Mexican Loan Apps, Extortion, and the Google Play Store

Audio of this conversation is available via your favorite podcast service.

In recent months, press reports have emerged about individuals in multiple countries falling victim to extortion and fraud schemes enabled by often highly rated lending apps downloaded from Google’s Play Store.

Last year, a Reuters investigation by Rina Chandran found dozens of lending apps in India that appeared to violate Google's policies against short-term loans. Chandran told the story of a housekeeper named Bhumana Prasad who was locked into a cycle of debt after taking an instant loan for 3,000 rupees- just $41- to help pay his rent. Receiving as many as 1,000 threatening calls a day, he contemplated suicide.

For the publication Rest of World, Erika Lilian Contreras wrote about these apps in Mexico, including SolPeso, Rápikrédito, Super Peso, LoanLaLa, Money Flash, and iFectivo. Contreras told the story of one woman who fell victim to these schemes named Maria. After Maria took a loan, agents for the app iFectivo sent her 13-year-old daughter, her cousin, her nieces, and more than a dozen of her other contacts a picture of a nude woman with her face photoshopped on. iFectivo told her contacts she had become a prostitute to pay her debts.

And last week, Diana Baptista and Avi Asher-Schapiro, journalists at the Thomson Reuters Foundation, told the story of how a man fell prey to another app operating in Mexico called José Cash, which was also available in the Play Store.

To learn more about this phenomenon and Google’s role in it, I spoke to Baptista about the story late last week.

Below is a lightly edited transcript of the discussion.

Justin Hendrix:

So before we launch into this specific investigation that you've done on these, lending apps, I'd love to know just a little more about your reporting. What is your beat? What do you typically report on?

Diana Baptista:

Well, for around 10 years, I've been reporting on crime in Mexico and human rights. And now at the Thomson Reuters Foundation, I'm reporting on the three basis that we report on, that is tech, climate change and inclusive economies. And this story is sort of a combination of everything like crime, cost of living and tech.

Justin Hendrix:

For this investigation, you take us inside what you call the Wild West of lending apps in Mexico, how they're used. And before we talk about the specifics, I'm wondering if you can kind of set the scene for any of my listeners who haven't been there, or aren't aware. What's the economic or social context in which the story plays out?

Diana Baptista:

Sure. Well, while we are going here in Mexico for a bit of an economic crisis since the pandemic, a lot of people have lost their jobs. And it's important to mention that half the population here in Mexico are working in the informal economy and therefore do not have access to banks or any sort of traditional banking institution.

And in Mexico, it's very common to lend money. We have these sort of lending methods that you can find anywhere within your own company even, among friends, among strangers. And now loan apps that are very dangerous, very suspicious. And it's a tough time economically speaking right now in Mexico. And one thing we do have a lot of access to is Internet. You know, practically the entire population has the smartphone.

But unfortunately there is not enough digital culture or financial culture, which allows people to fall into frauds and extortions very easily. We are not used to reading privacy policies. You know, nobody teaches you about this. We have no idea of what somebody needs to do to be able to legally lend money to somebody else. There's practically no financial culture in that.

And you know, this is the context in which criminals thrive because of all the ignorance around this subject.

Justin Hendrix:

Tell us the story of Pedro Figueroa.

Diana Baptista:

Yes. So Pedro, a 34 year old man who works in IT. In March, he was having some trouble paying his bills and he needed like some very small amount of extra cash to pay his bills. And he didn't have access to traditional banking institutions. He had tried out a couple of lending apps, lending services that are provided by fintech companies properly established here in Mexico. And he thought, "Okay, well, I'm just going to go into the Google Play Store, see what else is available."

And he comes across José Cash, you know, this app that is promising in five minutes to approve a loan without checking your credit score, which is fantastic. Because they don't know that you have debt. You're going to get the money without any problem, without any obstacle. And he's drawn into that.

