Why mobile-OTP login wins lab A/B tests
Login method affect drop-off, repeat visit rate, and account-takeover risk. We ran a 12-week A/B on four login surfaces and published the data.
The PlayExch login flow is built around a single 10-digit Indian mobile number. We deliberately rejected the email-password combination because our A/B test (n=42,000 returning readers) showed a 38% higher one-tap-success rate with mobile OTP. The numbers don't lie: email passwords get forgotten, recovery emails land in spam, and most users end up creating a second account. Mobile numbers stay with the user for life.
From the lab perspective, login is a measurement problem. Every failed OTP is a contest-entry blocked, a contest entry that funds another platform instead. We measure login success across three dimensions — first-attempt success, post-OTP bounce, and post-redirect depth — and they all correlate with contest entry volume. A 1% drop in login success costs the platform thousands of contest entries per week. That is why the login surface is the most-tested screen in the entire app.
Google sign-in is offered as a secondary path, not the primary. The reason is account consistency: most readers who use Google sign-in end up reading their first contest from a different account than the one they used to deposit ₹100 last month. That fragmentation makes our cohort analysis noisier and our captain-pick hit-rate attribution less reliable. We do not engineer for our convenience at the reader's expense, but mobile OTP gives the cleanest dataset to publish lab reports on.
Returning readers who switch phones use the 'Lost access?' link below the OTP screen. The recovery flow sends the OTP to a registered alternate number if one exists, otherwise it triggers customer-care verification with PAN or Aadhaar (last six digits). Full PAN verification is required above the ₹10,000 withdrawal threshold — there's a dedicated sub-section on that process in our Wallet & KYC page.
Two-step login: OTP then app launch
The exact login path is two screens, eleven seconds, one OTP field. We walk through both screens below.
Enter mobile number
The first screen asks for a 10-digit Indian mobile number. No country code, no leading zero. The input is set to numeric mode and auto-fills with the SIM card's primary number on most devices.
Receive SMS OTP
Tap the orange 'Send OTP' button. The OTP arrives via SMS on a verified sender within 4-7 seconds. Standard OTPs are 6 digits and expire after 10 minutes. Re-send is gated to one per 30 seconds to avoid spam.
Auto-verify and enter
On most Android devices, the OTP screen reads incoming SMS automatically. iOS users type the 6 digits manually. Either way, the app verifies in the background and lands on the home tab.
Last-active context
Returning readers pick up where they left off — the previous contest, the previous captain-pick matrix, or the lab report they bookmarked. We do not force the home screen every login.
Set PIN for fast re-entry
Optional 4-digit PIN unlocks the app for 14 days without re-OTP. The PIN is stored locally, hashed with bcrypt, and never transmitted. Customer care cannot read your PIN.
The post-login screen is the most personalized page in the entire app. New users land on a welcome card with three lab calls-to-action — read this week's captain matrix, browse contests, deposit & claim bonus. Returning users land on whichever screen they last viewed: my contests, my squads, or a saved lab report. We measure bounce from the post-login screen weekly and tune accordingly.
Account security & what we log
Every login attempt leaves a timestamped record. Lab readers see their own login history in the Security tab. We publish exactly what we log and why.
| Event | We log | We don't log |
|---|---|---|
| Successful login | Mobile hash (last 4), timestamp, device model, IP city | OTP value, full number in clear text |
| Failed OTP | Phone hash (last 4), timestamp, attempt count | The OTP the user typed |
| PIN unlock | Device ID, timestamp | The PIN value (bcrypt-hashed locally) |
| New device login | Device model, IP city, app version | Background apps, contacts, photos |
| Session timeout | Last activity timestamp | Any contest entry during the session |
The OTP value itself never leaves the SMS gateway. Our server sees only the verification result — yes or no. The bcrypt-local-PIN pattern means even our database engineers cannot read your PIN: only the device that created the PIN can verify it. If you forget the PIN, the recovery path is a fresh mobile OTP, not a backdoor.
Common login failure modes
The four failures we see most often in customer-care tickets. Each has a one-paragraph fix documented here for transparency.
OTP not arriving
Switch between mobile networks (Jio, Airtel, Vi, BSNL). The SMS gateway is gateway-of-record; failures usually trace to a specific carrier-route. Re-send works in 89% of cases within 60 seconds.
Wrong mobile number
The login is one account per mobile. If you have a previous account on a different number, our system will create a new one — never link them silently. Customer-care can merge two accounts with PAN proof.
Account locked
Five consecutive OTP failures lock the account for 30 minutes. This is fraud control. After the lock window, OTP retries restart at zero attempts. Customer-care cannot unlock early.
App still logged in (can't log out)
On Android, use Settings > Apps > PlayExch > Storage > Clear Data to wipe the local session. On iOS, uninstall reinstall. Customer-care does not have a remote-logout tool by design.
Frequently asked questions
Common questions our research desk fields about this page.Common questions our research desk fields about this page This is why the login test desk treats it as a baseline.
I don't remember which mobile number I used.
The signup confirmation SMS is the canonical record. Search your SMS history for 'FCL welcome' or look in your email for the signup confirmation if you used Google sign-in. Customer-care can also recover the registered number with PAN + Date of Birth verification, but only above the ₹10,000 withdrawal threshold.
Can I have two accounts on the same phone?
One mobile number, one account. Multiple accounts are against our terms. If two people in your household want to play, each needs a different mobile number. Customer-care does not merge accounts without KYC documents on file.
What if I switched phones and lost my PIN?
Use 'Lost access?' on the OTP screen. Customer-care verifies ownership through PAN + Date of Birth. Verification takes 2-4 hours during business hours. The 14-day PIN is a convenience, not a security boundary — mobile-OTP is always the recovery path.
Patterns the lab desk sees across thousands of weekly sign-ins
An honest look at the edge cases, the legacy-account migrations, and the device-trust patterns the lab tracks to keep the sign-in flow frictionless.
Peak-hour OTP latency
The lab sees a 1.4-second median OTP delivery time during off-peak hours and a 3.2-second median during peak hours (7 PM to 11 PM IST on match nights). The lab has invested in a multi-carrier OTP routing layer that picks the fastest path automatically. If the primary carrier's gateway is slow, the OTP falls back to a secondary carrier without user intervention.
Legacy email-password accounts
Accounts created before the OTP-first migration can still log in with email and password. The lab recommends migrating to OTP login — it is faster, more secure, and aligns with the lab's session-management standards. The migration takes under two minutes: enter the email, receive the OTP, and the account is OTP-first going forward.
Trusted-device drift
Trusted devices have a thirty-day trust window. After thirty days, the lab prompts for a re-verification SMS. The re-verification is a one-tap flow — the user enters the OTP and the device remains trusted for another thirty days. The lab's research shows that 12% of accounts have at least one trusted device that has gone stale — typically because the user upgraded their phone and forgot to revoke the old device.
Cross-device sign-in audit
The lab publishes an audit log that shows every device that has signed in to the account over the past ninety days. The audit log includes the device model, the browser, the IP geolocation, and the timestamp. The log is downloadable as a CSV. The audit log is a useful dataset for users who want to verify that no unauthorized access has occurred.