The government and the Reserve Bank of India’s (RBI) are encouraging the expansion of the fintech industry, which has privacy consequences and could potentially expose millions of Indians to financial fraud.Imagine you have applied for nothing: you have not requested a loan, you have not opened a new credit card account, you have not started a Know Your Customer (KYC) process. Yet someone enters your mobile number into a financial data platform and obtains a profile containing your name, Permanent Account Number (PAN), date of birth (DOB), address, email address, credit score, credit card limits and outstanding balances.Even your tax related identifiers such as an Income Tax Return acknowledgement number can be accessed.Financial technology (fintech) companies increasingly sell data-enrichment and verification services to banks, non-bank finance companies (NBFCs) and other fintech companies to target customers for retail loans. One such marketing communication, from Digitap, describes a “Mobile Enrichment API” capable of providing “verified identity, credit intelligence, and digital signals”. It promotes the ability to obtain information “before you even begin the onboarding journey” and with “minimal customer input”.Source: DigitapThere is an enormous difference between a borrower knowingly providing information during a loan application, as part of a conventional KYC/underwriting process and a prospective borrower being profiled before the onboarding process has even begun. The latter raises the question: Can a lender obtain a detailed financial profile of a person merely because it has the person’s mobile number?This author’s financial details could be accessed from only his mobile number without the regulatorily required One-Time Passwords (OTP).Author’s profile report which was accessed without OTPThe ease with which the author’s personal and financial information could be accessed using only a mobile number – and without OTP verification – should concern every Indian. The data included the author’s address, PAN, date of birth, email address, credit score, credit-card limits, outstanding balances and Income Tax Return acknowledgement number.The Aadhaar number, however, remained protected because the Unique Identification Authority of India (UIDAI) restricts access unless the individual provides an OTP to the requesting agency. The apparent unauthorised availability of the other personal details is deeply troubling.The misuse of information by acquiring information without the individual’s consent is a significant regulatory problem involving the lender, its technology partners and the data sources from which the information was obtained.Also read: Privacy Matters: Your Data Can Make You Pay More, Earn Less and Lose Access to What You NeedThe question is: Who gave permission to look for this information? This matters because a mobile number, in India’s digital financial ecosystem, acts as the common key connecting identity, credit, banking and other personal information. If that linkage is being used by digital lenders, micro-lending platforms, NBFCs or their technology providers without the required consent, the issue could become considerably bigger than an ordinary privacy complaint. The technology is moving faster than public understanding. And if it can, what legal authority permits the lookup?RBI’s digital-lending framework requires data collection by digital lending apps and their service providers to be need-based and based on prior, explicit borrower consent, with an auditable trail. The framework also addresses sharing of personal information with third parties and places responsibilities on regulated entities for the conduct of their lending service providers.This is important because many digital-lending operations are not technologically run entirely by the NBFC whose name appears on the loan agreement.Typical structureBorrower → mobile app → fintech/Loan Service Provider (LSP) → data provider → NBFCWhile the borrower may see one brand, behind it may be several technology and data companies. The question for the regulator is: Who is responsible when the data collection takes place in the technology layer?RBI’s outsourcing framework makes clear that regulated entities cannot simply outsource away their regulatory responsibilities. RBI’s rules require NBFCs to maintain control over outsourced activities and include provisions concerning customer-data confidentiality, audit rights and regulatory access to service-provider records.Also read: In First 10 Months of 2024-25, Digital Financial Frauds Drain Rs. 4,245 Crore: ReportFor an NBFC, the most convenient defence might be: “The technology provider collected the data. We only received it.” But that immediately leads to another question: Did the NBFC know what the technology provider was collecting and where it came from? RBI’s outsourcing framework specifically requires regulated entities to monitor service providers and protect customer information. It also provides for RBI access to records held by service providers.The critical question is not simply whether the information was subsequently used for a legitimate purpose. Regulators will need to examine whether the entity had lawful authority to obtain the information in the first place, and whether any required consent was obtained before the access.The situation becomes particularly sensitive when the information includes credit scores, credit-card balances or other credit information. India has a specific statutory framework governing credit information. Section 22 of the Credit Information Companies (Regulation) Act, 2005 states that no person may access credit information held by a credit information company, credit institution or specified user unless the access is authorised under the Act, another law, or by a court or tribunal. Unauthorised access is expressly characterised as “unauthorised access to credit information”.The Act provides penalties for unauthorised access. It is one thing for a financial app to know an individual’s address, but another if the app can retrieve their credit score and outstanding credit-card information. Regulators need to establish whether the information originated from a regulated credit-information system and, if so, whether the access was legally authorised. The source of the information therefore becomes critical.When all these personal details can be readily accessed it is no longer merely “lead generation”, but a detailed financial identity profile. For every field, an