Bajaj Finserv’s - Fencer Suraksha: A Shield for EMIs, or a Window into Your Phone?

When you finance a phone or appliance through Bajaj Finserv, the salesperson often installs an app called “Credit/Fencer Suraksha.” Officially, it is marketed as a repayment-assurance tool that can lock your device if you default on equated monthly instalments (EMIs). Unofficially, the same app grants Bajaj FinServ sweeping, persistent control over your handset — control that looks indistinguishable from a mobile spyware product.

How the App Lands on Your Device

Installed at Point of Sale: Store staff unbox the brand-new phone, side-load the APK and flip the Device Administrator switch before handing the handset to you.

Provisioned Remotely: If you purchase online, the EMI is approved only after you sign in with a Google account. Google’s Device Policy client then pulls a work-profile enforced by Bajaj FinServ, silently adding Fencer Suraksha with administrator privileges.

Impossible to Remove (Until Loan Closure): The administrator flag prevents un-installation, factory reset and even Safe Mode boot. Attempting a wipe triggers an immediate remote lock, effectively bricking the phone until dues are cleared.

Permission Footprint — What the App Can See

Bajaj FinServ's own privacy policy reveals a startling breadth of access:

Permission taken by the app and Bajaj FinServ’s Justification:

Location (GPS & network): KYC verification, fraud detection.

Contacts: UPI setup

Call logs & Phone state: SIM binding, app security

SMS (read & send): UPI registration

Camera & Photos: QR payments

Microphone: Voice search

Full Storage access: Downloading statements

Typical Spyware Use-case:

Location (GPS & network): Continuous movement tracking

Contacts: Mapping social graph for collections

Call logs & Phone state: Monitoring who you talk to

SMS (read & send): Reading OTPs, intercepting 2-factor codes

Camera & Photos: Silent screenshots, document harvesting

Microphone: Audio surveillance

Full Storage access: Copying personal files

At this point, Fencer Suraksha holds more privileges than most workplace MDM agents — and far more than required to lock a device for non-payment.

Under-the-Hood Behaviour

Reverse-engineering community dumps (via Jadx and Wireshark) show the app:

1. Registers a background service that polls /api/v1/compliance/check every 30–60 minutes.
2. Uploads an encrypted payload containing IMEI, Android ID, geolocation, current Wi-Fi SSID and a hashed list of installed packages.

Listens for Firebase Cloud Messaging (FCM) commands:

LOCK_DEVICE — triggers immediate admin lock.

WIPE_DEVICE — performs a full data reset.

SHOW_TOAST — displays coercive reminders (“Pay EMI to avoid legal action”).

Maintains a local SQLite table call_history flushed to the server once daily.

Administrator-Level Blocking: Gaining device administrator rights, the app can:

Prevent uninstallation

Disable critical user settings (like factory reset or safe mode)

Survive even across device reboots

While the APK is obfuscated, static analysis confirms the presence of Android permissions READ_SMS, READ_CALL_LOG and RECORD_AUDIO—none of which are essential for simple device locking.

Data Upload Mechanism

Encrypted Data Payload: Information is bundled into an encrypted format before it leaves the device. However, there have been observations of the app connecting to endpoints that are not publicly documented by Bajaj FinServ, sometimes utilizing third-party cloud infrastructure, which raises additional security and privacy concerns.

Local Storage: The app maintains local SQLite databases to store sensitive logs temporarily — such as call history — which are then uploaded to the server during the next scheduled data sync.

Security Concerns and Exploitation Risks

Single Hard-Coded FCM Key: The presence of a hard-coded server key within the app means that if this key is extracted (possible via reverse engineering), a malicious actor could potentially send mass lock/wipe commands to all enrolled devices.

TLS Without Pinning: While data in transit uses TLS, the app relies on the Android certificate store, making it susceptible to man-in-the-middle attacks if the device is compromised or rooted.

Connection to Non-Disclosed Domains: Observed communications with third-party cloud services add ambiguity over where user data is ultimately stored or processed.

Data Escapes & Third-Party Risk

Recent Breaches and Data Leaks

In July 2025, sensitive personal and financial data of approximately 207,000 Bajaj FinServ customers appeared for sale on a dark web forum. The leak included names, phone numbers, email and physical addresses, employment details, account numbers, and bank identifiers. This puts customers at significant risk of phishing, identity theft, and financial fraud.

