WHO SOLD YOUR PHONE NUMBER TO THE LOAN COMPANIES? Poonawalla Fincorp’s ‘Pre-Approved’ Loan Pitch Raises Alarming Questions About Data Brokers, Customer Privacy and Unsolicited Marketing

Who gave a financial company your mobile number? Who told it that you might be interested in borrowing money? Who authorised it to send you a WhatsApp message, SMS or email advertising a loan you never requested? And, most importantly, who decided that your personal information could become a commercial opportunity for somebody else?

These questions go to the heart of a growing concern surrounding digital lending: the invisible journey of consumer data through marketing databases, loan-comparison platforms, referral networks, telemarketing agencies and financial-service providers.

For a person receiving an unsolicited loan offer, the experience can be unsettling. A message arrives claiming that a personal loan has been pre-approved. The recipient wonders how the sender knows their telephone number and why the company believes they need credit. They follow the link, enter details or are asked to submit documents, only to discover that the promised loan is conditional, unavailable or unsuccessful.

The consumer is left with questions. The marketing system has already achieved its immediate objective: the recipient has engaged with the offer.

A reported incident involving a woman identified as Jasmine Arora raises these concerns in connection with a WhatsApp message purportedly from Poonawalla Fincorp. According to the account available, the message represented that a personal loan had been pre-approved, but the subsequent application page stated that it could not process the application and that the status would remain unchanged for 30 days.

The original message, sender and destination website have not been independently authenticated. It has not been established that Poonawalla Fincorp sent the communication, that any particular organisation sold Jasmine’s information, or that her credit score was damaged.

But the larger question cannot be brushed aside: when an individual receives a targeted financial solicitation without knowingly requesting it, what is the source of the information, what consent supports its use, and who is accountable for the entire journey of that data?

It is a question that deserves answers from lenders, digital intermediaries, lead-generation businesses, marketing agencies and anyone who earns money by turning personal information into a commercial lead.

The first question is not about the loan. It is about the phone number.

A mobile number does not ordinarily reveal the full financial life of its owner. But when linked with a name, email address, location, employment information or an existing financial relationship, it can become a valuable identifier in a commercial database.

For lenders and customer-acquisition businesses, contact information can be used to identify prospective borrowers, distribute marketing communications and encourage consumers to begin applications.

There is nothing inherently unlawful about every form of lead generation. A consumer may willingly request loan comparisons, subscribe to product information or agree to receive offers from specified partners. A lender may also contact its existing customers within the scope of applicable consent and regulatory requirements.

The problem begins when the individual cannot establish where the information came from, what permission was given, which entities received it or how it came to be used for a purpose the person did not expect.

A recipient who asks, “How did you get my number?” should not be met with an impenetrable maze of intermediaries and generic privacy disclaimers.

The source should be identifiable. The relevant consent should be demonstrable. The intended use should be explainable.

Without those answers, the consumer is effectively being asked to trust a data supply chain that remains invisible to them.

Who supplies customer data to loan companies?

The answer cannot responsibly be reduced to a single accusation that all lenders buy data illegally. There are several possible routes through which contact information enters a marketing system, and each has to be examined separately.

First, lead-generation and loan-comparison platforms. A person visiting a financial comparison website may enter a mobile number and other information to compare products. Depending on the disclosures and permissions involved, some information may be processed or shared with participating lenders or service providers. Whether the individual consented to the particular communication and use is a separate question.

Second, referral partners and marketing intermediaries. A business may collect prospective-customer details and pass qualified leads to a financial institution under a commercial arrangement. Such an arrangement does not automatically authorise every kind of data use or unsolicited communication. The scope of the consent, the purpose of collection and the terms of the arrangement matter.

Third, applications and previous customer interactions. Information may already be held by a financial institution or another service provider following an earlier application, enquiry or transaction. The continued use of that information for marketing must be assessed against the permission obtained and the applicable rules.

Fourth, promotional forms, mobile applications and co-branded financial services. A consumer may provide details while registering for another service, requesting an offer or participating in a promotion. Whether the disclosure permits a particular lender to contact that person cannot be assumed merely because the information was collected somewhere within a commercial ecosystem.