And he sees in the Google Play Store that the app is very well reviewed. The app has like 4.8 out of five stars. The reviews are all saying, "This is a very good app. The app helped me a lot. It's very quick." And he thinks, "This app has a million downloads, it must be legit. And it's in a Google Play Store and it has a good rating. Like why would the Google Play Store lie?"

And he decides to download it. And the moment you download this apps, that's where everything goes down because immediately after downloading the app, you get a notification with terms of service saying that the app will have access to a lot of your private information on your phone. And it's practically everything on your phone. Your pictures, your messages, your social media accounts, your contacts, everything, your calls. And he doesn't really understand what it means or how the information is going to be used because the terms of service are not clear.

And he just says "Yes," and immediately without even getting the loan, the app already has access to all of his private information. And he's unaware of everything that's going to happen the minute he allows the app to have access to his phone.

And as promised, the app in five minutes they requested intimate information from him. And in five minutes, the app said, "You have an approval for three different kind of loans."

You know, he was asking for 10,000 passes, which is around $500. And the app said, "You can pay it in 30 and 60 or in 90 days." And he was super excited, but he didn't notice the fine print, which said, "You actually have to pay this in seven days." And so he clicks, yes.

And besides all the private information the app already had access to through his phone, he gave the app even more information like bank account, where he worked, the contact of his bosses, his family, a picture of him next to his national ID. So this app has access to everything about his life. And he's completely unaware of what's going to happen because he wants the money. And the app said, "Yes, you'll get it."

But then he discovers, like the first bad thing to happen to him is that he doesn't get 10,000 pesos. He gets half of it because the other half is a commission he didn't see, that is immediately discounted from the amount you get a loan off. And you don't even get to choose. It's immediate, it's discounted from what the app was loaning him. And unfortunately he had to pay the 10,000 back. And then he didn't read that the app has a 300% interest in seven days. And by the sixth day, well, he was completely unaware of course, that it wasn't going to be a 30 day loan. It was going to be a seven day loan. By day six, he starts getting messages on his WhatsApp. In Mexico, we only use WhatsApp and that's the way we communicate here.

And he starts getting messages from these people working from the app saying, "You have to pay tomorrow." And he starts getting harassed. Like you have to pay the 10,000 tomorrow plus interest. And he's like, "What? But I had 30 days." And they tell him, "No, you have to do it. Now you have to do it now." And of course he didn't have the money, because it was six days. How was he supposed to get it?

And he starts getting these intimidations like, "Hey, we're going to tell all your contacts, you're a thief. You're stealing from us. You need to pay us." And he starts getting harassed. And this app, this call center is, what they do is they tell you if you don't have the money, "It's okay. We can lend you more money. So you can pay us from there."

And that's like a vicious circle, because you never end up paying anything. And so he gets more money from the app and seven days later, he starts getting harassed again. And in a matter of a month, he had this massive debt of around 60,000 pesos, which was a lot, considering he was only requesting 10,000. And he's desperate. He needs to download other apps to lend him money, to pay José Cash.

And that's where the harassment starts increasing in tone. He starts getting this very, very graphic images of dismembered bodies. You know, real images probably taken from those websites that have pictures from drug dealers and the terrible things they do here in Mexico.

So he's being sent this true, these real pictures. And of course any Mexican will immediately get very scared, very intimidating, thinking that organized crime is behind something. You don't want to be their target. You start fearing for your life. They have your address. They have information on your children, your wife, he's very scared.

He fears they will come to his house and kill his children. He's completely terrified. Friends of his start getting these horrible videos, graphic videos of minors getting raped and these criminals telling him, "This is what's going to happen to your friends. This is what's going to happen to your family. You need to pay all the money."

This poor man is completely desperate. He doesn't trust Mexican authorities, because usually we don't trust authorities here in Mexico. He doesn't dare to go to the police. He's afraid he's going to die and everybody's going to die. And another method of intimidation is they start Photoshopping the picture he sent with his ID. They start Photoshopping his picture into posters saying. like. "he's a pedophile. He raped a minor. He's wanted by the police."

