How to Check if a “Loan Shark” App Is Harvesting Your Contacts
It isn't.
If a lending app can access your contact list, it may potentially obtain information about the people saved on your phone. That becomes particularly concerning when the lender uses those details to contact, pressure or embarrass people connected to a borrower.
Nigeria's data-protection regulator, the Nigeria Data Protection Commission (NDPC), has previously described loan apps as overly intrusive when they access contacts, pictures and messages.
More importantly, the FCCPC's 2025 digital-lending regulations require digital lenders to confirm that their apps will not have access to consumers' call logs, contacts and photos/gallery.
So if you're using a digital lending app, checking its permissions is one of the quickest ways to see whether it has access to information it shouldn't need.
First: What Does “Harvesting Your Contacts” Mean?
Contact harvesting is when an application obtains information from your phone's address book and potentially processes or uses that information.
Your contact list may contain:
- Names
- Phone numbers
- Email addresses
- Family members
- Friends
- Colleagues
- Customers
- Employers
- Business contacts
The problem isn't simply that the app asks for permission.
The important question is:
Does the app actually have access?
And:
Does it have a legitimate reason to need that access?
Nigeria's data-protection principles require personal data to be collected for specified, legitimate purposes and to be adequate, relevant and limited to what is necessary for those purposes.
How to Check on Android
The exact wording can vary depending on your phone manufacturer and Android version, but the general process is similar.
Step 1: Open Settings
Go to your phone's Settings.
Step 2: Open Apps
Look for:
Apps
App Management
or Applications.
Step 3: Find the loan app
Tap the lending app you want to investigate.
Step 4: Tap Permissions
Look for a section labelled:
Permissions
or
App permissions.
You'll see the categories of information the app is allowed to access.
Look specifically for:
📱 Contacts
📞 Phone
📷 Photos and videos
📍 Location
💬 SMS
🎤 Microphone
The Biggest Red Flag: Contacts
If you open the app's permissions and see:
Contacts → Allowed
that means the application currently has permission to access your contacts.
That doesn't by itself prove the company is abusing the data.
But for a digital lender, it is a serious privacy warning sign, particularly because the FCCPC's current digital-lending rules require registered lenders to confirm that their apps aren't designed to access contacts, call logs or photos/gallery.
What should you do?
If you don't believe the app needs your contacts:
Tap Contacts → Don't allow
or
Remove permission.
How to Check on iPhone
On an iPhone, go to:
Settings → Privacy & Security → Contacts
You'll see a list of apps that have requested access to your contacts.
Find the loan app.
If access is enabled, you can turn it off.
You can also check other categories under Privacy & Security, including:
- Photos
- Microphone
- Location Services
- Bluetooth
- Camera
The exact options available depend on your iOS version.
Check More Than Just Contacts
A predatory loan app may not only be interested in your address book.
Look at every permission the application has.
🚩 Contacts
Ask:
Why does a lending app need my entire address book?
This is one of the biggest privacy concerns.
🚩 Call Logs / Phone
An app that can access your call history may potentially obtain information about who you communicate with.
For digital lenders, this is particularly concerning because the FCCPC's 2025 regulations specifically address access to call logs.
🚩 Photos / Gallery
Be cautious if a loan app wants broad access to your photos.
Your gallery could contain:
- ID cards
- Bank statements
- Screenshots
- Family photographs
- Work documents
- Private conversations
- Other sensitive information
The current FCCPC framework specifically requires digital lenders to confirm their apps won't have access to consumers' photos/gallery.
🚩 SMS
SMS can contain sensitive information, including:
- Bank transaction alerts
- OTPs
- Account notifications
- Personal messages
An application requesting SMS access deserves particularly careful scrutiny.
🚩 Microphone
Ask why a loan application needs access to your microphone.
If you aren't using a legitimate feature that requires audio recording, consider denying the permission.
🚩 Location
Some financial applications may have legitimate reasons for requesting location information, but you should still check why the app wants it and whether you can use the service without granting unnecessary access.
The 2-Minute Permission Test
Here's a simple test you can use for almost any loan app.
Open:
Settings → Apps → [Loan App] → Permissions
Then ask:
Contacts?
❌ Why does it need my address book?
Call logs?
❌ Why does a lender need my call history?
Photos?
❌ Why does it need my entire gallery?
SMS?
❌ Why does it need to read my messages?
Microphone?
❓ Is there a legitimate feature requiring this?
Location?
❓ Is this actually necessary for the service?
The more unrelated permissions an app requests, the more carefully you should investigate it.
Permission Denied Doesn't Always Mean You're Completely Safe
This is an important distinction.
If you remove Contacts permission, the app should no longer have access through that Android/iOS permission.
But that doesn't necessarily mean the company has deleted information it may have collected before you revoked access.
That's why permission management is only one part of protecting your data.
If you previously gave an app access to your contacts, consider:
- Revoking the permission
- Reviewing the company's privacy policy
- Asking the company what personal data it holds about you
- Asking how the data is being used
- Requesting deletion or restriction where applicable
The NDPC says data subjects have rights including access, rectification, objection, restriction and erasure in appropriate circumstances.
What If the App Already Has Your Contacts?
Don't panic.
You can still take action.