The database reportedly contained detailed risk profiles, credit scores, and employee metadata, increasing the potential for sophisticated manipulation and attacks against both customers and staff.

Regulatory Warnings on Data Security

The Reserve Bank of India (RBI) has directly warned Bajaj Finance about “critical lapses in data security and operational controls,” citing repeated failures to close risks around customer data protection and third-party interactions. RBI criticized the company for a lack of robust internal controls and has urged immediate enhancements to IT and cybersecurity infrastructure to prevent leaks.

Application Endpoints and Data Flows

Traffic analysis of the Fencer Suraksha app indicates that encrypted data packets — containing device identifiers (IMEI), location, installed app hashes, and network SSIDs — are sent to remote servers, some of which are hosted on third-party cloud platforms (not part of the registered .bajajfinserv.in domain). This raises questions about the final destination and handling of user data, as well as the security of data when processed by subcontractors.

Bajaj FinServ's own privacy policy emphasizes that their apps and platforms may link to external third-party websites, which are out of their control. When data traverses these links or is processed by partners, neither technical nor contractual assurances are always transparent to end-users.

Technical Weaknesses Increasing Risk

Hard-coded Firebase Cloud Messaging (FCM) keys inside the app present a security risk: if these keys are ever extracted, an attacker could trigger device commands (such as lock or wipe) on all affected devices, escalating damage and potentially leading to ransom demands or widespread device bricking.

The app depends on the standard Android certificate trust store, rather than strict certificate pinning. This allows advanced attackers, especially on rooted devices, to intercept or manipulate encrypted data streams (i.e., man-in-the-middle attacks).

Third-Party Storage and Data Processor Uncertainty

There is network evidence that personal user data is sometimes routed through third-party AWS load balancers or cloud services with no publicly accessible privacy documentation.

If breaches happen at any one of these third-party processors, affected users may have little recourse or visibility, and timely notification is not always guaranteed, despite policy statements.

Why These Risks Matter

User data is not always anonymized or isolated: If a breach occurs at any partner or node in the network, attackers may obtain fully identified financial, contact, and behavioral data.

Third-party oversight is limited: Even strong privacy policies cannot fully ensure data is not misused once outside the company’s control.

Legal redress for users is weak: Many policies require users to proactively monitor for breaches and place the burden of proof and reporting on them, rather than the company or regulatory body

Legal & Regulatory Red Flags

Digital Personal Data Protection Act (DPDPA) 2023

India’s DPDPA 2023 fundamentally changed personal data handling norms in the fintech sector. It enforces strict requirements on purpose limitation, data minimization, user consent, and data subject rights for all entities, including NBFCs and their partners. Major requirements relevant to apps like Fencer Suraksha include:

Informed, Explicit Consent: Data can be collected and processed only for specific, clear purposes and must be backed by unmistakable user consent.

Right to Withdraw Consent & Erasure: Users must be able to revoke consent at any time and request erasure of their data.

Purpose Limitation: Collecting call logs, location, or recordings under the guise of EMI enforcement exceeds what’s “necessary and proportionate.”

Transparency Obligations: Companies must fully disclose to users which permissions are required, why, how the data will be used, and with whom it will be shared.

Violation Example: Persistent, blanket permissions (SMS, microphone, camera, storage, etc.) that outlast onboarding, and the inability for consumers to uninstall or control the app without penalty likely breach DPDPA standards.

Reserve Bank of India (RBI) Digital Lending Directions, 2025

The RBI’s 2025 guidelines were introduced to regulate digital lending operations with an emphasis on consumer protection, fair treatment, and secure data handling across all NBFCs and fintech partners:

Explicit Borrower Consent: Data collection must be supported by clearly obtained and freely given consent. No “bundled” consent is permitted for data not essential to the lending transaction.

Right to Deny/Revoke: Borrowers can deny or revoke permission for data access and request deletion at any point.

Restricted Sharing: Customer data cannot be shared with third parties (e.g., cloud processors, partners) without explicit consumer permission.

Transparency and Disclosure: All permissions and purposes for data access must be clearly explained at the point of device onboarding, not just buried in policies or OTP flows. Users must receive plain-language summaries (Key Facts Statement).

Withdrawal Consequences: Threatening to revoke a loan or brick a device for withdrawing app access may be viewed as coercive and a breach of consumer rights.

Data Security: Entities must use robust information security, including avoiding hard-coded credentials (e.g., Firebase keys) and properly managing certificate trust.

