In March 2023, a routine day working at a media agency turned into a harrowing two-month-long ordeal for one 25-year-old digital marketing executive. Tasked with researching digital lending products on the Google Play Store, she came across AA Kredit—a personal loan application with over a million downloads and superb ratings by users. Having never heard of the company or app, she downloaded it to see what it was all about.

The app asked for some basic identification documents, which she duly provided. Even before she could screenshot the app’s policies, however, the app crashed. This didn’t raise any red flags, with the executive chalking it down to a harmless glitch. Later that day, though, she received notifications from her bank that a total of Rs 13,500 had been deposited into her account from three separate sources.

She checked the AA Kredit app again and was shocked to find that a loan had been disbursed to her, with a payback period of 60 days. Her first instinct was to immediately repay the loan, but none of the repayment options on the app were functional. Emails to the company also went unanswered.

A week later, even as she tried to resolve the matter, the harassment began. At first, this took the form of threatening calls and WhatsApp messages from loan agents asking her to pay Rs 20,000. If not, they warned, they would begin reaching out to her contacts to defame her. Eventually, morphed photos of her were circulated amongst her contacts.