India flags five Play Store loan apps: I4C notice, old Chinese-app shelf, new shells

New Delhi / Bengaluru | 16 September 2026, India’s Cybercrime Coordination Centre has again used the government-request channel to Google to pull suspected predatory digital-lending apps off the Play Store. A Lumen copy of the complaint, sent on 9 September 2026 by I4C–MHA to Google LLC, lists five Android package URLs. There is no copyright claim. The jurisdiction is India.

The move sits inside a year-long industrial takedown. By 30 June 2026 the Ministry of Home Affairs had told Parliament that I4C had blocked 3,718 mobile apps, including fraudulent loan apps, under Sections 69A and 79(3)(b) of the IT Act; the same reply put ₹11,158 crore as money reported saved on the national cyber-fraud desk and listed 15.75 lakh SIMs and 5.77 lakh IMEIs cut on police reports.

This batch is smaller. It is more interesting. The five Play IDs are not one gang. They fall into three operator clusters and one wrapper listing. Only one cluster has a documented line back to the 2020–21 Chinese instant-loan factory.

What Google was intimated to take down

Earlier I4C Play notices this year used the same legal hook, Section 79(3)(b) of the IT Act read with Rule 3(1)(d) of the IT Rules, 2021, and a three-hour disable window. Those notices alleged the same harms: “low-interest instant loan” lures, extortionate rates after disbursal, and harvest of Aadhaar, financial data, contacts, gallery and camera by operators I4C called transnational criminals. Several batches were promoted with Play Store ads.

Public batches already on the record in 2026: five apps on 21 July; six on 7 August (LoanOrbit, Hisab, Nexus Loan, One Fund, Credit Factor, Mobile Credit Prairie); three on 19 August (Horizon Cash Service, Money Score Monitor, Zelicredit). The 9 September Lumen card is at least the fourth Google salvo in eight weeks.

Cluster A: LoanMargLine sits on the 2020 Chinese-app nominee shelf

LoanMargLine is published by Toucolor Technologies Private Limited (CIN U72900KA2020PTC131433), incorporated 9 January 2020, paid-up capital ₹100. The Play card sells a revolving line of ₹3,000–₹90,000 at “from 0.05% a day,” claims no processing fee, and names no RBI-regulated lender.

The two directors are Chirapuram John Roy (DIN 08614594) and Ravikumar Mangala (DIN 08641136). In the same ten-week window, November 2019 to January 2020, those DINs were written onto a stack of Bengaluru private companies whose names are not Indian product brands: Liufang, Nabloom, Pinprint, Hotful, Haohua, Tiantian, Nianlun, Qianxun. Toucolor was incorporated the same day as Liufang and Tiantian.

Those four core names are the companies Hyderabad Cyber Crime froze accounts on in December 2020 and named as the Indian shells behind roughly 1.4 crore transactions / ₹21,000 crore of instant-loan flow. Police said the operation was headed by Chinese national Zhu Wei @ Lambo (Jiangxi), arrested at Delhi airport on 30 December 2020; that Qiu Yuan Yuan @ Jennifer had set the India shop up and left; and that recovery instructions ran through Jakarta. Bank logins on mule accounts were found in Mandarin. Google’s 2021 sweep listed the same four companies against Krazy Bean, Krazy Rupee, Pocket Rupee and the rest of that wave.

The address pattern did not move. Toucolor’s MCA office is S-515, Manipal Centre, 47 Dickenson Road, the same suite used by Fairgrowth Exim, Fair Growth Factors and Addtec. Its Play address is Ejipura, the locality The News Minute flagged for Liufang in 2021. That is an office factory, not a product company.

This does not, by itself, prove Zhu Wei still owns Toucolor in 2026. Nominees get reused; some of Roy’s earlier posts show cessation dates. It does prove the legal face of a 2026 I4C Play target is the same Indian nominee pair, same RoC, same fortnight, same two rooms as the 2020 Chinese-app shelf. Delisting one APK and leaving Liufang–Nabloom–Pinprint–Hotful–Haohua–Tiantian untouched leaves the factory standing.

Cluster B: BAGOLoan is a Tamil Nadu family stack

BAGOLoan is published by Basago Digitech Private Limited (CIN U72900TN2022PTC154520), Kovilpatti. Directors Velliyappan Sivanantha Selvan and Velliyappan Balasubramanian incorporated four companies in 27 days in August–September 2022: Digitech, Payserve, Software, Technologies. That is origination plus an in-house payment rail. There is no DIN or address overlap with the Bengaluru Chinese shelf.

The Play card offers revolving credit of ₹1,000–₹100,000 at 0.04–0.08% a day and still does not name an NBFC. Under RBI Digital Lending Directions, a personal-loan app that does not map to the public DLA directory is already offside, with or without a China story.

Cluster C: Sunny Rupee is a 13-month shell on a real NBFC

Sunny Rupee is published by Valendrix Fintech Private Limited, incorporated 5 August 2025, paid-up about ₹1 lakh, DINs issued the same day. The package name, data.analytics.processor.service.app, is a generic stub. AppBrain showed on the order of 110,000 installs in 30 days with almost no reviews: farmed distribution.