And they start sending that poster to all his friends, you know? And he's completely ashamed. He's embarrassed. All his friends are reaching out saying, "Hey, what's happening? What did you do?" And he has to call family and friends personally to say, "No, this is an extortion. I'm in the middle of a fraud." Anyway, he's completely desperate. He starts thinking about suicide because now he's in a problem with 20 apps. He told me 27 apps lent him money and he was being harassed by 27 apps.

And he said that at one moment, he spent entire weeks just answering messages on WhatsApp and begging them not to send those edited pictures to his friends and not to harm his family. I mean, it was a very difficult situation for him. And that lasted until mid May, all this harassment and intimidation.

Justin Hendrix:

What broke the cycle for Pedro?

Diana Baptista:

It's very interesting. So there's no trust in authorities. So he resorts to social media and he finds in Facebook, a lot of Facebook groups of victims with thousands of victims, sharing the same story. Many sharing a story against this app, José Cash. And he says like, "I'm being harassed. I'm being intimidated." And some other victims tell him, "Oh, the same that's happening to you has happened to us. And we know how to help you."

And this is a method he described to me. It even has a name after one of the victims. It's called the Russo method. And this method is that they buy burner phones and they start communicating with the call centers through burner phones and downloading these apps on those phones that are empty or have false information. And therefore your contact list is fake. Your pictures are fake and they have no real information against you.

And at some point the call centers realize they cannot get any money out of him and they stop harassing him. And he says he still owes money. And the interest is still going up, but they're not harassing him anymore because they didn't have information on him anymore. And it's something as simple as he stopped answering the phone. And at some point he realized, "Okay, they're really not going to come after me. They're really not going to come kill my children. They were just intimidating me."

And he was very afraid and it was very real, but the moment he stopped answering the phone that stopped. And you know, that was June, he paid off... He asked fur a loan between his family and friends. They lent him money to pay off like a big chunk of the debt he had.

But now the debt is still mounting and he's like, "I just won't answer the phone anymore." And that really stopped everything for him.

Justin Hendrix:

So you found that there were as many as 29 apps in the Google Play Store, offering these loans in Mexico. What does Google have to say about this?

Diana Baptista:

Yes. So at the beginning of the year, this collective that helps victims of crime here in Mexico released a statement saying that there were 130 apps that they had received reports on from victims saying that these apps were extorting them. And they reported these apps to the police. And also earlier this year, many police departments around the country were warning people not to download loan apps because something suspicious was going on.

And then we looked at that list and we looked for this apps on the Google Play Store. And we found out that from that those 130 apps that were reported to the police, 29 were still online. Some of them with different names, but the same unique Google App ID and the same privacy policies and everything.

So we found that 29 were still there. We found 44 apps in total in the Google Play Store that are available for download. Not all of them have been reported to the police, but all of them had terrible... They had the same, if not very similar privacy policies. Like copy and pasted and you could see they had not been written by a lawyer or anybody who knew about a Mexican privacy law. And 29 of them had been reported to the police.

And we actually sent this list to Google and they said they couldn't comment on any app specifically or individually, but they did say that they were looking through it, that they considered it a serious issue. And they had already removed or had investigated dozens of these apps and that they would continue the investigation. But they refused to comment on why, for example, José Cash is still on the Google Play Store under a different name and still swindling people?

And there are many reports against José Cash specifically. And there was no explanation on why this app would still be available when it's a fact that it's extorting and defrauding people.

Justin Hendrix:

So according to your article a spokesperson for Google issued a statement saying, "We take this issue very seriously and are committed to providing a secure platform for billions of Android users. We have already implemented measures against more than a dozen apps and will continue to investigate." But it's also the case that your colleague in India has found similar practices there?