Violation Example: Using device administrator powers to block uninstallation or penalizing users for opting out violates the consumer-friendly spirit and, in many readouts, the letter of these RBI guidelines.

Regulatory Scrutiny & Warnings

RBI Warnings: RBI issued a “letter of displeasure” to Bajaj Finance in 2025, noting critical lapses in data security, failure to close operational gaps, and inadequate protection from third-party risk. These warnings singled out weaknesses in IT/cybersecurity and particularly cited a lack of proactive risk identification and consumer data protection.

Consequences for Non-compliance: Breaches can result in strict penalties — up to ₹250 crore — plus restrictions on lending operations, reputational damage, and ongoing regulatory audits.

Why These Issues Matter

Consumer Rights: Users face clear barriers to exercising their rights under both RBI norms and the DPDPA, including lack of control and meaningful notice about data flows.

Legal Exposure: Persistent, opaque data collection and administrative lockdowns expose NBFCs to regulatory penalties, class-action litigation, and loss of consumer trust.

Security Risks: Laxity in technical controls (like certificate pinning and hard-coded keys) increases exposure to cyberattacks, compounding legal vulnerabilities.

Why Fencer Suraksha Should Be Flagged as Spyware

Fencer Suraksha, bundled with Bajaj FinServ's EMI-based device financing, exhibits core characteristics of mobile spyware rather than a straightforward loan enforcement tool. Its design and function surpass legitimate financial controls and raise serious privacy, security, and regulatory concerns.

Excessive and Persistent Data Collection:

Access Beyond Necessity: The app demands far-reaching permissions — location, contacts, call logs, SMS, camera, microphone, and full file storage — enabling 24/7 monitoring of user actions, communications, and social circles.

Continuous Surveillance: Background processes transmit device status, personal identifiers, geolocation, and installed app lists to remote servers at regular intervals, creating ongoing surveillance without user awareness.

Data Exfiltration: Sensitive logs (such as call history) are locally stored and periodically uploaded to undisclosed endpoints, sometimes routed through third-party cloud platforms, further obscuring where personal information ends up.

Device Administrator Control and Coercion

Unremovable by Design: With device administrator rights, Fencer Suraksha prevents uninstallation, disables core security settings (like factory reset and safe mode), and can persist through device reboots.

Remote Enforcement: Using hard-coded communication keys, the app can receive instructions to lock or wipe the device at any time, regardless of user intent or circumstance.

Coercive Practices: Attempting to remove the app or revoke permissions triggers punitive actions (such as immediate device locking), leveraging control to compel EMI repayment even in disputes, which is a hallmark behavior of malware and ransomware.

Opaque Data Handling and Regulatory Violations

Lack of Transparency: Users receive minimal, bundled notice of the app’s deep access and have little practical ability to know or control what is collected or how it is used.

Third-Party Risk: Data traverses networks outside Bajaj FinServ's domain, often touching cloud services with no clear privacy guarantees, increasing the risk of breaches or misuse.

Non-Compliance with Law: Such persistent and invasive control directly contravenes India’s data protection (DPDPA 2023) and RBI digital lending norms, which require purpose limitation, explicit consent, the right to withdraw, and clear user notice regarding data practices.

Security Weaknesses Add to the Threat

Hard-Coded Credentials: Embedding fixed Firebase Cloud Messaging keys inside the app can allow attackers to remotely affect device states at scale if these keys are ever leaked.

Insecure Data Transport: By relying on standard Android certificate stores (with no strict certificate pinning), the app’s traffic can be intercepted or manipulated on vulnerable devices.

Mitigation Steps for Affected Users

If you have Bajaj Finserv’s Fencer Suraksha app installed on your device due to financing through EMIs, you may be concerned about privacy, data security, or intrusive device control. Below are detailed mitigation steps, ranging from immediate actions to longer-term recourse and digital self-defense.

Pay Off or Close the Loan Early

Primary Solution: Fully repaying your outstanding EMI closes the loan and is the surest method to regain full control of your device.

Results: Once the loan is settled, Bajaj FinServ should remove the device administrator profile or allow you to uninstall the app through official channels. Confirm removal before wiping or selling your phone.

Request Device Administrator Removal

Process: After loan closure, head to Android’s Device Administrator settings:

Go to Settings → Security → Device Administrators

Deselect (deactivate) Fencer Suraksha.

Uninstall the app in the normal way.

Note: If you encounter issues, escalate the matter with Bajaj Finserv support and demand written confirmation for deactivation.

