Your credit is easier to steal than your money: How online lending works

A simple 'Buy now, pay later' click can trigger a full loan without consent. Weak verification, no alerts, and instant disbursals are fuelling identity fraud in India's digital lending ecosystem

“I just received a message about a loan being sanctioned to me by a private bank. I never applied for any loan.” That’s how our client, Abhishek Ghate, began our call. His credit report showed that the bank had accessed his record and approved a loan in his name. The issue began with what he thought was a simple ‘Buy now, pay later’ limit check on a shopping site. The consent screen didn’t show that it was a loan application. The OTP (one-time password) he entered turned out to be an Aadhaar e-sign for a loan agreement. Luckily, the loan was not disbursed. Abhishek got it cancelled and learned a hard lesson. 

To understand what Abhishek faced, it helps to know how online lending works. Every lender reports their clients’ repayment history for all loans and credit cards to the four credit bureaus — often called Cibil after the first and largest of them. These bureaus maintain each borrower’s repayment record across lenders. When a lender gets a new application, it ‘enquires’ about the borrower’s history. If the data fits its norms, the loan is approved instantly. Since everything — application, verification, approval, signature and disbursal — now happens online, it takes only seconds. This kind of digital lending has boomed, fuelled by private equity money. 

Author and podcast host Anupam Gupta discovered that someone had taken a small loan in his name. His strong credit history helped the loan sail through, and ₹20,000 was disbursed to a fraudster’s UPI ID. His post on X went viral, forcing the lender to apologise, cancel the loan, and fix his record. My colleague Mukul Agarwal was similarly defrauded at the same lender but is still fighting to erase the fake loan from his report. Many such stories appear online, and most victims are ordinary borrowers without visibility or influence. They sometimes pay up to avoid an impact on their credit scores. 

Lenders are allowed to access a person’s credit report only when that person applies for a loan. But in the rush to approve quickly, they often skip proper identity checks, letting identity thieves slip in. Creditworthiness is like money in a bank—but without safeguards. A phone number and email are often enough for a fraudster to trick a lender into pulling your report and disbursing a loan. Unlike a debit from your bank account, a credit-report pull needs no verified consent and triggers no instant alert. Some lenders even release funds without proper documentation. Weak consent, no alerts, and hurried disbursals make the system ripe for fraud. The fix lies in three safeguards: verified informed consent before any credit-report access, instant SMS or email alerts (which must be free), and release of funds only after proper e-signing and independent ID verification. 

Other countries have already implemented these measures. Unlike in India, where the four credit bureaus work in isolation, borrowers in the US can get a single consolidated report covering Experian, TransUnion and Equifax. Many nations also allow a ‘credit lock’ that lets consumers block access to their reports for new lending unless they unlock them — just like Indian bank cards can be switched on or off. Most of these protections are legally mandated, either free or capped at fixed rates, and apply across all bureaus. 

Truth be told, people like Anupam are privileged. Their cases get resolved because they have visibility and the will to fight. But such cases would drop sharply if the three safeguards described above were in place. The irony is that India already has a proven framework for informed, auditable consent — the Account Aggregator system — yet it has not been extended to credit reports. That gap must close soon. 

Ultimately, the countless KYC (know your customer) checks Indians go through should have real value. Money moving through the banking system must be traceable to its final recipient and recoverable quickly. Otherwise, all those repeated KYCs are just harassment without benefit. 

The writer heads Fee-Only Investment Advisors LLP, a Sebi-registered investment advisor;  X: @harshroongta