Cricplay account access, sign-in and password reset.

How to register, how to sign in on web and on the mobile app, how to reset a forgotten password, and what to do when KYC is still pending. The platform’s account flow, in editorial language.

Start at registration Customer care

Section One

Registering a new account.

Registration on every major Indian rummy platform follows the same five steps. The platforms differ on small details: the order of the KYC prompts, the wording on the deposit-fee disclosure, the location of the responsible-play link. The flow is the same.

Open the platform’s sign-up page or launch the mobile app. Enter your mobile number. Wait for the one-time password.
Confirm the OTP. The platform creates an account with the mobile number as the primary identifier. You can add an email address later.
Set a strong password. The strong password is one you do not use on any other service. A password manager is the cleanest way to generate and remember it.
Read the responsible-play page before you make your first deposit. The link is on the same page as the deposit form. The platforms that bury the responsible-play link are the platforms you should not register with.
Make your first deposit. The deposit triggers the KYC prompt. Complete KYC inside the first 24 hours; the platform is required to verify your identity before it can credit winnings to your account.

Use your real name everywhere

Match the name on the platform registration to the name on your PAN and on your bank account. A mismatch is the most common cause of first-withdrawal rejection. Use your full legal name; do not abbreviate or use a nickname.

Section Two

Signing in on the web.

The web sign-in is the most reliable sign-in path on any platform, because it does not depend on the mobile app staying current with the OS in your pocket. The web sign-in also gives you the most options for password reset and account recovery.

Open the platform’s official sign-in page in a desktop browser. Confirm the URL is the platform’s own domain; phishing pages impersonate rummy platforms.
Enter your registered mobile number or email and your password. If you have forgotten the password, use the “forgot password” link below the password field.
Complete the OTP step if the platform requires it. Most platforms require an OTP on every web sign-in. The OTP arrives on the registered mobile number via SMS.
Once signed in, the platform redirects you to the lobby. From here you can deposit, withdraw, sit at a table or visit the responsible-play page.

Never share your sign-in OTP with anyone, including someone claiming to be from the platform’s customer-care team. The platform’s actual team will never ask for your OTP. If you receive a call asking for it, hang up and write to the platform’s customer-care through the in-app route.

Section Three

Signing in on the mobile app.

The mobile sign-in is faster than the web sign-in if you have biometric login enabled. The platforms that support biometric login (fingerprint or face) generally let you bind it during the first sign-in. The binding is local to your device; removing the app removes the binding.

The mobile OTP sometimes fails to arrive inside the standard 30-second window. The most common cause is a delayed SMS gateway on the platform’s side, not an issue with your phone. Wait 60 seconds before requesting a resend. If the OTP still does not arrive, switch to the web sign-in.

If the app refuses to sign you in after an update, the platform may have revoked older app versions. Uninstall the app, install the latest version from the official app store, and sign in again. Do not install a third-party APK to recover access; the third-party APK is the most common source of account compromise.

If the sign-in spinner runs indefinitely, the platform’s auth service may be temporarily unavailable. Try again in 15 minutes. If the issue persists, the platform’s status page (linked from the responsible-play section) will tell you whether the auth service is down.

Section Four

Resetting your password.

The password-reset flow on every major platform uses the registered mobile number or email. The platform sends a one-time link or a one-time code; you set a new password and sign in again. The flow is straightforward and usually completes inside 5 minutes.

When to reset

Reset your password immediately if you suspect another person has access to it. Signs include: a successful sign-in notification you do not recognise, a session-active notification for a device you do not own, or a withdrawal request you did not make. The earlier you reset, the smaller the recovery surface.

After the reset

After a password reset, every active session is signed out. You will need to sign in again on every device. The platforms that support device management show you a list of active sessions in the security settings; revoke any you do not recognise.

Section Five

What to do when KYC is pending.

You can sign in and browse the lobby while KYC is pending. You cannot make a withdrawal until KYC is approved. The KYC review itself usually completes inside 24 hours on a working day; slow approvals on weekends are common.

Why KYC is pending

The most common reasons: the platform is reviewing your PAN upload manually because of image quality, the platform is verifying the name match between your PAN and your bank account, or the platform is verifying the address on your Aadhaar against the address on your bank account.

How to speed it up

Re-upload the PAN or Aadhaar image in good lighting. Make sure the document fills the frame. Make sure the name on the document matches the name on the platform registration exactly. The most common cause of a slow review is a partial image that the back-office team has to ask the player to re-upload.

When to contact customer care

If KYC has been pending for longer than 48 hours on a working day, contact the platform’s customer-care team through the in-app route. Provide your registered mobile number, the timestamp of your upload, and a screenshot of the pending status. The team can pull the upload from the queue and review it manually.

Customer care contacts Wallet & KYC explainer

Section Six

Device management, sessions, and active logins.

Every reputable Indian rummy platform shows you a list of active sessions in the security settings of the app or web client. The list includes the device name, the operating system, the city of last sign-in, and the timestamp of the most recent activity. If you see a device you do not recognise, revoke it immediately. Revoking a session signs that device out and forces a fresh sign-in the next time the device tries to connect.

How to revoke a session

Open the app or web client, sign in if you are not already.
Open the menu, then Settings, then Security, then Active Sessions.
Find the session you want to revoke. The session list shows the device and the last activity.
Tap Revoke. The device is signed out. The next time the device tries to use the account, it has to complete the OTP flow again.

Trusted devices

Most platforms let you mark a device as trusted. A trusted device skips the OTP step on subsequent sign-ins for a fixed period (commonly 30 days). Trusted devices are useful for your own phone and laptop. Mark a device as trusted only when you are confident the device is secure, the password is unique, and you control physical access to the device.

When your device is stolen

If your phone or laptop is stolen and you had marked it as trusted, sign in to the platform from a different device, open Settings, then Security, then Active Sessions, and revoke every session that does not belong to you. Then change your password. Then enable two-factor authentication on the new sign-in. The order matters: revoke first, then change the password, then enable 2FA. The sequence prevents the thief from intercepting the password-reset email or SMS.

Wallet & KYC explainer Customer care

Sign-in mechanics

Why the sign-in flow is built the way it is built

A sign-in flow looks like one screen, but the work underneath it is several layers. The reader enters a credential. The platform checks the credential against the stored hash. The platform checks the device fingerprint against the previously trusted devices. The platform issues a session token. Each layer is a chance to catch a problem, and each layer is also a chance to introduce a friction the reader did not need.

The web sign-in is the simplest. The reader enters the email and password; the platform checks; the platform issues a session; the reader lands on the lobby. The mobile sign-in adds the OTP, because the mobile session has to be bound to a phone number, and the OTP is the cheapest binding the platform can use. The trade-off is that the OTP is the layer most likely to fail on a slow network.

The password reset flow is the flow the reader rarely thinks about until they need it. The flow has to be available when the reader cannot sign in, and the flow has to be hard enough that an attacker cannot trigger it for someone else. The page describes what the flow looks like, when to use it, and what to do if the reset email does not arrive.

The sign-in safety section is the most useful for a reader who is signing in on a new device. The reader should expect a notification on a previously trusted channel when a new device signs in. If the notification does not arrive, the reader should assume the sign-in did not happen, and try again.