Frictionless In, Frozen Out: Auditing a Digital Lender's Controls From the Wrong Side of the Inbox

1. The Hook: Thirty-Six Minutes

In Part 1 I walked through the price of a ₹15,000, 17-day loan that was signed in someone else's name using my email address. This post is about something harder to put in a spreadsheet cell: how the lender behaves when it is told, in writing, that it has made a mistake.

Start with one timestamp comparison. The eSign certificate on the loan agreement is stamped 5:32 PM on 4 September 2026. The grievance mailbox's first reply to my message, saying I should work through their escalation matrix, is stamped 6:08 PM the same day. That is 36 minutes from signature to my first warning that the email address did not belong to the borrower.

The popular narrative about digital lenders is that they have removed friction from finance. That is true, and the data in my inbox shows exactly where the friction was removed and where it was kept.

As of the last email in my file (mid-October), roughly six weeks after that first warning, the address was still attached to the account. The company has acknowledged in writing that the loan is registered under my email ID and has apologised for the inconvenience. I will describe what I observed and let the pattern speak. I am not the borrower, I do not know the borrower, and I have left their details out of this post.

2. Pulling Back the Curtain: The Personal Logic

I treat a lender like I treat a company I might analyse. The income statement tells me about price. The control environment tells me about the quality of the business. I read the correspondence as if it were a controls audit, and five findings stood out.

2.1 Same address, two outcomes

The correspondence opens in July. On 8 July a message thanks "Satbir" for an emergency loan application and says the paperwork is needed. On 13 July the application is "on hold." I replied that day that I had applied for nothing and asked for removal. On 16 July the application was rejected after "multiple checks on multiple parameters." On 4 September a loan was sanctioned and signed with the same email address on the paperwork.

I cannot see their underwriting. Their paperwork does not say who applied in July or in September. What I can say is that an address which was attached to a rejected file, after the address's owner wrote back to say it was not theirs, was accepted again seven weeks later without any contact from me. The conclusion I draw is about controls, not about any person: a written objection from the mailbox owner did not stop the mailbox being used for the next application.

2.2 Ease of sanction

The sanction letter carries a line that stands out: "valid for 24 Hours only." Acceptance was by e-sign. The product is designed so that the gap between wanting money and receiving it is as short as possible. That design choice has an economic logic. Speed converts more applicants, and the fee on this loan was deducted upfront (₹1,770 of the ₹15,000). The lender's revenue on this contract was earned at disbursal, regardless of what came after.

The cost of an error in that system does not sit with the party that earned the fee. It sits with whoever owns the contact detail that was used.

2.3 The friction asymmetry

Here is the contrast I think matters most.

To be fair about the limits of my vantage point: the onboarding side may include checks I never saw, because I was not the applicant. My notice to the company said no email-ownership verification reached me, and I stand by what I could observe. The removal side I can describe directly, because I have it in writing. I replied that I would not hand over identity documents, that I was not alleging identity theft, and that the company's own onboarding, eSign and email-verification records could settle the question without anything from me. The next message asked for the same documents again.

2.4 The template as a business process

I parsed my merged file, which covers about 650 message blocks once quoted replies are counted. Those collapse to fewer than 80 distinct subject lines. Six subject lines account for more than half the volume. Quoted threads inflate the counts, so I treat these as indicative rather than precise. The daily rhythm is not in doubt: my file shows between four and eleven messages a day through 1 to 17 October, and far more during the peak weeks of late September.

The subject lines span three moods. There are urgent demands ("Immediate Action Required," "Final Notice"). There are cheerful promotions ("Pay Early, Save More," "Weekend Dhamaka," "Tuesday Special," a "100% Penalty Waiver"). And there are friendly nudges ("Stay on track"). A single recipient received all three tones in the same week. At least one mass mailing arrived with a template placeholder for the due date unfilled.

What this tells me is that collection at this firm runs on a schedule and a mailing list, not on case-by-case judgement. The written acknowledgements from the grievance side were human and apologetic. The automated stream continued regardless, which suggests the two systems do not talk to each other.

2.5 Pressure language

The collection messages describe field visits (up to two), contacting "the references provided during your loan application," referral to a legal department, and damage to the credit profile. The Key Fact Statement, which the borrower e-signed, lists recovery agents as "NA." The consent document does allow collection agents to contact the borrower and visit, and allows informing the employer in case of default. I am not offering a legal view on whether the messages I saw complied with any rule. My point is narrower. These threats were addressed to an address whose owner had told the company repeatedly that the debt was not theirs, and one message even offered a larger "re-loan" in the same breath.

A collection model that treats the contact list as the asset, and the people on it as interchangeable, is exposed to exactly this failure.

3. The Scalable System: The Modern Framework

I condensed the above into a tool I now apply to any consumer-finance business I look at. Think of it as a controls audit you can run from public and personal documents.

The Control Asymmetry Test

Step 1: Map the two paths. Write down every step needed to add a data point to a customer record (an email, a phone number, an address). Then write down every step needed to remove or correct one.

Step 2: Score the friction on each path. For each path I count three things: the number of proofs demanded, the elapsed time, and who has to supply the proof. A mature control environment has similar rigor in both directions. A lopsided one is cheap to enter and expensive to exit.

Step 3: Compute an asymmetry ratio. I divide the exit friction score by the entry friction score. In this case my observed entry friction from the mailbox owner's side was zero, so the ratio is undefined, which is itself the finding. When the ratio is large, I treat the firm as one whose growth metrics and its controls are pulling in different directions.

The Template Entropy Check

This one is simple enough to run on any inbox.

1. Export the messages from a sender into a single list.
2. Count the total messages and the distinct subject lines.
3. Divide distinct subjects by total messages.
4. Read ten replies to your own messages and mark each one as responsive (it answers a point you made) or scripted (it could have been written without reading your message).

A very low ratio, and a high scripted share, indicate that communication is generated by a schedule. In my file the ratio was roughly 1 in 8 and a large share of the replies to my numbered points were scripted. The same check could be applied to a company's replies to any customer and says something about how much information actually flows back into its systems.

The Disclosure-to-Behaviour Gap

The last step is a reconciliation. I put the Key Fact Statement and consent terms in one column and the observed behaviour in another. Any row where the document says one thing and the inbox shows another is a flag. In this file there were several: recovery agents listed as not engaged against collection staff copied on threats, a one-day cooling-off window against a 24-hour sanction, and two different annualised cost figures in two documents.

None of these flags is a conclusion. Each is a prompt to ask the company a question. I find that firms which answer such questions quickly and specifically are rare.

4. The Smart Investor Summary

• Friction is a design choice. A digital lender that removes it on the way in and keeps it on the way out is optimising for conversion. That is a business decision with winners and losers, and the losers can be people who never opened an account.
• Fee income is booked early, error costs land late. When revenue arrives at disbursal and the cost of misidentification falls on a third party, the incentives to spend on verification are weaker than they look.
• Scripts scale, judgement doesn't. A recovery operation run from templates will behave the same toward a defaulter and a bystander. The quality of the exception handling is what separates the two.
• Documents beat adjectives. I did not need strong language to describe this episode. A dated, merged archive and a couple of ratios did the work.

In Part 3 I plan to look at the digital-safety side: what happens to personal data when a single email address becomes a routing key in someone else's collection system.

The companies named here are welcome to respond, and I would publish a response alongside this post.