investigator should be able to ask:Without these details, it is impossible to determine whether the data was lawfully obtained.This could become the most consequential aspect of the issue. Suppose a prospective borrower gives a fintech only their mobile number. Before the person has completed an application, the platform retrieves information about their creditworthiness and financial position. The lender then decides whether to offer the person a loan. The individual may never know that this profiling occurred. This raises a fundamental distinction between verification after consent and profiling before consent.The regulatory issue becomes particularly significant if sensitive financial information is being retrieved before the individual has been informed about the collection and before the required consent has been obtained. The exact legal conclusion would depend on the source of the data, the relationship between the parties, the purpose of the lookup and the applicable statutory framework. But these are precisely the questions a regulator can answer only by examining the underlying systems.An elderly couple that lost Rs 14.85 crore following their “digital arrest” for 15 days in January 2026. Om Taneja, 81, and his wife Indira, 77, were trapped by men who impersonated officials from telecom and law enforcement agencies. Photo: PTIThere is a significant precedent. In July 2024, RBI cancelled the Certificate of Registration of Star Finserv India Ltd. Among the reasons cited were violations relating to outsourcing in digital lending and data confidentiality and security of customer information, including providing complete access to customer data to its service provider.In April 2024, RBI cancelled the Certificate of Registration of Acemoney (India) Ltd., citing violations connected with outsourcing through third-party apps and failure to comply with requirements concerning confidentiality of customer information.Also read: ‘Indians Lost Rs 177 Crore to High Value Digital Payment Fraud in FY24’: Union GovtThese cases do not establish that any other NBFC currently using mobile-number enrichment has committed a similar violation, but they demonstrate that the RBI can treat failures involving digital-lending outsourcing and customer-data controls as serious regulatory matters affecting the regulated entity itself. It cannot be restricted to a dispute between a consumer and an app developer.The regulatory significance would change dramatically if investigators discovered that this was not an isolated technical error but a systematic industry practice.Digitap along with Surepass, Digitap, Zoop, and Signzy were investigated by the Ministry of Electronics and Information Technology (MeitY) in June 2025 for bypassing authorised protocols to access information and MeitY blocked access to their websites by telecom networks.Take the case of an API being used across dozens of lenders. Every time a mobile number is entered, the system produces a financial profile. If millions of searches have occurred, the regulator would potentially have to determine:How many individuals were searched?How many had actually applied for loans?How many had given consent?How many were merely prospective customers?Which data sources were queried?Which NBFCs received the information?How long was it retained?Was it used for underwriting?Was it used for marketing or cross-selling?Were the searches recorded in an auditable system?That combination of information is potentially dangerous even without the person’s OTP, password, CVV or bank-account credentials. The biggest risk is that it gives a fraudster a highly credible “identity-and-financial profile” that can be used to make subsequent social-engineering or identity-theft attacks much more convincing.The Indian Cyber Crime Portal specifically recognises impersonation/identity theft, SIM-swap fraud, phishing and card fraud as categories of cybercrime.A recent study by Common Cause and Lokniti, CSDS, the Status of Policing in India Report (SPIR) 2026: Cybercrimes – Victim Perspectives and Systemic Responses, based on a survey of 8,306 respondents from across 16 states and Union Territories and interviews with 37 stakeholders, including victims, cybercrime experts and others finds that 13% of the overall respondents were victims of cybercrimes in the last 2-3 years. More than half (54%) were victims of digital financial frauds.The study finds that 54 of the victims had faced digital financial fraud, 13 hacking of their devices, 11 personal data theft and the remaining 11 faced abuse or harassment online.Writing in the Hindu, one of the experts behind the study said that perceptions of safety – the belief that one could trust a digital fintech/payment platform – raised the likelihood of falling victim to fraud. The converse was equally true – the lower the trust, the less likely was a fraud.1. Targeted bank/credit-card impersonationThis is probably one of the most immediate risks. A fraudster could call saying: “We can see that your card ending XXXX has an outstanding balance of Rs Y. We are offering you a balance-transfer/interest reduction.” Because the fraudster actually knows the victim’s approximate outstanding balance and credit limit, the victim may believe the caller genuinely works for the bank.The Income Tax Department similarly warns that phishing works by impersonating trusted financial institutions and inducing people to disclose sensitive information. The attacker would then try to obtain the missing pieces – OTP, CVV, card number, internet-banking password, UPI PIN, etc.2. SIM-swap attackThe mobile number is particularly important. The Cyber Crime Portal describes SIM-swap fraud as obtaining a replacement SIM against the victim’s registered number and then receiving the OTPs and alerts used for financial transactions. Having the victim’s name, date of birth, PAN, address and mobile number can give the fraudster substantially more material with which to impersonate the customer to a telecom operator or overcome verification questions.The data by itself does not mean a SIM swap can automatically be performed; additional controls normally exist. But it can materially strengthen an attack.3. Fraudulent loan or credit applicationsA detailed credit profile is particularly valuable to an organised fraudster. Such a profile can identify approximate income/creditworthiness, existing borrowing, card limits, outstanding debt, and likely eligibility for additional credit. They could then impersonate the