The listing name-drops Nishtha Leasing Pvt Ltd, a genuine 1991 RBI-registered NBFC in Panipat that markets itself as a co-lending / LendBase partner. Naming a real NBFC on a Play card is not the same as the app name appearing on RBI’s DLA directory. That is the 2025–26 version of rent-an-NBFC, not proof of a clean book.

No director, address or email overlap with Clusters A or B.

Outlier: Spendexa Smart

Spendexa Smart is published by August Global Creation Private Limited (CIN U74900KA2012PTC066789), a 2012 Padmanabhanagar signage and interiors firm. The store page sells a budget tracker, not a loan. I4C listed the package anyway, consistent with wrapper listings used to stay inside Play policy while a lending funnel runs behind it. There is no corporate line to Liufang or Basago. Keep the package as an IOC. Do not merge the company into Cluster A.

RupeeGo (com.codethrust.rupeego) is already unpublished. No living MCA company named CodeThrust surfaced. The “Rupee + verb” brand family is the same naming grammar Google attributed to Liufang/Nabloom/Pinprint in 2021. That is a name rhyme, not a CIN hit.

Google's Playstore Policy Bypass

India is running the largest continuous app-store action against illegal digital lending of any major market. Operators adapted. Play-compliant skins (“credit line”, “expense tracker”, “data analytics processor”), fresh Pvt Ltds with ₹100–₹1 lakh paid-up capital, optional name-drops of real NBFCs, contact-graph harvest for collection harassment, then, after the three-hour takedown, Instagram, web funnels and sideloaded APKs. Mint documented that “dark distribution” shift this year. ED has separately said Chinese networks still dominate loan-app and crypto rip-offs even as domestic crews run digital-arrest fraud.

One publisher is the surviving legal face of a shelf that already produced a police-documented ₹21,000-crore predicate. That is the row that should drive the next notice, the next ED account freeze, and the next RBI DLA audit, not another URL-only takedown.

Indicators of compromise (IOCs)

Android packages

com.augustglobalcreations.SpendexaSmart com.basago.credit.app com.codethrust.rupeego com.sunny.rupee.data.analytics.processor.service.app com.toucolor.loanmargline.credit.stable

Play Store URLs

https://play.google.com/store/apps/details?id=com.augustglobalcreations.SpendexaSmart https://play.google.com/store/apps/details?id=com.basago.credit.app https://play.google.com/store/apps/details?id=com.codethrust.rupeego https://play.google.com/store/apps/details?id=com.sunny.rupee.data.analytics.processor.service.app https://play.google.com/store/apps/details?id=com.toucolor.loanmargline.credit.stable

Publisher entities (this notice)

Cluster A expansion, same nominee DINs / 2020 shelf

LIUFANG TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131436 NABLOOM TECHNOLOGIES PRIVATE LIMITED U72200KA2020PTC131440 PINPRINT TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131434 HOTFUL TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131435 HAOHUA TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131725 TIANTIAN TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131432 NIANLUN TECHNOLOGIES PRIVATE LIMITED U72200KA2020PTC131779 QIANXUN TECHNOLOGIES PRIVATE LIMITED U72900KA2020PTC131728 CREDGO FINANCIAL SERVICES PRIVATE LIMITED U67200KA2020PTC133797 FAIRGROWTH EXIM LIMITED U85110KA1991PLC012326 FAIR GROWTH FACTORS LIMITED U72200KA1991PLC012452 WATERELEPHANT TECHNOLOGIES / FINANCIAL AGLOW TECHNOLOGIES / AGLOW FINTRADE (2020–21 predicate)

Cluster B expansion

BASAGO PAYSERVE PRIVATE LIMITED BASAGO SOFTWARE PRIVATE LIMITED BASAGO TECHNOLOGIES PRIVATE LIMITED

Director DINs

08614594 Chirapuram John Roy 08641136 Ravikumar Mangala 09700969 Velliyappan Sivanantha Selvan 09700970 Velliyappan Balasubramanian 11230517 Simarnjeet Kaur Gahir 11230518 Satypriya 06400299 Naragallu Babu Sobhan 06400316 Rajkumari

Emails

[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Domains

toucolortechnologies.com basagodigitech.com valendrixfintechprivatelimited.com nishthaleasing.in

Phone

+91 87961 61288

Addresses (pivot)

S-515, 5th Floor, Manipal Centre, 47 Dickenson Road, Bengaluru 560042 No. 20, Alfa Center, Venugopal Swamy Layout, Ejipura, Bengaluru 560047 484/2D1 Sinthamani Nagar, Kovilpatti, Thoothukudi, TN 628502 Plot No. 68B, Kavi Nagar, Rohta Road, Meerut Cantt, UP 250001 Unit C-407, Tower C, Urbtech Trade Center, Sector-132, Noida, UP 201301 1/42, 11th Main, N.N. Complex, Padmanabhanagar, Bengaluru 560070

Google should treat every personal-loan, credit-line and wrapper-finance listing aimed at India as unlawful until it is on the RBI directory by exact app name and extend the same licence bar beyond the current seven-country list. Anything less is knowing distribution of an extortion tool that has already been paid for in Indian lives.