Diana Baptista:

Yes, Reuters' investigation found identical practices in India. Google changed its own policies so these loan apps wouldn't be able to upload their apps if they violated these policies. However, after publishing this article, we've received comments from people in Pakistan and India saying, "Hey, this is still going on. And it's exactly the same method."

And you know, it leads us to wonder what is happening that Google cannot remove this in time. And we actually consulted several experts on this. One point that we were wondering about was why do these apps have such high ratings and they have thousands of positive reviews that you know are fake because they're really worded in a weird Spanish. In a way, no Mexican really speaks and they are all similar.

I mean, you can tell they are either fabricated or done by a robot or something. And we were wondering, why does Google allow this? And we were told by experts that Google has no real responsibility to make sure that the ratings or the reviews are accurate. And in fact, Google has no responsibility over these apps at all.

There's a problem with accountability because there is no way to make Google responsible for what's happening. We were also wondering why do these apps all have the same privacy policies that are against Mexican law? They are all running the same way and they all violate the same Mexican privacy laws and experts again told us, "Well, the platform is so big. How is Google going to check every single privacy policy that these developers upload to their platform?"

So in the end, it's a real issue with authorities, Mexican authorities, how are they regulating this? And the answer is there is, no regulation for loan apps. They are free to do whatever they want because in Mexican law, any institution can lend anybody money without being officially registered as a banking institution.

So this leaves victims in a place where they have nowhere to go. The consumer regulator here in Mexico cannot help you out because these institutions do not exist. And when you go to report them, the regulator says, "Well, it's out of my jurisdiction."

And all you can do is go to the police. But you know, people do not trust the police here. So we can only assume it is wildly under-reported. And the only answer would be for Google to have some sort of policies or to check the policies or to check that these apps are not being involved with extortion and fraud.

However, it's not happening yet. There is no lobbying here in Mexico to make the platforms check the apps that are being uploaded to their platforms. And there is no movement to regulate this either. So people are pretty much helpless in this situation.

Justin Hendrix:

Your story mentions also that similar practices have been discovered in Kenya, in the Philippines. You've just mentioned now, other countries where evidence has come forward as a result of this investigation. Has there been any other response to your report? Has there been any, either government activities, civil society activity, there in Mexico or other evidence that's come forward?

Diana Baptista:

Not yet. However, this is one of many articles that are being published on this subject right now in Mexico. It is a huge situation. Even the president commented on it like a month ago. And he was made aware that this is happening and he called the population not to download this apps. And he said, "They are probably connected to organized crime. And that they're going to, the federal secretary for security is personally going to look into this." But response has been very slow. Again, because there is no regulation.

And we were asking some experts like, "Okay, there's no regulation, but how can the police investigate these apps?" And this was very shocking. They told us that Google has no names, no addresses, no real information on who is behind these apps. So there's no way to track them in that sense.

And the only way to track who is behind this would be through the call centers that are behind the extortion and the fraud, and who are harassing you through WhatsApp. However, it's a whole deal what's happening in call centers. We have information that they recruit young men without any access to any other jobs. Not criminals, just people without job opportunities. And they're being drawn into this call centers with hundreds of clients or users, let's say that they need to harass every day.

And it's a moment in which police in every state in Mexico is investigating these call centers, trying to figure out where they are, where the money is coming from and bringing them down. But this is something that is happening as we speak. There is still no accountability for what's going on here.

Justin Hendrix:

Are you aware of what kind of operation or business operation Google has in Mexico?

Diana Baptista:

They responded from here from Mexico and I am aware there is a Google office here in Mexico City. We did notice that many of the apps that have been reported to the police were actually removed by Google, but they pop back again with different names. But you can realize it's the same app because it leads to the same website with the same privacy policy and the same context like the same email.

And it's really a matter of how much can Google do if these apps just keep popping up every time they're removed? It seems like a never ending cycle. And we also noticed that some maps that had been removed and didn't come back to the Google Play Store, had their own websites, and you could download the Android package directly from their webpage. And the way they promote this is with people standing outside the subway.