victim in applications for personal loans, credit card, BNPL facilities, fintech credit, consumer finance, and fraudulent merchant accounts.Also read: ‘Will Take Stringent Action’: SC Expresses Shock Over Rs 3,000 Crore Lost to Digital Arrest ScamsWhether an actual loan can be obtained depends on the lender’s KYC, authentication and fraud controls. RBI’s digital-lending framework, which was subsequently withdrawn, specifically identified data privacy and misuse of personal data as risks requiring regulatory controls, including need-based collection and explicit consent for data collection.4. KYC update scams“Your PAN and credit-card KYC have a discrepancy. We have your DOB and address here. Please click this link to update your PAN.” The victim receives such a message that shows the caller already knows several private facts and therefore assumes the caller is legitimate. The fraudster then obtains the information that isn’t in the database – typically an OTP, login credential, card information or authentication approval.5. Tax/refund impersonationIf an ITR acknowledgement number is genuinely exposed, it could make a fake Income-Tax communication substantially more convincing. For example, imagine you receive the following message: “Your ITR acknowledgement XXXXX has been selected for verification. Your refund is being held because your bank details need confirmation.” The attacker could use the known PAN, DOB, email, address and ITR reference to make the communication appear authentic.This is particularly relevant because the Income Tax Department itself warns about fraudulent refund/phishing communications, and says it does not request passwords, PINs or similar financial credentials by email. (An ITR acknowledgement number by itself is not equivalent to access to the taxpayer’s e-filing account. The danger is that it can provide another piece of information for impersonation and social engineering.)6. Credit-card fraudKnowing the credit limit and outstanding balance doesn’t normally allow someone to charge the card, but it can make a subsequent attack much more credible: “Your Rs 4.8 lakh card limit has been temporarily blocked because your outstanding payment hasn’t been received…” The fraudster can then attempt to obtain the card number/CVV/OTP or induce the victim to approve a transaction.Delhi Police specifically warns that vishing attacks commonly involve criminals impersonating banks or financial institutions to obtain credentials and other authentication information.Routers seized from a cyber-fraud racket with links to the Philippines and Cambodia busted by Gurugram Police. Five people were arrested for using and delivering illegal SIM boxes, in Gurugram, Wednesday, April 1, 2026. (PTI Photo)7. Account takeover through password-reset/social engineeringThe combination of mobile + email + DOB + address + PAN can potentially be used to answer identity questions, construct password-reset attacks, or persuade customer-service personnel that the attacker is the genuine customer.The actual feasibility varies enormously between institutions because some require OTP, device binding, biometric verification or other authentication.8. Highly targeted WhatsApp/SMS phishingInstead of sending a generic scam message: “Your bank account has been blocked. Click here”, the criminal can send: “Your bank credit card ending XXXX has an outstanding balance of Rs 1,84,650. Your payment is overdue. Click here to avoid late-payment charges.”Also read: New Scam in Town: A Journalist Recounts 28-Hour-Long ‘Digital Custody’The more accurate the underlying financial information, the greater the psychological credibility of the attack.9. Sale into a larger fraud databaseThis is perhaps the most concerning systemic issue. The information could be combined with other databases containing: Aadhaar-related information; bank account information; telephone records; employment information; insurance information; vehicle information; property information; transaction data. The result could be a very comprehensive identity/financial dossier. That is considerably more valuable to criminals than an isolated PAN or mobile number.ConclusionThere is an important difference between “information that permits an immediate theft” and “information that substantially increases the probability of successful fraud.” This type of profile is primarily the second. Each incremental piece of information – mobile, name, date of birth, PAN, address, email, credit score, card limits, outstanding balances, and ITR information – contributes to increasing the possibility of a successful fraud.That is why the alleged ability to retrieve such a profile merely by entering a mobile number would be a serious data-governance and financial-consumer-protection issue, even if the platform cannot directly move money.RBI’s digital-lending framework, subsequently withdrawn, expressly recognises privacy/data misuse concerns and requires regulated entities and their service providers to impose controls around data collection and privacy.However, as seen above, the author’s financial details were accessed and disclosed without his providing consent. This incident raises the possibility that similar practices may be more widespread and that some entities may be obtaining personal information without lawful authorisation. The scale of the problem cannot be assumed from a single case, but it warrants urgent regulatory investigation.If such information is available to unauthorised parties, fraudsters could use it to build convincing identity and financial profiles, increasing the risk of impersonation, social-engineering attacks and financial fraud. The possibility that this data may already have been misused makes the lack of visible regulatory action a serious concern.In such circumstances, there is little meaning in the authorities bombarding phone users with audio and text alerts about the dangers of fraud. That merely pushes the responsibility onto the individual, when the regulator is not preventing such fraud at the source.Severe penalties and stronger consent controls could lengthen customer-acquisition processes and affect the valuations of businesses that rely on rapid data-driven onboarding. Regardless of the commercial impact, the public, industry stakeholders and regulators must recognise and address practices that undermine privacy and the financial security of individuals.Hemindra Hazari is a commentator. This piece was updated to remove some details of the author’s redacted report.