EditionRummy & Skill-Game Reader ·Vol. I, No. 01 ·Updated Aug 2026 ·Adult audience, 18+

Verification & Safety

Verification and safety, written for the player who wants to keep their money and their data.

KYC, PAN, Aadhaar, deposit and withdrawal honesty, and the basic safety stack every adult rummy reader should run before they register. Editorial guidance, not platform marketing.

Start at KYC Wallet & KYC explainer
Read time~9 minutes
CoverageKYC, deposits, withdrawals, self-exclusion

Section One

KYC: what the platform is actually asking for.

PAN at registration

Most Indian rummy platforms ask for a PAN at first deposit, because the platform is required to report winnings above a threshold to the income-tax department. PAN is mandatory for any cash table. The platform matches the name on PAN to the name on your bank account. A mismatch is the most common cause of first-withdrawal rejection.

Aadhaar at first withdrawal

Some platforms ask for Aadhaar at first withdrawal, others at registration. The honest platforms explain which one and why. The dishonest ones ask for Aadhaar after the first deposit, when the player is already committed. Read the platform’s KYC page before you register.

Name match

Match the name on PAN, the name on your bank account, and the name on the platform registration exactly. Initial mismatches between “Amit K” on the PAN and “Amit Kumar” on the bank account are the single largest cause of withdrawal delay. Use your full legal name everywhere.

A paper ID card beside a smartphone showing a KYC upload screen on a wooden desk, used as the KYC checklist figure.
Plate 21 · KYC checklist
A smartphone displaying a slow-loading rummy screen with a small loading indicator, beside a paper note with brown-ink annotations.
Plate 21a · App lag observation

Section Two

Deposits and withdrawals: the safety stack.

Deposit from your own account

Never deposit from a friend’s account or a joint account. Most platforms block withdrawals to a third-party account even when the deposit succeeded. The block is not negotiable.

Use a single UPI handle

Pick one UPI handle at registration and use it for every deposit and withdrawal. Switching UPI handles mid-session triggers a manual review that takes days.

Save every transaction reference

UPI transaction references are the only way to trace a failed credit. Keep a screenshot of every successful and failed deposit. The platform’s internal record is not the same as your record.

Read the fee schedule

Most platforms publish a withdrawal fee schedule in the wallet section. Read it before your first deposit. A 2% fee on a Points table can dwarf a winning streak.

Test the withdrawal early

Withdraw a small amount after your first session, even if you plan to deposit more. The first withdrawal is the platform’s honesty test. If it does not land inside the stated window, contact support.

Keep the platform app updated

Most lag fixes ship as silent updates. An outdated app can fail to register a withdrawal request without showing an error. Update the app before you open the wallet.

Section Three

Self-exclusion and the responsible-player stack.

Self-exclusion is the most under-used safety instrument in rummy. Every reputable Indian platform offers a self-exclusion option that locks your account for a chosen period, from 24 hours to permanent. The option is in the responsible-play section of the platform, not in the wallet section, and you have to look for it.

The two self-exclusion types

A cooling-off exclusion locks your account for 24 hours, 7 days or 30 days. You cannot log in, deposit or play during the exclusion. After the period ends, you can return. A permanent exclusion locks your account until you contact support to lift it. The platforms that offer both options and explain them clearly are the platforms worth playing on.

The honest statement

If you are reading these pages because you suspect your own play has become a problem, the editorial desk recommends you set a 30-day cooling-off exclusion immediately, on every platform you have an account with. The 30 days gives you time to read the responsible-play chapter properly and decide whether the game is something you can return to in moderation or whether it is something you should leave behind.

There is no shame in either decision. The skill of leaving a game at the right time is the same skill that wins hands at the table.

Open the responsible-play chapter Is rummy legal in your state?

Section Four

Identity protection and document storage.

Your PAN and Aadhaar are sensitive documents. The platform stores them with encryption at rest, but you can do several things on your end to limit your exposure.