You know that the subway is usually very crowded and they're with pamphlets saying, "Hey, enter our website and download our loan app from our website." So they don't have to go to any platform because they're getting removed. So the criminals are actually finding ways to have people download their apps, even if they're not available on the Google Play Store.

So it's really complicated, I believe, because even if Google might be obviously trying to control this, it might not be enough.

Justin Hendrix:

That's a fascinating detail about individuals promoting it at the subway. It does suggest that it's a fairly substantial local operation. You mentioned in the story that this one civil society group has documented more than 2000 cases of this type of fraud. Have there been any actual physical altercations, or have any of the physical threats materialized?

Diana Baptista:

Yes. It has all been digital harassment. They didn't have any story or any case in which the threat had actually come true. However, they did notice that, for example, in some cases the people didn't even get a loan. It was just the moment the app was downloaded into your phone and had access to all your private information, then they had access to information to extort people, right?

And Salvador Guerrero, who was the man who from this collective who gave me the interview, he mentioned that people are being forced to give money to criminals. To make deposits through convenience stores that we have in every corner here in Mexico City. And they have to deposit every week, certain amount of money without ever getting a loan.

And that was very worrying. We also have cases of revenge porn, which actually we have regulated here in Mexico with a law called the Olympia Law, which forbids revenge porn. And they take your personal pictures and they are posting them online.

So they were creating very real damage, even though they weren't killing anybody. And even leading to some cases of people wanting to commit suicide or actually committing suicide.

Justin Hendrix:

I should mention that Pedro's a pseudonym. You haven't identified him in this story for his own safety, but how is Pedro?

Diana Baptista:

Well, it's actually a fascinating story with Pedro. So by mid-May when he paid off part of his loan and he stopped answering the phone, he felt very empowered. He realized he actually had the power to fight these people back. And so he made this YouTube persona called Mr. Cabron, which is he wears this Luchador mask and he has a TikTok and YouTube accounts. And all he does is troll these call centers with burner phones.

And it's hilarious because call centers, the people in call centers, call to harass him and he starts trolling them. And he starts flirting with them. He's like, "How can I hook up with somebody in a call center?" He's having so much fun doing this, but also he has like millions of views from people who are reaching out saying, "Hey, I need your help. You got out of this. How can you help me get out of this as well?"

And he's teaching people the Russo method. He actually told me and he was like, "Maybe I shouldn't tell you this. There are some people who are getting burner phones and downloading the apps and getting the loans, and then not paying back." They're scamming the scammers. And at some point, some of these apps didn't even have money anymore for their false operations, which he found very funny. I found it very funny as well.

So he's finding ways to get it back at them and to empower other victims. And to let them know. He told me like, "At some point you're so into this harassment and this fear that you do not realize it's not real in a way. You can just stop answering the phone and they go away. But they get in your head. And because we have all this fear around organized crime, it works very well for them. But the moment you let go of the fear, then you can start either scamming them or having fun with them."

And so now he has this public persona and he's helping people as well. He told me he felt very proud of what's happening. That perhaps all this happened for a reason and that he was glad he could be helping people now.

Justin Hendrix:

An extraordinary story, and it sounds like an extraordinary individual. What's next? What's the next story for you?

Diana Baptista:

So we want to look into call centers. That's the way we think we can follow the money, find out who is behind these operations. And so we're going to start investigating the people who are working in these call centers. We want to know how do they get recruited? What's the operation like? Who teaches them to do this extortion? Who's editing the pictures and sending them to people? And we want to understand the economic and social context in which these call centers are thriving, because we understand that these are people that are not criminals. They're not part of organized crime, but there is no other possibility for jobs. So this is all they can do.

Justin Hendrix:

Thank you so much for speaking to me today.

Diana Baptista:

Thank you so much, Justin.