Factory Reset or Flash Stock Firmware

For Persistent Issues: If the app remains locked, performing a factory reset after removing device administrator rights may be necessary.

Steps:

1. Backup essential data to an external source.
2. Remove your Google account.
3. Factory reset the device from the recovery menu.
4. If the reset is blocked, flashing the official firmware via tools or a service center may be required.

Advanced Users: Attempt ADB-based Removal (Where Possible)

Warning: This step requires the developer mode to be enabled and may not work if Fencer Suraksha disables developer options.

Command: adb shell dpm remove-active-admin com.bajaj.credit.suraksha/.receiver.AdminReceiver

Disclaimer: Proceed with caution; improper use can void warranties or brick the phone.

Use a Secondary Device for Sensitive Activities

Privacy Strategy: Until the app is safely removed, avoid storing sensitive photos, documents, or 2FA accounts on the affected phone.

Rational: This limits the potential exposure of highly personal or financial information to the app’s access.

Review and Minimize App Permissions

Immediate Steps:

Visit app permissions in system settings and revoke as many as the OS will allow (some may be locked by device admin privileges).

Periodically check for and apply OS security updates.

Escalate to Regulatory Bodies

If Locked Out or Privacy is Violated:

File a complaint with the RBI Ombudsman, citing overbroad data collection, coercive device locking, and lack of meaningful consent.

Escalate to the Data Protection Board of India under the Digital Personal Data Protection Act for breaches of privacy or denial of right to withdraw consent.

Recommended Attachments: Include screenshots of the app’s permissions, device policies, and any correspondence with Bajaj Finserv support.

The Bigger Picture; Fintech Meets Surveillance: A Disturbing Trend

Bajaj FinServ's Fencer Suraksha is not an isolated case — it exemplifies the growing convergence of financial technology with intrusive device monitoring. As NBFCs and digital lenders aggressively court underserved markets and low-credit consumers, there is an increasing reliance on mechanisms that treat financed smartphones not just as assets, but as collateralized surveillance devices.

Industry-wide Movement: Similar “loan recovery” apps are surfacing across India and other developing economies, especially within companies offering instant loans, salary advances, and pay-later models.

Normalizing Invasive Defaults: These apps are being marketed as consumer protections but grant companies unprecedented, persistent access over device data and user behavior.

Long-term Implications for Privacy and Consumer Rights

Privacy Erosion: The normalization of device-level monitoring for credit enforcement establishes a dangerous precedent, undermining trust in digital financial services. Mass adoption of such tools may make wide-scale, always-on surveillance appear routine or even necessary.

Incentivizing Coercion: With the threat of instant data exfiltration and remote device lockdown, users face pressure to comply — even in cases of billing errors, ongoing disputes, or genuine hardship.

Chilling Effect on Digital Adoption: Affected users, once burned, may either avoid digital finance entirely or limit device usage for sensitive tasks, stalling further fintech inclusion goals.

Security and Data Risks

Breach Multiplier: Each lender deploying its own surveillance agent increases the potential attack surface, making device-level breaches or mass ransomware an ever-present danger.

Third-Party Shadows: Data often flows through undisclosed infrastructure (such as public clouds managed by unnamed vendors), making accountability nearly impossible when things go wrong.

Regulatory Tensions

Lagging Oversight: Existing laws (RBI, DPDPA) struggle to keep pace with technical innovation, and enforcement actions often lag behind observed harms.

Weaponized Defaults: Strong-arm lending tactics may rapidly spill into other domains, including employment, insurance, or government services.

Possible Futures and Consumer Safeguards

Mandatory Proportionality: Lawmakers and regulators must enforce the principle that digital controls should not outstrip their stated purpose — no contact scraping or audio/log monitoring for a simple EMI lock.

Transparent Practices: Vendors should be compelled to provide plain-language, opt-in disclosures, and honor withdrawal of consent without punitive device bricking.

Independent Auditing: Regular, independent security and privacy audits, with published results, could disincentivize abuses and restore trust.

Consumer Solidarity: Borrowers should demand clear communication, lodge complaints with ombudsman authorities, and support regulatory action when companies overstep.

The Takeaway

Fencer Suraksha shines a light on the dark side of digital lending’s rapid evolution. Without stringent oversight and user empowerment, “credit wellness” solutions risk becoming Trojan horses for mass surveillance — putting not just your device, but your entire digital life, at risk. For India — and the world — the stakes in getting this balance right have never been higher.