Fifth, unauthorised databases and information leaks. Personal information may also circulate through improperly disclosed records, compromised systems or unauthorised resale. Such a route would raise materially different questions from consented lead generation. However, no evidence presently establishes that Jasmine Arora’s number came from a leaked database or an unlawful data seller.

The investigative task is to identify which, if any, of these routes explains the reported communication.

Who collected the number? Who transferred it? Was money paid for the lead? Was a referral fee involved? What did the recipient agree to? Which records document that consent? And did the subsequent communication remain within its permitted scope?

Until those questions are answered, claims that Poonawalla Fincorp bought Jasmine’s data—or that a named intermediary sold it—would go beyond the evidence.

That is not a reason to stop the investigation. It is the reason to conduct it properly.

Poonawalla Fincorp’s own website identifies a digital-sourcing network

There is a concrete starting point for this inquiry.

Poonawalla Fincorp’s publicly available digital-partnership information identifies personal-loan sourcing through its own platform and lists Paytm, MobiKwik, Paisabazaar and SuperMoney among its digital lending channels and partners.

The company also provides a link to a list of lead-referral partners.

These disclosures establish that the company uses a digital-sourcing and referral ecosystem. They do not establish that any named partner sold customer information without permission, supplied Jasmine’s number or sent the WhatsApp message in question.

Nevertheless, the existence of this network makes one set of questions unavoidable.

When a company obtains prospective borrowers through multiple channels, can it trace the source of each lead? Can it identify the organisation that collected the underlying information? Does it maintain records of the consent supporting subsequent contact? Can it distinguish a legitimately acquired lead from an unauthorised list?

And when a customer complains that a message was unsolicited, does the company investigate the original source—or simply direct the individual to block the number?

A lender cannot meaningfully answer a complaint about its customer-acquisition process without examining the intermediaries involved.

The Reserve Bank of India’s Digital Lending Directions, 2025 require regulated lenders to conduct due diligence on lending service providers, periodically review their conduct and ensure compliance with the applicable requirements. The directions also state that outsourcing arrangements do not absolve the regulated entity of its statutory and regulatory responsibilities for the acts and omissions of its lending service providers.

In other words, the existence of an intermediary is not, by itself, an answer to a complaint.

If an authorised lending service provider is responsible for an activity covered by those directions, the regulated lender cannot simply pretend that the use of an outsourced channel removes its responsibilities.

The relevant contractual arrangements, lead-source records and compliance reviews should provide a basis for determining who did what.

The company’s own application terms raise further questions about marketing consent

A review of Poonawalla Fincorp’s publicly accessible online personal-loan offer page reveals another relevant detail.

The page asks applicants for information including their name, mobile number, email address, date of birth, PAN, monthly income and address.

Its published terms state that, by proceeding, applicants authorise the company and its representatives to contact them through phone calls, SMS, WhatsApp or other modes of communication. The terms also refer to enquiries with credit bureaus and other entities for verification.

Further, the terms include consent to sharing a person’s name, mobile number, email address, PAN and other information with the company, its group companies, agents and representatives for information about products, offers and services.

These are significant disclosures because they show the kinds of information the company’s online loan application seeks and the scope of communication and sharing described in its published terms.

But an essential distinction must be maintained.

A person’s agreement to terms while submitting a loan application does not, by itself, establish that the person consented to an earlier unsolicited WhatsApp message. Nor does the wording of an application page establish that Jasmine Arora accessed that page, agreed to its terms or authorised anyone to contact her.

The original communication and its history must be examined separately.

The distinction matters because consent should not become a retrospective explanation for how an organisation obtained a person’s details before that person reached the relevant application.

The company should therefore be asked to identify the source of the number involved in the reported incident and provide the records supporting any claim that the recipient had agreed to receive the message.

If the message was sent by an impostor, that should be established through the sender details, destination URL and other evidence. Poonawalla Fincorp itself warns customers about impostors using its name without authorisation, making authentication particularly important.

