A loan taken in your name by an impostor is not your loan. There was no agreement between you and the lender, the person who signed or clicked was committing an offence, and your job is to put that on record with the lender, the credit bureaus, the police and UIDAI before a recovery agent or a rejected home loan application forces the issue. Each of those four has its own paper. Start all four this week.
How do I get the lender to cancel the loan?
Write to the lender's grievance officer, not the collections number. State that you never applied, never received the money, and dispute the debt in full. Ask for the complete application file: the form, the KYC documents relied on, the selfie or video KYC, the mobile number and email used, the bank account the money went to, and the IP and device details. Demand that the account be marked disputed and that reporting to the credit bureaus stop pending investigation. Enclose the police acknowledgement as soon as you have it.
On the law, an agreement whose consent was obtained by fraud is voidable under Section 19 of the Indian Contract Act, 1872, and where the lender never dealt with you at all there was no consent to speak of. Say plainly that you will not pay, and that the lender's remedy is against the person who cheated it, which is Section 318(4) of the Bharatiya Nyaya Sanhita, 2023 from the lender's side of the same fraud. If the lender is a bank, or a non-banking financial company that takes deposits or has a customer interface with assets of Rs 100 crore or more, and it does not resolve the complaint within thirty days, the Reserve Bank Integrated Ombudsman Scheme, 2026 is open at cms.rbi.org.in, free, with a ninety-day window from the reply. Our answer on the Ombudsman and the consumer commission explains the sequence.
How do I get it off my credit report?
Pull your report from every credit information company that carries the entry and raise a dispute with each, and with the lender, on the same day. Section 21(3) of the Credit Information Companies (Regulation) Act, 2005 provides that on a request to update or correct, the credit information company, the specified user or the credit institution "shall take appropriate steps to update the credit information within thirty days after being requested to do so", though a correction is made only after the lender certifies it. The Reserve Bank's circular of 26 October 2023 put money behind that clock: you are entitled to Rs 100 per calendar day where the complaint is not resolved within thirty calendar days of filing, the lender gets twenty-one of those days to send the correction and the bureau the remainder, and a rejection must carry reasons. Section 19 of the same Act separately obliges all of them to keep the data accurate. Credit information companies are within the 2026 Ombudsman scheme, so an unresolved bureau dispute has the same free escalation.
| Track | Law or rule | Deadline that runs in your favour | Escalation |
|---|---|---|---|
| Lender dispute | Section 19 Contract Act, lender's grievance policy | Thirty days to reply | RBI Ombudsman, consumer commission |
| Credit report correction | Section 21(3) CICRA 2005, RBI circular of 26 October 2023 | Thirty days, then Rs 100 a day | RBI Ombudsman (covers credit information companies) |
| Police complaint | Section 66C IT Act, Sections 318(4), 319, 336(3) BNS, Aadhaar Act Sections 34 to 37 | Register today, e-FIR signed within three days | DCP, then Magistrate under Section 175(3) BNSS |
| Aadhaar lockdown | UIDAI biometric lock, authentication history, VID | Immediate | UIDAI helpline 1947 |
Which offences do I report?
File on cybercrime.gov.in and at the police station, and name the provisions. Section 66C of the Information Technology Act, 2000 punishes whoever fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of another person, with up to three years and a fine up to Rs 1 lakh, and an Aadhaar number is exactly such a feature. Section 319 of the Bharatiya Nyaya Sanhita, 2023 covers cheating by personation, up to five years, and Section 336(3) covers a forged electronic record made for cheating, up to seven years. Section 318(4) covers the cheating of the lender, and you and the lender are both persons harmed by the same act.
The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 adds offences of its own. Section 34 punishes impersonating another person by providing false demographic or biometric information, Section 36 punishes pretending to be authorised to collect identity information, and Section 37 punishes intentionally disclosing or disseminating identity information to a person not authorised to receive it, each with up to three years. Ordinarily only UIDAI can complain under that Act, but the proviso to Section 47(1), inserted in 2019, lets the court take cognizance of Sections 34 to 37 on a complaint by the Aadhaar number holder, and Section 47(2) places the trial before a Chief Metropolitan or Chief Judicial Magistrate. Where the leak came from a company that held your Aadhaar for a legitimate purpose, Section 43A of the IT Act makes a body corporate that is negligent in maintaining reasonable security practices liable to compensate you, through the adjudicating officer under Section 46 for claims up to Rs 5 crore. If the station will not register, the answer on police refusing to register an FIR has the ladder.
How do I stop it happening again?
- Lock your biometrics through the "Lock/Unlock Biometrics" service on the UIDAI site or the Aadhaar app, so no fingerprint or iris authentication can be run in your name until you unlock it
- Check the authentication history in the Aadhaar app for the dates of the fraudulent authentications and print it for the police
- Generate a Virtual ID and give that, or a masked Aadhaar, instead of the number wherever you can
- Run "Know mobile connections in your name" on the Sanchar Saathi portal, because an identity thief usually takes a SIM first, and get any stranger's number disconnected
- Pull all your credit reports again in ninety days to confirm the entry is gone and nothing new has appeared
- Keep every letter, ticket number and reply in one folder. The Digital Personal Data Protection Act's core obligations are phased in only from 13 May 2027, so today the IT Act and these regulators are the working remedies
What I tell people in this position
The recovery agents will keep calling, and the account will often show as "written off" on the report, which lenders read worse than "overdue". Do not negotiate a settlement to make it stop, because a payment is read as an admission that the loan was yours. Send the agents the FIR number and the dispute letter, record the calls, and let the thirty-day clocks run. The entry comes off when the lender certifies the correction, and lenders certify faster once the Rs 100 a day and an Ombudsman complaint are on the table. Our answer on rights over personal data covers what you can demand from whoever leaked the number in the first place.