By Jackson Godwin. Cybersecurity Analyst.
The Loan App That Stole My Contacts
Disclaimer: This story is fictional but inspired by real reports of abusive and fraudulent loan applications. It is written to educate readers about mobile security, app permissions, privacy risks and financial scams.
I Needed Money Quickly
Unexpected expenses can happen to anyone.
One month, I found myself needing money before payday.
A friend suggested trying a mobile loan application.
“It only takes a few minutes,” he said.
Curious, I searched online and found dozens of loan apps promising:
- Instant approval.
- No paperwork.
- Fast transfers.
- No collateral.
One app stood out.
It had thousands of downloads and glowing reviews.
It sounded perfect.
The Application Was Surprisingly Easy
After installing the app, I entered my:
- Full name.
- Phone number.
- Email address.
- Bank details.
- National identification number.
Everything seemed normal for a financial application.
Then came another request.
It Wanted Access to My Contacts
The app displayed a permission request.
It asked to access:
- My contacts.
- Phone storage.
- SMS messages.
- Phone status.
I paused for a moment.
Why would a loan app need my contacts?
The explanation claimed the permissions were required for “identity verification and faster approval.”
Without thinking too much, I tapped Allow.
The Loan Was Approved
Within minutes, I received a notification.
My application had been approved.
The money arrived quickly.
I was impressed.
The app had done exactly what it promised.
For a few days, everything seemed fine.
Then the Problems Started
A week later, repayment reminders began arriving.
At first, they were polite.
Then they became more aggressive.
The messages warned about penalties.
The language became increasingly threatening.
Even though I intended to repay the loan, the pressure felt excessive.
My Friends Started Calling Me
One evening, my phone wouldn’t stop ringing.
A close friend asked me:
“Why is a loan company messaging me about your debt?”
I was confused.
I had never provided my friend’s phone number directly.
Then another relative called.
They had received a similar message.
Within hours, several people from my contact list told me they had been contacted.
I Suddenly Realised What Had Happened
The permission I had approved during installation finally made sense.
The app hadn’t requested access to my contacts for identity verification.
It had collected my contact list.
Now those contacts were being used to pressure me into making payments.
My private address book had become part of the company’s collection strategy.
One Tap Changed My Privacy
The app hadn’t hacked my phone.
It hadn’t bypassed Android’s security.
Instead, I had voluntarily granted it permission to access one of the most personal parts of my device.
At that moment, I realised that the real cost of the loan wasn’t just the interest.
It was my privacy.
(Continue in Part 2, where I’ll explain how abusive loan apps misuse permissions, reveal the warning signs I ignored, and show how one permission exposed not only my information but also the privacy of everyone in my contact list.)