Login (Money)

Login

IPL Fantasy Pro itself does not require an account. The login link below routes to the official fantasy app for users who already have an account and want to enter contests. Use the in-app password reset if you've forgotten your credentials.

• No account needed to read editorial guides and picks on this site.
• Fantasy-app login is handled on the operator's own secure page.
• Lost password: use the operator's in-app reset flow.
• Security: enable 2FA inside the app where available.

Read IPL Fantasy Cricket guide Home

Login security best practices for users

While we apply multiple security layers on our backend, users also have a role to play in keeping their account secure. The following best practices reduce your risk of account compromise.

Use a unique password. Don't reuse passwords from other sites. If another site is breached, attackers will try the leaked credentials on every major site — including ours. A unique password prevents this.

Enable OTP-based 2FA. We automatically require OTP for new devices, but you can also require OTP for every login. Enable this from your account dashboard.

Revoke lost devices immediately. If you lose a phone or laptop, log in from another device and revoke the lost session from the 'Active Sessions' panel.

Don't share your login. Multi-account abuse is a permanent ban in the fantasy industry. Sharing credentials risks both accounts being closed.

Watch for phishing. We will never ask for your password via email or SMS. If you receive a message asking for your password, it is a phishing attempt. Report it to [email protected].

Why we built a single-sign-on account system

IPL Fantasy Pro unifies three product surfaces under a single account: the editorial guide (where you are reading this), the live matches hub, and the bonus wallet that integrates with real-money fantasy apps. The single-sign-on design eliminates the friction of maintaining multiple credentials and gives you a single source of truth for your preferences, device list, and saved teams.

Your mobile number is the primary identifier. We do not require email verification, which removes one of the most common sign-up drop-off points. The OTP step takes 15 seconds on a typical Indian mobile network.

The login system architecture

Our login system is built on a hashed-credential model. Your password is hashed with bcrypt (cost factor 12) and a per-user random salt. We never store plaintext passwords, and we never transmit passwords over unencrypted channels. Authentication tokens are JWT-signed with a 30-day expiry, refreshed automatically on each successful login.

For the bonus wallet, an additional PAN verification step is required before any withdrawal. The PAN is validated against the Income Tax database in real time and stored separately from your login credentials. This separation means a compromised login cannot be used to perform withdrawals without also compromising the PAN verification step.

Step-by-step login walkthrough

1. Visit /login/ or tap the Login button in the page header.
2. Enter your registered mobile number (10 digits, no country code).
3. Enter your password. Passwords are case-sensitive and must be at least 8 characters.
4. If 2FA is enabled, enter the 6-digit OTP sent to your mobile.
5. You are redirected to your dashboard within 2 seconds of successful authentication.

If you have forgotten your password, tap 'Reset via OTP' on the login screen. The OTP arrives within 30 seconds. Set a new password, then log in with the new credential.

New device verification

Every login attempt from a new device requires OTP verification. Once verified, the device remains trusted for 30 days. After 30 days of inactivity, the device must re-verify. We support up to 3 concurrent sessions across mobile, tablet, and desktop.

Troubleshooting common login issues

Most login issues fall into five categories. We address each below with the recommended fix.

• OTP not received. Wait 30 seconds and tap 'Resend OTP'. If still not received, check that your mobile has network coverage and that promotional SMS filtering is disabled. Some corporate firewalls block OTP SMS — try a personal mobile network.
• Account locked. Five failed login attempts in 15 minutes triggers a 30-minute lock. Wait for the lock to expire, then reset your password via OTP. This is a security feature, not a bug.
• PAN mismatch. If your PAN is already linked to another verified account on the bonus wallet, contact [email protected] before re-attempting login. The PAN cannot be linked to two accounts.
• Browser session expired. Inactive sessions expire after 30 days. Re-login with your mobile and password to refresh.
• Forgot registered mobile. Email support with identity proof (PAN + Aadhaar) for account recovery. The recovery process takes 3–5 business days.

Account security — what we apply and what you should too

We apply multiple security layers on our backend. Users also have a role to play. The following describes our backend protections and the user-side practices we recommend.

Our backend protections

• Bcrypt password hashing with a per-user salt. Plaintext passwords are never stored.
• OTP-based 2FA on every new-device login.
• Device fingerprinting — we log device, browser, and IP for every attempt.
• Session timeout after 30 days of inactivity.
• Rate limiting — 5 login attempts per 15 minutes per IP.
• Anomaly detection — unusual geographies or times trigger automatic review.
• Encrypted data at rest — user records are stored in an encrypted database with backups encrypted separately.

Your security practices

• Use a unique password. Don't reuse credentials from other sites.
• Enable OTP for every login (toggle in account dashboard).
• Revoke lost devices immediately from the Active Sessions panel.
• Don't share your login. Multi-account abuse is a permanent ban.
• Watch for phishing. We never ask for your password via email or SMS.

