Dark Patterns in Fintech Apps: What India’s Rules Ban and What to Fix

By Yamm Labs · Updated October 2026 · 13 min read

A personal loan app shows an approved amount, a countdown timer and a bright orange button that says Get my money. Under the button sits a box, already ticked, that adds loan protection cover to every EMI (equated monthly instalment). The only way out is a line of grey text: No thanks, I’ll take my chances. Each of those three design choices now has a name in Indian consumer law. From January 2027, a bank or non-banking financial company (NBFC) that ships them also answers to its banking regulator.

What are dark patterns in fintech apps?

A dark pattern is an interface choice that gets a customer to do something they would not have chosen with a neutral screen in front of them. In a shopping app the cost is a stray item in the cart. In a finance app the cost is a loan taken on worse terms, an insurance premium nobody asked for, or personal data shared to get a product that was advertised as free.

The Indian definition comes from consumer law. The CCPA issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023 on 30 November 2023 under the Consumer Protection Act, 2019. The government’s own description, in a December 2023 press release, is design and choice architecture that deceives, coerces or influences consumers into choices that are not in their best interest. Such practices fall under unfair trade practices in that Act.

The guidelines name 13 patterns: false urgency, basket sneaking, confirm shaming, forced action, subscription trap, interface interference, bait and switch, drip pricing, disguised advertisements, nagging, trick wording, SaaS (software as a service) billing and rogue malware. Every one of them has a fintech version, and most of them have shipped in Indian finance apps at some point because they lift conversion on a dashboard.

Fintech is a harder case than retail for one reason. A regulated financial product already carries disclosure duties: a Key Facts Statement for a loan, a risk warning for a mutual fund, insurer approval for an insurance ad. A dark pattern usually works by getting the customer past those disclosures faster than they can read them. So the same screen can break consumer law and sector rules at once.

The table maps the CCPA’s list onto finance screens. The examples in the third column are typical composites, not findings against any named firm.

If the customer would be surprised by the charge, the screen made the choice for them.

How do dark patterns differ from persuasive design and mis-selling?

Persuasive design helps a customer reach a decision they already want to make. Dark patterns change the decision. A clear progress bar, a saved application and a one-tap KYC (know your customer) upload are persuasive design. A pre-ticked add-on, a hidden fee and a shaming decline label are dark patterns.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

The test that works in a review meeting is reversibility. Ask whether the customer, shown the same screen with every option given equal weight and every cost up front, would make the same choice. If yes, the design is persuasive. If the conversion depends on the customer not noticing something, it is a dark pattern.

Mis-selling is the nearest regulatory term, and the two overlap without being the same thing. Mis-selling is about the product: selling something unsuitable, without full information or without explicit consent. A dark pattern is about the interface used to get there. A suitable product sold through a fake countdown is still a dark pattern. An unsuitable product sold through a clean, neutral screen is still mis-selling.

RBI now handles both. Its June 2026 amendment directions on advertising, marketing and sale of financial products cover dark patterns and the prevention of mis-selling within one framework. Misleading advertising is a third neighbour: the CCPA has separate guidelines on misleading advertisements, notified on 9 June 2022, and a bait-and-switch rate can break both sets.

How do India’s dark pattern rules work, and how do the Gulf and global rules compare?

India now has two layers. Consumer law covers every business that sells to Indian consumers online. Sector regulation adds a second, stricter layer for banks, NBFCs and other entities RBI supervises. Data protection law sits under both and decides whether the consent a screen collects is valid at all.

The consumer law layer is already being enforced. On 5 June 2025 the CCPA advised all e-commerce platforms to run self-audits for dark patterns within three months and encouraged them to publish self-declarations. By November 2025, 26 e-commerce platforms had submitted declarations, according to a government release. In June 2026 the CCPA fined an edtech company ₹5 lakh and a software seller ₹1 lakh for dark patterns.

Those two orders read like a fintech checklist. In one, a donation was pre-selected at checkout and the opt-out came with emotional messaging. In the other, a renewal screen offered Renew Now against Accept Risk. The CCPA named basket sneaking, confirm shaming, forced action, interface interference and trick question, and said consent cannot be assumed through pre-selected options. Swap the donation for loan protection cover and the renewal for a card plan, and the same reasoning applies.

The sector layer arrives on 1 January 2027. On 15 June 2026 RBI issued amendment directions on advertising, marketing and sale of financial products and services for commercial banks, small finance banks, payments banks, co-operative banks, regional rural banks, NBFCs and housing finance companies. They cover dark patterns, the conduct of direct selling and direct marketing agents (DSAs and DMAs) and mis-selling. Read the final text for the exact testing and audit duties. Press coverage of it describes regular testing and audits of digital interfaces, including those run by a bank’s agents.

