Can banks lock your phone for loan default? What RBI’s new rules say

Can banks now lock your mobile phone?

Yes, but only under tightly regulated circumstances and in a gradual manner. The RBI has formally recognised that banks financing smartphones, tablets or laptops may use technology-based mechanisms to restrict certain device functions if the borrower defaults. Such measures, however, can only be used where the loan specifically financed that device.

The loan agreement must clearly disclose this possibility, the recovery process and the stages at which restrictions may be imposed. No restrictions can be activated until the account becomes 30 days past due, despite notices to the borrower. Even then, restrictions must be introduced gradually, RBI says.

Complete restrictions permitted under the loan agreement can be imposed only after the loan remains unpaid for 60 days, and outgoing calls cannot be blocked before that point, it says.

What parts of the phone cannot be disabled?

The RBI has drawn important safeguards. Banks cannot disable incoming calls, SMS services or emergency SOS functions. Restrictions should also not interfere with activities necessary for the borrower’s work or employment.

Borrowers must be able to view the status of restrictions placed on their device at any time. Once overdue amounts are paid, banks must restore functionality within one hour. Where restoration is delayed because of the bank, compensation of Rs 250 per hour becomes payable until access is restored, subject to a ceiling equal to the loan amount, the regulator says.

The directions also impose strict privacy protections. Banks and third-party technology providers are prohibited from accessing personal data stored on borrowers’ devices, including contacts, photographs, messages, call logs or location history, the regulator says.

How will banks be held accountable?

Banks must record recovery-related calls, maintain records for at least six months, and inform borrowers that conversations are being recorded. Recovery targets and incentive structures should not encourage aggressive behaviour.

Every bank must establish a dedicated grievance redressal mechanism for recovery-related complaints. Contact details of the grievance redressal officer must appear in loan documents and all recovery communications. This makes the bank — not merely the outsourced recovery agency — accountable for violations.

Why has the RBI issued fresh directions now?

India’s retail lending market has expanded rapidly over the past decade, driven by digital loans, unsecured personal credit, Buy Now Pay Later (BNPL) products and financing for smartphones and other consumer electronics. Alongside this growth, complaints relating to recovery practices have also risen.

Borrowers have frequently alleged repeated phone calls, intimidation, visits at odd hours, public shaming through social media, and harassment of family members and employers. At the same time, some lenders financing smartphones have begun using technology capable of remotely restricting a device’s features when repayments are missed.

The Reserve Bank of India office in Mumbai. Photo: Wikimedia Commons

The RBI’s latest amendment seeks to address these developments through a comprehensive framework covering recovery agents, recovery agencies, banks’ internal policies, grievance redressal and the use of technology in loan recovery. The directions apply to all commercial banks.

Importantly, the RBI has expanded the definition of recovery agencies. Any outsourced individual or entity engaged in recovering loan dues — including Business Correspondents carrying out recovery functions — will now be treated as recovery agencies. Their representatives interacting with borrowers have been defined as recovery agents. This closes a long-standing regulatory gap where recovery work was often outsourced under different contractual arrangements.

What changes for banks?

The RBI has made recovery a board-governed process rather than merely an operational function. Banks must frame a comprehensive recovery policy that clearly specifies when recovery proceedings begin, the sequence of recovery measures, escalation mechanisms, and the code of conduct to be followed by employees as well as outsourced recovery agents.

The policy must also lay down procedures for dealing with borrowers facing genuine financial distress, including documented engagement before recovery actions are escalated. It should cover recovery following the death of a borrower and provide compensation where recovery actions violate RBI norms. Banks will also have to strengthen oversight of outsourced recovery agencies through periodic audits, performance reviews and due diligence before empanelment, RBI says.

What safeguards have been introduced for borrowers?

The biggest shift is the emphasis on respectful recovery practices. Recovery agents can contact borrowers only between 8 am and 7 pm, unless the borrower specifically requests otherwise. They must identify themselves through identity cards and authorisation letters and carry copies of notices issued by the bank.

Recovery discussions must be limited to the borrower or guarantor. Banks cannot allow recovery agents to discuss outstanding loans with neighbours, colleagues or unrelated third parties. The RBI has also listed practices that will be treated as unacceptable. These include abusive language, anonymous or threatening calls, repeated messaging, harassment of relatives, intimidation, public humiliation, and posting borrower information or recordings on social media. Recovery agents have also been instructed to avoid visits during bereavement, medical emergencies, marriage functions or similar distressing situations, the central bank says.

Why has the RBI focused on recovery agents?

The regulator has made banks directly responsible for the conduct of outsourced recovery personnel. Banks must conduct background verification before appointing recovery agents and periodically thereafter. Only individuals certified through the Indian Institute of Banking and Finance’s Debt Recovery Agent training programme — or equivalent recognised programmes — can undertake recovery work.

Further, banks must publish an updated list of empanelled recovery agencies on their websites. Borrowers should be informed before the first recovery visit, immediately notified if the agency changes, and told if the agency’s services are terminated. The objective is to ensure borrowers always know who is authorised to represent the bank.