Background: An illegal loan app Holiday Loan targeting Pakistani users was published on Google Play Store on 14 January 2023. The app may appear to be a standalone operation but an extensive open source investigation reveals it is linked to multiple entities in India and Kenya with a common (and yet unknown) beneficiary in China.
As of 08 March 2023, the app has been downloaded on more than 50,000 devices. It is currently running multiple ads on Facebook, including one which misuses the logo of National Bank of Pakistan (NBP) to deceive the audience and some which show the symbol of Indian Rupee and the Indian flag; this is because the app's Facebook page was previously used to market apps targeting users in India. Historical timeline:
The Facebook page cover photo of this app ironically has not changed its original cover photo which still shows the symbol of Indian Rupee:
Ad samples below:-
The app's description shows it mentions an email address [email protected] for correspondence, which also appears on the website. A reverse lookup of this email address reveals the name of an individual Muhammad Jamil.
Facebook's transparency features reveal that the Facebook page for this app is managed by 2admins, both of whom are based in Indonesia.
The apps targeting Indian citizens included three stakeholders which are long-time registered companies in Ahmedabad, Gujarat:
(1) Novartis Fiscal Ltd, now renamed to Ricavi Finance Ltd (Ahmedabad, Gujarat).
(2) YMS Finance Pvt Ltd (Kolkata, West Bengal).
(3) Volga Commerce Pvt Ltd (Kolkata, West Bengal).
It is unclear whether these apps were in fact as fronts for these apps or their corporate identities were being misused without their knowledge.
An inspection of those apps, including cached webpages, reveals these apps have further links to a set of apps targeting Kenyan citizens, all managed by a registered company Deltech Capital Kenya which further manages Joyot Technology Ltd and Zerox Technology Company Ltd. Thanks to the LinkedIn resume of a former Kenyan employee, the common ownership of these entities was confirmed; also the fact that this employee mentioned common ownership for MyKes, AsapKash and A Pesa apps. While MyKes is removed from Play Store, its iOS app is active. AsapKash is also active while A Pesa remains removed.
In late 2022, the Office of the Data Protection Commission (ODPC) in Kenya was reportedly investigating the aforementioned apps, among others, for breaching the privacy of Kenyan citizens.
Summary
Holiday Loan is the Pakistani prong for a transnational network of loan shark apps. It is not operating with a license and is not known to be patronised by any domestic front company. Its primary IP is based in Mumbai, India while the server is based in Hong Kong SAR, China.
Apart from deceiving and trapping users, these apps aim to collect and store Personal Identifiable Information (PII).
Apps targeting Indian citizens have been removed from Play Store but continue to deceptively lure Pakistani and Kenyan citizens, particularly the former through sponsored ads on Facebook. The MyKes app on App Store is also quite popular.
Visual Summary
I have developed the mind map below that attempts to summarise key findings and observations. Right-click and zoom in the image below to examine better:
It is worth mentioning that the Securities and Exchange Commission of Pakistan has already listed this app, among others, as illegal and has requested relevant authorities such as the Pakistan Telecommunications Authority and Google. However, the app is still available on Play Store, raising concerns about harmful delays in takedown.
This report may be updated in the future if further apps linked to this particular network are uncovered.
If you appreciate the effort I put into this report, you can support me by buying me a cup of coffee. Supporters will get early (and in some cases permanently exclusive) access to future reports.