The data protection layer decides what counts as consent. India’s Digital Personal Data Protection Act, 2023 (DPDP Act) requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. A pre-ticked box is hard to square with that, and so is a free product that will not open until the customer shares contacts.

Sector rules then add their own screens. RBI’s Key Facts Statement rules require the lender to give the borrower the Key Facts Statement, including the annual percentage rate (APR), before the loan contract is executed. If the add-on is insurance, the insurer’s rules travel with it: under the 2024 policyholder-protection regulations of the Insurance Regulatory and Development Authority of India (IRDAI), an advertisement issued by a distribution channel needs the insurer’s written approval before it goes out.

The Gulf works through disclosure rules more than a named list. The Central Bank of the UAE’s Consumer Protection Standards apply disclosure duties to every channel, mobile apps included. They require disclosures in Arabic and English, in clear and plain language, with user-friendly font size, colour and spacing. A grey decline link in small type is hard to defend against that standard, whatever it is called.

Elsewhere the direction is the same. The EU’s Digital Services Act bars online platforms from designing interfaces that deceive or manipulate users or seriously impair their ability to make free and informed choices. In the US, the Federal Trade Commission (FTC) published a staff report on dark patterns, Bringing Dark Patterns to Light, in September 2022. India is unusual in giving businesses a public, numbered list to check screens against.

This is general guidance, not legal advice. Your compliance team decides how each rule applies to your products.

Where do you meet dark patterns in fintech journeys in practice?

They cluster at five points in a finance app: onboarding, the offer screen, checkout and add-ons, renewals and cancellation, and notifications. Audit those five and you have covered most of the risk.

Onboarding. The common pattern is forced action. A free credit score, a free portfolio tracker or a free UPI (Unified Payments Interface) rewards wallet asks for contacts, SMS or location before showing anything. The fix is to ask only for what the product needs at that step, and to ask for each permission at the moment it is used, with a working Not now option.

The offer screen. False urgency and drip pricing live here. A loan offer that expires in ten minutes, every time, is false urgency. A headline rate with the processing fee, insurance and GST (goods and services tax) revealed only at confirmation is drip pricing. The regulator-driven fix is a screen sequence: the Key Facts Statement, with the APR, appears before the accept button, and the total cost of credit shows on the offer card itself.

Checkout and add-ons. This is where basket sneaking and confirm shaming sit together. Loan protection cover, card fraud protection, extended warranties on consumer durable loans and paid credit reports get pre-ticked, and the decline label carries a warning. The fix has three parts: the box starts empty, the add-on gets its own screen with its own price, and the decline button matches the accept button in size, colour and wording.

Renewals and cancellation. Subscription traps and SaaS billing show up in premium investing plans, paid advisory tiers and card memberships. A plan that starts in one tap and ends only by email is a trap. The fix is symmetry: the customer cancels through the same channel and with the same number of steps it took to join, and gets a reminder before a trial converts to a paid mandate.

Notifications. Nagging is the quiet one. Daily prompts to switch on futures and options trading, upgrade a card or raise a credit limit wear people down. Set a frequency cap, honour a single opt-out across channels, and keep product pushes apart from service alerts. A customer who mutes promotions should still get the debit alert.

Design teams that build these rules into the brand system early find them cheaper to keep. Our brand guidelines for fintech startups covers how to write button hierarchy and disclosure placement into the guidelines, so every new screen starts compliant.

How should a regulated brand decide what goes on the add-on screen?

Take a hypothetical NBFC with a personal loan journey that bundles loan protection cover. Today the cover is pre-ticked on the final screen, the premium is folded into the EMI, and the decline label reads I’ll risk it. Marketing likes it because attachment rates are high. Compliance has started asking how many of those customers knew they bought insurance.

The decision has four parts, and each one traces to a rule. First, the box starts unticked, because the CCPA has said consent cannot be assumed through pre-selected options and the DPDP Act wants a clear affirmative action. Second, the cover moves to its own screen after the Key Facts Statement, with the premium shown in rupees and separately from the EMI, because RBI wants the cost of credit clear before the contract.

Third, the insurance copy and screen go to the insurer for written approval before launch, because a distribution channel’s insurance advertisement needs it. Fourth, both buttons get equal weight and neutral labels, Add cover and Continue without cover, because the CCPA’s 2026 orders treated fear-loaded decline wording as confirm shaming.

