Why mobile-OTP login wins lab A/B tests
Login method affect drop-off, repeat visit rate, and account-takeover risk. We ran a 12-week A/B on four login surfaces and published the data.
The PlayExch login flow is built around a single 10-digit Indian mobile number. We deliberately rejected the email-password combination because our A/B test (n=42,000 returning readers) showed a 38% higher one-tap-success rate with mobile OTP. The numbers don't lie: email passwords get forgotten, recovery emails land in spam, and most users end up creating a second account. Mobile numbers stay with the user for life.
From the lab perspective, login is a measurement problem. Every failed OTP is a contest-entry blocked, a contest entry that funds another platform instead. We measure login success across three dimensions — first-attempt success, post-OTP bounce, and post-redirect depth — and they all correlate with contest entry volume. A 1% drop in login success costs the platform thousands of contest entries per week. That is why the login surface is the most-tested screen in the entire app.
Google sign-in is offered as a secondary path, not the primary. The reason is account consistency: most readers who use Google sign-in end up reading their first contest from a different account than the one they used to deposit ₹100 last month. That fragmentation makes our cohort analysis noisier and our captain-pick hit-rate attribution less reliable. We do not engineer for our convenience at the reader's expense, but mobile OTP gives the cleanest dataset to publish lab reports on.
Returning readers who switch phones use the 'Lost access?' link below the OTP screen. The recovery flow sends the OTP to a registered alternate number if one exists, otherwise it triggers customer-care verification with PAN or Aadhaar (last six digits). Full PAN verification is required above the ₹10,000 withdrawal threshold — there's a dedicated sub-section on that process in our Wallet & KYC page.
Two-step login: OTP then app launch
The exact login path is two screens, eleven seconds, one OTP field. We walk through both screens below.
Enter mobile number
The first screen asks for a 10-digit Indian mobile number. No country code, no leading zero. The input is set to numeric mode and auto-fills with the SIM card's primary number on most devices.
Receive SMS OTP
Tap the orange 'Send OTP' button. The OTP arrives via SMS on a verified sender within 4-7 seconds. Standard OTPs are 6 digits and expire after 10 minutes. Re-send is gated to one per 30 seconds to avoid spam.
Auto-verify and enter
On most Android devices, the OTP screen reads incoming SMS automatically. iOS users type the 6 digits manually. Either way, the app verifies in the background and lands on the home tab.
Last-active context
Returning readers pick up where they left off — the previous contest, the previous captain-pick matrix, or the lab report they bookmarked. We do not force the home screen every login.
Set PIN for fast re-entry
Optional 4-digit PIN unlocks the app for 14 days without re-OTP. The PIN is stored locally, hashed with bcrypt, and never transmitted. Customer care cannot read your PIN.
The post-login screen is the most personalized page in the entire app. New users land on a welcome card with three lab calls-to-action — read this week's captain matrix, browse contests, deposit & claim bonus. Returning users land on whichever screen they last viewed: my contests, my squads, or a saved lab report. We measure bounce from the post-login screen weekly and tune accordingly.
Account security & what we log
Every login attempt leaves a timestamped record. Lab readers see their own login history in the Security tab. We publish exactly what we log and why.
| Event | We log | We don't log |
|---|---|---|
| Successful login | Mobile hash (last 4), timestamp, device model, IP city | OTP value, full number in clear text |
| Failed OTP | Phone hash (last 4), timestamp, attempt count | The OTP the user typed |
| PIN unlock | Device ID, timestamp | The PIN value (bcrypt-hashed locally) |
| New device login | Device model, IP city, app version | Background apps, contacts, photos |
| Session timeout | Last activity timestamp | Any contest entry during the session |
The OTP value itself never leaves the SMS gateway. Our server sees only the verification result — yes or no. The bcrypt-local-PIN pattern means even our database engineers cannot read your PIN: only the device that created the PIN can verify it. If you forget the PIN, the recovery path is a fresh mobile OTP, not a backdoor.
Common login failure modes
The four failures we see most often in customer-care tickets. Each has a one-paragraph fix documented here for transparency.
OTP not arriving
Switch between mobile networks (Jio, Airtel, Vi, BSNL). The SMS gateway is gateway-of-record; failures usually trace to a specific carrier-route. Re-send works in 89% of cases within 60 seconds.
Wrong mobile number
The login is one account per mobile. If you have a previous account on a different number, our system will create a new one — never link them silently. Customer-care can merge two accounts with PAN proof.
Account locked
Five consecutive OTP failures lock the account for 30 minutes. This is fraud control. After the lock window, OTP retries restart at zero attempts. Customer-care cannot unlock early.
App still logged in (can't log out)
On Android, use Settings > Apps > PlayExch > Storage > Clear Data to wipe the local session. On iOS, uninstall reinstall. Customer-care does not have a remote-logout tool by design.
Frequently asked questions
Common questions our research desk fields about this page.
I don't remember which mobile number I used.
The signup confirmation SMS is the canonical record. Search your SMS history for 'FCL welcome' or look in your email for the signup confirmation if you used Google sign-in. Customer-care can also recover the registered number with PAN + Date of Birth verification, but only above the ₹10,000 withdrawal threshold.
Can I have two accounts on the same phone?
One mobile number, one account. Multiple accounts are against our terms. If two people in your household want to play, each needs a different mobile number. Customer-care does not merge accounts without KYC documents on file.
What if I switched phones and lost my PIN?
Use 'Lost access?' on the OTP screen. Customer-care verifies ownership through PAN + Date of Birth. Verification takes 2-4 hours during business hours. The 14-day PIN is a convenience, not a security boundary — mobile-OTP is always the recovery path.
The lab's deeper perspective on teams
Beyond the headline content, the lab's editorial team publishes a longer read on the underlying dynamics, the historical context, and the future direction.
Historical context
The fantasy cricket market has evolved through three phases. Phase 1 (2008-2015) was the early-adopter phase — Dream11 was the dominant operator and the captain-pick methodology was largely gut-driven. Phase 2 (2016-2022) was the data-driven phase — operators introduced live-match data feeds and projection models became more sophisticated. Phase 3 (2023-present) is the transparency phase — readers demand methodology disclosure, hit-rate auditing, and assumption-risk documentation. The lab was founded in 2023 to serve Phase 3 readers.
Underlying dynamics
The underlying dynamics of fantasy cricket are driven by three forces. The first is the ownership distribution — when ownership spikes, the differential edge compresses. The second is the venue read — venue-aware picks outperform venue-blind picks by 11 points in hit rate. The third is the form curve — recent form is a stronger predictor than career average. The lab's research covers all three forces in depth.
Future direction
The fantasy cricket market is moving toward three futures. The first is increased regulation — state gaming authorities are tightening the rules around paid contests. The second is increased transparency — readers demand methodology disclosure and hit-rate auditing. The third is increased automation — AI-driven captain picks and squad optimization are becoming mainstream. The lab is positioned for all three futures.
Lab's editorial position
The lab's editorial position is that fantasy cricket is a research-grade problem. Captain picks are not gut calls — they are data-driven decisions backed by methodology, dataset versioning, and assumption-risk documentation. The lab's editorial principles are published on the owner page. The lab's editorial standards are reviewed quarterly by the editorial board.