If the message was sent by the company or an authorised intermediary, the relevant consent and sourcing records become central to the inquiry.

Either outcome calls for evidence.

The privacy question: when did a person’s information become a marketing asset?

India’s Supreme Court recognised the right to privacy as a fundamental right in its landmark 2017 judgment in K.S. Puttaswamy (Retd.) v. Union of India.

Privacy is not an absolute prohibition on collecting or using personal information. Financial institutions can process data for legitimate purposes, including applications, identity verification, lending decisions and servicing, subject to applicable law and regulatory requirements.

But neither is a person’s information available for unrestricted commercial use simply because it exists in a database.

The central questions are purpose, authority, necessity, transparency and accountability.

A consumer may provide information to complete one transaction without expecting it to be circulated across an unlimited network of businesses. A person who submits a mobile number for one purpose should not have to assume that it can be used for every possible financial offer.

Where data has passed through multiple entities, the consumer’s difficulty becomes even greater. The original collector may be one business, the intermediary another, the marketing sender a third and the actual lender a fourth.

Which organisation must answer the customer? Which one holds the consent record? Which one supplied the number? Which one must correct the information if it was obtained or used improperly?

If all the organisations point towards one another, privacy rights become a formality on paper while the consumer is left to investigate the data trail alone.

That is the unacceptable accountability gap the digital-lending industry must confront.

RBI’s digital-lending rules already address consent and third-party data sharing

The issue is not merely philosophical. The RBI’s Digital Lending Directions, 2025 contain specific safeguards for digital lending activities by regulated entities, including NBFCs.

The directions require data collected through digital lending applications operated by lenders or their lending service providers to be need-based and supported by prior, explicit consent with an auditable trail. They require the purpose of consent to be disclosed at each stage of the customer interface.

They also provide that borrowers must be able to give or deny consent for specific data uses, restrict third-party disclosures and, where applicable, revoke consent and request deletion of information.

Explicit consent is required before personal information is shared with a third party, except where disclosure is required by law or regulation. The directions further address data-retention restrictions, privacy policies and the continuing responsibility of regulated entities for customer-data privacy and security.

The exact application of those provisions depends on the facts, including the role of the entity involved and whether the activity falls within the relevant digital-lending framework.

But where a communication or lead-collection process forms part of the regulated digital-lending activity, a lender should be able to demonstrate that its systems and contracted intermediaries comply with the applicable requirements.

The regulator’s emphasis on prior consent and an auditable trail is particularly important. It points towards a practical standard: a company should be able to show what consent was obtained, when it was obtained, for what purpose and how the resulting information was used.

A vague assertion that a contact list was obtained through a partner is not an adequate substitute for those records.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 form another part of India’s developing privacy framework. Their substantive provisions are subject to a phased commencement schedule, with major data-processing provisions scheduled to commence 18 months after the November 2025 notification. As of October 2026, those core provisions are not all in force.

That timing matters. The legal position should not be overstated by suggesting that every provision of the new data-protection framework is already fully operative. The RBI’s digital-lending requirements and the applicable telecom rules, however, provide existing standards relevant to the questions raised here.

Unsolicited SMS: TRAI requires more than a marketing department’s enthusiasm

The rules governing commercial SMS communications provide another important line of inquiry.

The Telecom Regulatory Authority of India’s framework for unsolicited commercial communications requires relevant senders to meet registration, header, content-template and consent requirements for bulk communications. The framework distinguishes promotional communications without the recipient’s explicit consent from communications that qualify under applicable rules.

Consumers can manage commercial communication preferences and report qualifying unsolicited communications through the relevant mechanisms, including their telecom service provider and the 1909 complaint channel.

In February 2026, TRAI reported that its enforcement activity during 2025 had included more than 731,000 notices to unregistered telemarketers and restrictions affecting hundreds of thousands of entities. This illustrates the scale of the broader unsolicited-communications problem, although those figures do not identify Poonawalla Fincorp or establish a violation in Jasmine Arora’s case.