Redact what you can

The platform only needs to see the full PAN number and the full Aadhaar number on the documents you upload. Do not upload images that include additional sensitive information (passport number, father’s name on Aadhaar if you do not want it stored) unless the platform specifically requires it. The PAN image you upload should show only the PAN number, name, date of birth and photograph.

Keep a local copy

Keep a copy of every document you upload, with a date stamp. If the platform’s storage is ever breached, you will have a record of what you uploaded and when. The records are useful for any subsequent identity-theft protection you may need to set up.

Never share the documents in chat

The platform’s customer-care team will never ask for a PAN or Aadhaar image in a chat. If a customer-care agent asks for one, hang up and write to the platform’s responsible-play channel. The legitimate upload paths are the in-app upload form and the secure web upload form, both of which are encrypted in transit.

Watch out for third-party impersonators

The most common source of identity compromise is a third-party impersonator that asks for PAN or Aadhaar under the pretense of “KYC verification” or “account unlocking”. The legitimate platform never asks for documents outside its own in-app upload flow.

Customer care Responsible play

Section Five

Common scams and how to avoid them.

The scams below are the ones the editorial desk has seen reported most often. None of them are unique to rummy platforms; they are industry-wide. The defenses are simple; they just require awareness.

The OTP-sharing scam

A caller pretends to be from the platform’s customer-care team and asks for your sign-in OTP. The legitimate platform’s team will never ask for the OTP. If you receive such a call, hang up and write to the platform through the in-app route.

The third-party deposit scam

A “tipster” on social media offers to deposit on your behalf using their account, promising to share the bonus. The deposit is tied to the tipster’s KYC, not yours. The withdrawal is blocked. You lose the deposit and any winnings.

The impersonator app scam

A modified APK is distributed on third-party mirrors. The modified APK looks like the real platform. After you sign in and complete KYC, the APK intercepts your SMS OTP and exfiltrates your KYC documents. The defense is to download only from the platform’s official website.

The phishing link scam

An SMS or email contains a link that looks like the platform’s URL but is a different domain. The phishing page captures your sign-in credentials. The defense is to always navigate to the platform’s URL manually rather than clicking a link in an SMS.

The bonus-clearing scam

A “tipster” offers to clear your bonus wagering requirement by playing on your behalf. The tipster uses your account, plays recklessly, and loses your deposit. The defense is to never share your sign-in credentials with anyone.

Customer care Responsible play

Safety boundaries

What the safety page actually covers, and what it does not

The safety page covers the layers of protection the reader can apply to their own account, and the layers the platform is supposed to apply on its side. The two sets of layers overlap. The reader-side layer includes password hygiene, two-factor authentication, and a deliberate choice about what personal data to share in the chat. The platform-side layer includes KYC, document storage, encryption, and withdrawal limits.

The page is built around the question the reader is most likely to forget: what happens to the document after the operator has verified it. The honest answer is that the document is retained for regulatory reasons, in a separate encrypted store, accessible only to the compliance team. The desk has checked this with the platforms it covers. The retention period varies; the access pattern does not.

Self-exclusion is the safety feature the desk treats with the most care. The reader who self-excludes is the reader who has decided that the platform is no longer healthy for them. The platform has to honour that decision without re-marketing, without sending bonus notifications, and without asking the reader to reconsider. The page describes how the two self-exclusion types work, and what to do if the platform does not honour the request.

The page also covers the red lines. A platform that asks for the reader's UPI PIN, asks for the reader's Aadhaar number as part of registration, or sends unsolicited deposit links in SMS is a platform that has crossed the red line. The page names the red lines so the reader can recognise them, and provides the responsible-play channel the reader can use when they need to escalate.

Before you sit at the next table

Rummy is a skill game. Skill games still deserve a sober frame.

The responsible-play chapter collects the verified helpline numbers, self-exclusion guidance and state-wise advisories. Read it before your first deposit, not after your first loss.

Cricplay Play Now