The attachment rate will fall. That is the point of the exercise, and it is the number marketing should be ready to explain upward. What the firm keeps is a cleaner complaint record and an add-on book that holds up when the customer reads the policy. The lesson most teams miss is that the screen sequence matters more than the copy. Rewriting labels on a pre-ticked box fixes nothing.

How do you audit a fintech app for dark patterns before 2027?

Start with an inventory, score it against the CCPA’s 13, and keep the evidence. How long a first pass takes depends on how many journeys and partner screens the app has. The steps below assume marketing, product, design and compliance each name an owner.

1. List every journey that ends in money moving or consent being given: account opening, loan, card, investment, insurance add-on, subscription, cancellation and data permissions.
2. Screenshot every screen in each journey, on Android and iOS, including the screens a DSA’s or partner’s app shows on your behalf.
3. Score each screen against the 13 patterns on a simple 0 to 2 scale: 0 for absent, 1 for borderline, 2 for present. Two reviewers score separately, then compare.
4. Check every default. Any pre-ticked box that adds cost or shares data goes straight to the fix list.
5. Walk the decline path. Count the taps to say no, cancel or opt out, and compare them with the taps to say yes.
6. Check the order of disclosures. The Key Facts Statement, fees and risk warnings appear before the accept button, not after it.
7. Fix, re-test with a handful of real customers, and record what changed, who approved it and when.
8. Repeat on a set cycle and whenever a journey changes, so the record stays current.

Keep the output in one place: the screenshots, the scores, the fix log and the sign-offs. If a regulator, an ombudsman or a consumer commission asks how a screen was approved, that file is the answer. Our compliance and creative work for banking, financial services and insurance (BFSI) brands uses the same record format, so creative and compliance read from one sheet.

What to tell your compliance team: “We have mapped every money and consent journey against the CCPA’s 13 dark patterns and scored each screen 0 to 2. All pre-ticked add-ons are now unticked and moved after the Key Facts Statement. Insurance screens have the insurer’s written approval on file. Decline and cancel paths take no more steps than accept and join. Screenshots, scores and approvals sit in one shared folder, reviewed before every release.”

What related terms should marketing and compliance teams know?

These terms come up in the same meetings. Each one has a plain meaning and a reason it changes a screen.

• Choice architecture. The way options are arranged on a screen, including order, defaults and visual weight. It matters because a dark pattern is usually a choice architecture decision before it is a copy decision.
• Explicit consent. A yes the customer gives by acting, such as ticking an empty box or tapping Agree. It matters because Indian data and consumer rules both reject consent inferred from silence or a pre-selected option.
• Key Facts Statement. A standard summary of a loan’s cost and terms, including the APR. It matters because RBI’s rules place it before the contract, which fixes where it sits in the screen sequence.
• Mis-selling. Selling a product that is unsuitable, without full information or without explicit consent. It matters because RBI’s new directions treat it alongside dark patterns, so one screen can raise both.
• Misleading advertisement. An ad that misrepresents the product or hides material facts. It matters because a bait-and-switch rate can breach the CCPA’s advertisement guidelines and its dark pattern guidelines at once.
• Sludge. Friction added to make a customer’s preferred action harder, such as a long cancellation flow. It matters because it is the mirror image of a pre-ticked box: one makes yes too easy, the other makes no too hard.

For examples of Indian fintech brands that keep screens clean and still look distinctive, see our list of India’s best fintech brands by design.

People also ask

Are dark patterns illegal in India?

The CCPA’s 2023 guidelines treat 13 named dark patterns as unfair trade practices under the Consumer Protection Act, 2019, and the CCPA has fined companies for them. Whether a specific screen breaks the law depends on the facts, so have compliance review borderline cases.

Do the CCPA dark pattern guidelines apply to banks and NBFCs?

The guidelines come from consumer law, which covers businesses selling to Indian consumers online, and RBI’s June 2026 directions add dark pattern duties for banks, NBFCs and other regulated entities. Plan for both layers to apply to the same app.

Is a pre-ticked insurance box on a loan app a dark pattern?

It is the textbook case of basket sneaking. The CCPA has said consent cannot be assumed through pre-selected options, so start the box empty and show the premium on its own screen.

When do RBI’s dark pattern rules for banks take effect?

RBI issued the amendment directions on 15 June 2026, and they come into effect on 1 January 2027. Audit journeys now, because fixes to loan and add-on flows take design, compliance and insurer approval time.