For the present investigation, the key issue is whether the message was sent through a channel covered by the applicable requirements and whether the sender can demonstrate the necessary authorisation and consent.

WhatsApp and email communications require separate assessment. The telecom framework governing bulk SMS and calls should not automatically be treated as applying identically to every WhatsApp message or email.

Yet the underlying question remains the same: what permitted the sender to use the person’s information for that communication?

It is not enough for a financial company to ask consumers to block numbers after unwanted messages have already arrived. The source and authority for the communication must be capable of scrutiny.

What if the number came from a third-party lead seller?

Suppose an intermediary collected a consumer’s details on a comparison website, a promotional form or another application. Suppose the consumer then began receiving financial offers from businesses they did not recall approaching.

The next questions would be whether the relevant disclosures authorised the transfer, whether the permission covered marketing by the particular sender, whether it was recorded properly and whether the information was used within the disclosed purpose.

Now consider a different possibility: an organisation obtained the contact details through an unauthorised database or information leak.

That would present a different factual and legal question, requiring evidence of how the information was acquired and used.

And suppose a third-party marketing company sent an offer while using a financial institution’s name without authorisation. In that scenario, the lender’s identity may have been misused, and the sender would need to be identified.

These are materially different scenarios. They cannot all be labelled the same kind of misconduct, and none can be attributed to the reported Jasmine Arora incident without supporting evidence.

But they share one investigative requirement: the data trail must be reconstructed.

A credible inquiry should seek records from the original collector, the relevant lead-generation or referral partner, the sender of the communication and the lender whose name appeared in the message. If money changed hands for the lead, the contractual and payment records would help establish the nature of that arrangement.

Only after those records have been reviewed can an investigator responsibly determine whether the data was collected with permission, shared within the disclosed purpose, transferred improperly or obtained through impersonation.

The question “Who sold my data?” is therefore not rhetorical. It is a request to identify the parties and records that can explain how the information reached the sender.

The reported failure after the pre-approved offer needs its own investigation

The privacy issue should not obscure the separate problem raised by the reported application outcome.

Jasmine Arora’s account describes a WhatsApp message claiming that a personal loan was pre-approved, followed by an application page stating that the application could not be processed and that the status would remain unchanged for 30 days.

A preliminary loan offer can remain conditional, and a lender may legitimately need additional information before deciding whether to sanction a loan. The request for documents therefore does not, on its own, establish deception.

However, the original communication should be compared with the actual process that followed.

Was the message describing final approval or only preliminary eligibility? Was the status restriction explained? Was a credit-bureau enquiry conducted? Did the applicant knowingly authorise that enquiry? Were the purposes of collecting the requested information disclosed?

Poonawalla Fincorp’s online application terms refer to credit-bureau enquiries and communication permissions, but those terms do not establish what occurred in Jasmine’s case.

Her credit report and the application records would be necessary to determine whether an enquiry took place and whether it affected her score. A single enquiry does not automatically result in a measurable score reduction; the actual effect must be established from the available credit records.

Similarly, no evidence presently establishes that the rejected applicant was subsequently offered a higher-interest loan as a result of the original application.

If such an offer was made, the sender, quoted interest rate, annual percentage rate and relationship with the original parties should be examined. It would also be necessary to determine whether any data transfer was authorised.

The proper investigation follows the documents. It does not substitute suspicion for proof.

The wider customer-complaint record makes accountability more important

The questions surrounding the alleged message also arise against a broader backdrop of customer grievances disclosed by the company.

Poonawalla Fincorp’s FY 2025–26 annual report recorded 19,871 customer complaints, compared with 2,901 in FY 2024–25. Among the categories reported for FY 2025–26 were 1,818 CIBIL-related complaints and 1,513 complaints concerning bureau updation involving an alliance partner.

These figures do not establish that the complaints were substantiated, that they involved unsolicited marketing or that they were connected with Jasmine Arora’s reported experience. They should not be used as proof of a data-selling scheme.

They do, however, make the quality of customer-service controls, credit-information processes and oversight of intermediaries relevant subjects for examination.