Step 1 — Remove the permission
Go to the app's permissions and turn off Contacts.
Step 2 — Screenshot the permission page
Before changing anything, take a screenshot showing what the app was allowed to access.
This can become useful evidence if you later make a complaint.
Step 3 — Save your loan records
Keep:
- Loan agreement
- Receipts
- Transaction records
- App messages
- Emails
- SMS
- Screenshots
- Collection messages
Step 4 — Review the privacy policy
Look for sections explaining:
Data collected
How data is used
Third-party sharing
Data retention
Contact information
Nigeria's data-protection principles require transparency around personal-data processing.
Step 5 — Make a formal privacy request if necessary
If you want to know what personal data an organisation holds about you, you have a data-subject access right under Nigeria's data-protection framework. The NDPC provides a Data Subject Access Request process.
What If the App Is Contacting Your Friends?
If people in your contact list start receiving messages about your loan, don't simply assume they are responsible for your debt.
Document everything.
Ask the person who received the message to send you:
- Screenshot of the message
- Sender's number
- Date and time
- Any links included
- Name of the company mentioned
Keep the evidence.
If the lender is using personal information improperly or engaging in abusive collection practices, you can escalate the matter through the relevant consumer-protection and data-protection channels.
Don't Give the App More Information While Investigating
This is another common mistake.
If you discover that a suspicious loan app already has access to your contacts, don't respond to an unknown agent by sending:
❌ NIN
❌ BVN
❌ Bank PIN
❌ OTP
❌ Card details
❌ Password
❌ More identity documents
Just because someone says:
“We need it to close your account.”
Contact the lender through a verified official channel instead.
Check Whether the Lender Is Legitimate
Permission problems are only one part of the investigation.
Before taking another loan, verify the lender.
The FCCPC maintains a regulatory framework for digital consumer lending, while the NDPC oversees data-protection compliance.
Don't download a loan app simply because someone sends you its APK or a link on WhatsApp.
Verify:
Who owns the app?
What company operates it?
Does the company provide a privacy policy?
Does it provide a physical/contactable business identity?
Is it subject to the relevant regulatory requirements?
What a Legitimate Loan App Should NOT Make You Feel
Be cautious if an app makes you feel:
“If I don't give them access to my contacts, I won't get my loan.”
or:
“They already have everyone's number, so there's nothing I can do.”
or:
“They said they'll call everyone I know if I don't pay.”
Those are serious warning signs.
A lending relationship does not give a company a free pass to collect and misuse unrelated personal information.
The NDPC has previously highlighted the privacy problems associated with loan apps accessing contacts, pictures and messages.
What to Do Before Installing Any Loan App
Before you press Install, follow this checklist.
🔍 CHECK THE COMPANY
Who operates it?
🔐 CHECK THE PRIVACY POLICY
What information does it collect?
📱 CHECK THE PERMISSIONS
What does the app want access to?
💰 CHECK THE LOAN TERMS
Interest, fees, repayment date and penalties.
🚨 CHECK THE REGULATORY STATUS
Don't rely on the app's name or logo alone.
⭐ CHECK REVIEWS CAREFULLY
Look for complaints about harassment, privacy and unauthorised contact access—not just complaints about high interest rates.
The Biggest Red Flags
If you see several of these together, stop and investigate before proceeding:
🚩 Loan app demands contacts access
🚩 Requests access to your gallery without a clear reason
🚩 Requests call logs
🚩 Requests SMS access
🚩 Forces you to grant unrelated permissions
🚩 Has no clear privacy policy
🚩 Doesn't clearly identify the company behind the app
🚩 Uses WhatsApp agents instead of official support
🚩 Threatens to contact your friends
🚩 Threatens to publish your personal information
🚩 Demands more personal information after you've already completed verification
🚩 Was installed from an unofficial APK
If You Think Your Data Has Already Been Misused
There are several things you can do.
1. Revoke unnecessary permissions
Start with contacts, photos, call logs and other sensitive permissions.
2. Preserve evidence
Take screenshots before deleting anything.
3. Contact the lender
Use the official complaint channel.
4. Ask what data they hold
You can exercise applicable data-subject rights.
5. Ask for correction, restriction or deletion where appropriate
The NDPC recognises data-subject rights including access, objection, restriction and erasure.
6. Escalate
If the organisation doesn't resolve a legitimate privacy complaint, the NDPC provides channels for reporting and data-protection complaints.
One Important Myth
❌ “If the app asks for permission, it automatically has all my contacts.”
Not necessarily.
On modern Android and iOS devices, apps generally need the relevant operating-system permission to access protected information such as contacts.
That's why checking your Permission Manager is useful.
But if you previously granted permission, the app may already have processed information while that permission was active.
So:
Check → Screenshot → Revoke → Review → Report if necessary.
THE BOTTOM LINE
A loan app should not need unrestricted access to your personal life simply because you're applying for credit.
If a lending app has access to your contacts, call logs, photos or messages, check those permissions immediately.
Nigeria's current digital-lending rules specifically require lenders to confirm that their apps aren't designed to access call logs, contacts and photos/gallery.
And Nigeria's data-protection framework requires personal data to be processed fairly, transparently and only to the extent necessary for the stated purpose.
So the next time a loan app asks for access to your contacts, don't just tap Allow.