever make it to the top. Heck, only a fraction of all app developers even get to publish their apps on the Google Play Store and the Apple App Store. Then, how do the scam loan app developers pull it off?
Here’s how it might work.
First, the scammers create a developer account, then launch an app that perhaps serves no major need. It might not even be in the finance category. It could be a tool instead, such as a calculator. That app – harmless and perhaps even useful to some – gets approved easily, boosting the developer account’s credibility. Armed with this, the developers then release the actual scam – their loan app – from the same account. ‘Maybe there is a loophole of some kind that exists at Google and Apple where the first app released from a developer account is getting checked thoroughly, but subsequently released apps pass through a more lenient process,’ Babu Lal says. ‘This is just my guess, but I have seen multiple such developers launch such apps on app stores [in this manner].’
Earlier, these scammers used to publish apps that would directly claim to be developed by a private limited company, and by the name, it would appear to be some sort of lending or finance company. Now that they are getting caught, they have resorted to a new strategy where they publish new kinds of apps such as Aadhar guides, loan guide apps, loan calculators, etc. Babu Lal wrote a case study on this. That could be one part of the scam, but how do they hack app store rankings?
To boost their app’s rankings, these scammers may be running advertisements on social media or on multiple networks like Google Ads and others, and diverting traffic to these apps from clicks ads. Notice those ads that pop up in banners as you play a mobile game, or open a tarot reading blog without your ad blocker turned on? Those click ads are the number one way for apps around the world to market themselves.
The technique is as old as the internet itself, but it is exceedingly effective.
This excerpt from ‘Bharat Bluff ’ by Soumya Gupta has been published with permission from Roli Books.