The company’s regulatory history also includes an RBI penalty of ₹10 lakh announced in August 2024 in relation to interest charged from dates before loan disbursement, contrary to terms communicated to customers. That action concerned a different compliance issue and was not a finding about data privacy or the reported WhatsApp message.

The significance of these disclosures is not that they establish the current allegation. It is that a financial institution operating at scale must be able to explain its systems, substantiate its representations and address customer grievances with verifiable records.

Privacy and responsible marketing should be subject to the same expectation.

The questions that Poonawalla Fincorp and its intermediaries must answer

The reported incident calls for a direct, evidence-based response.

Who sent the WhatsApp message to Jasmine Arora, and what evidence establishes the sender’s identity?

How was her telephone number obtained? Was it collected directly, through a prior application, by a referral partner, through a lead-generation platform or from another source?

If a third party supplied the information, which organisation was responsible for collecting it, what disclosures were made to the consumer and what record of consent supports its transfer and use?

Was any payment or referral fee associated with the lead? If so, what contractual arrangement governed the transaction, and what safeguards applied to customer information?

Did the recipient consent to receive commercial communications before the original WhatsApp message was sent? If the sender relies on consent captured through a later application, what evidence connects that permission to the earlier communication?

What personal information was collected during the application, who received it and what happened to it after the application could not be processed? Was the applicant’s credit report accessed, and can the company identify the corresponding enquiry record?

If the message was unauthorised and used Poonawalla Fincorp’s identity, what steps were taken to identify the sender and protect the affected consumer?

Finally, what systems does the company use to trace lead sources, audit digital partners, review consent records and investigate allegations of unsolicited marketing?

These questions are specific and answerable. They do not presume that the company or any named intermediary acted improperly. They identify what must be established to determine responsibility.

The right to privacy cannot depend on whether a company finds your number commercially useful

The central concern is larger than a single WhatsApp message.

A person’s information may move through several organisations before a message reaches their phone. Some transfers may be legitimate and supported by consent. Others may exceed the permission originally given. Still others may involve unauthorised acquisition or impersonation.

The consumer usually sees none of that history.

They see only the final message: a loan offer they did not request, sometimes carrying the reassuring language of pre-approval. They are then expected to decide whether to trust the sender, click the link, enter their details or submit identity documents.

That arrangement places an obvious burden on the person least equipped to understand the underlying data supply chain.

Financial institutions and their service providers should be able to do better. They should be able to identify their acquisition channels, demonstrate consent, explain the purpose of data collection and establish who is permitted to receive the information.

The question is not whether companies can advertise financial products. They can, within applicable rules. Nor is every unsolicited message proof that a database was stolen or sold illegally.

The question is whether the person’s information reached the sender through a permitted and demonstrable process—and whether the recipient has a meaningful way to challenge its use.

The uncomfortable question for Poonawalla Fincorp is not simply why a woman reportedly received a failed pre-approved loan offer. It is whether the company can establish how the number reached the sender, what consent supported the communication and what happened to the information afterwards.

If the message was an impostor’s work, the identity of that impostor needs to be established. If an authorised intermediary sent it, the relevant consent and sourcing records should be examined. If the communication originated with the company, it should explain the basis for the outreach and the steps taken to ensure that the applicant’s information was handled appropriately.

What cannot be accepted as a satisfactory answer is a system in which a consumer is expected to trust the message, surrender personal details and then investigate the source of the marketing themselves.

A mobile number is not an open invitation to a financial sales network. A person’s PAN is not a universal marketing pass. And a click on a later application form should not be treated as proof that every earlier communication was authorised.

Until the source of the reported message and the consent underlying it are established, the case remains an unresolved allegation—not proof of a data-selling scam. But the questions it raises are serious, specific and firmly within the public interest.

The basic demand is simple: identify the source, produce the consent trail, explain the use of the information and establish who is accountable.

Anything less leaves the consumer facing the same question that should never have been difficult to answer in the first place:

Who gave you my number, and what gave you permission to use it?