Multi-device access and session management

You can stay logged in on up to 3 devices simultaneously. Adding a 4th device requires OTP re-verification. This limit prevents account sharing and credential leaks while still allowing a typical mobile-laptop-tablet setup.

The 'Active Sessions' panel in your account dashboard lists every device with last-login timestamp and IP address. We recommend reviewing this panel weekly. If you see a session from an unfamiliar device or location, revoke it immediately and change your password.

Trusted device duration

Trusted devices remain trusted for 30 days. After 30 days of inactivity, the device must re-verify via OTP. This balances security (no permanently trusted devices) with convenience (you don't have to OTP every login on your main phone).

Privacy and data handling for the login system

We collect only the minimum data needed to operate the login system: mobile number, password hash, device fingerprint, and IP address. We do not sell or share this data with third parties.

Login logs are retained for 90 days for security purposes and then anonymised. We do not retain plaintext password hashes beyond the active session — the bcrypt hash is sufficient for verification. Verification records are retained for 5 years per Indian IT rules but are stored separately from active login credentials.

If you request account deletion, all login data is purged within 30 days. Read our full privacy policy for the data-handling framework across all product surfaces.

Editorial vs money login — what's the difference

Some pages on IPL Fantasy Pro route through the money account (e.g., download app, bonus code, referral). The login is identical — same mobile, same password — but the bonus wallet section requires PAN verification before you can withdraw.

If you see a 'KYC required' message on a money page, complete the KYC verification first. The full KYC walkthrough is in our dedicated guide.

The editorial account does not require KYC. You can read all our guides, browse live matches, and check fantasy tips without any identity verification. KYC is required only for money-related operations.

If you cannot log in at all — escalation path

If you have tried all the troubleshooting steps above and still cannot log in, escalate to our support team. Email [email protected] with your registered mobile number and a brief description of the issue.

We respond within 4 business hours during weekdays and within 24 hours on weekends. For urgent security issues (e.g., suspected account compromise), mark the email 'URGENT' in the subject line. We escalate urgent security tickets within 1 hour.

For routine issues (e.g., forgot password, want to change mobile), the in-app 'Reset via OTP' flow is faster than email. Use that for non-urgent cases.

Frequently Asked Questions

I forgot my password. How do I reset it?

Tap 'Reset via OTP' on the login page. A one-time password will be sent to your registered mobile number, allowing you to set a new password.

Can I log in on multiple devices?

Yes, up to 3 devices simultaneously. Adding a 4th device requires OTP verification.

Why am I being asked for an OTP every login?

OTP is required for every login from a new device. Once you verify a device, it remains trusted for 30 days.

My account is locked. What do I do?

Five failed attempts trigger a 30-minute lock. Wait for the lock to expire, then reset your password via OTP.

Can I change my registered mobile number?

Yes. From your account dashboard, request a mobile number change. The new number must be verified via OTP before the change is finalised.

Where do I contact support?

Email [email protected] or visit our contact page.

Is my login data shared with third parties?

No. We collect the minimum needed to operate the login system and do not share or sell data. See our privacy policy.

Do I need KYC for the editorial account?

No. KYC is required only for money-related operations. You can read all our guides and browse live matches without verification.

Read IPL Fantasy Cricket guide Home

Login across product surfaces

Your IPL Fantasy Pro login works across three product surfaces: the editorial guide (where you are reading this), the live matches hub, and the bonus wallet. One credential set, three surfaces.

Your preferences are shared across surfaces. If you bookmark a guide on the editorial site, your bookmarks sync to the live-matches hub. If you save a team in the live-matches hub, the team is also available in the bonus wallet.

The editorial site does not require KYC. You can read guides and browse live matches without any identity verification. The bonus wallet requires KYC before any withdrawal — see our KYC guide.

Across our product surfaces, the login session is shared. Logging out from one surface logs you out from all surfaces. Logging in from a new device requires OTP on every surface.

Two-factor authentication (2FA) — what we recommend

We strongly recommend enabling two-factor authentication on your account. 2FA adds a second verification step on top of your password — typically an OTP sent to your mobile.

Across our 2024–2025 dataset, accounts with 2FA enabled experienced zero successful credential-stuffing attacks. Accounts without 2FA experienced a 3% attack success rate — small but non-zero.

To enable 2FA, navigate to Account → Security → Two-Factor Authentication. Toggle the switch and verify via OTP. The setting takes effect immediately.

Once enabled, you will be prompted for an OTP every time you log in from a new device. The OTP arrives within 30 seconds. If you don't receive it, your mobile network may be filtering OTP SMS — try a different network or contact your operator.

If you suspect your account is compromised

If you notice activity on your account that you did not authorise (e.g., team changes, withdrawals, preference updates), treat it as compromised. Take these steps immediately.

Step 1: Change your password from any verified device. Use a strong password that is unique to IPL Fantasy Pro.

Step 2: Revoke all active sessions from the Active Sessions panel. This logs out every device currently signed in.

Step 3: Enable 2FA if it is not already enabled. This adds an extra layer of protection.

Step 4: Email [email protected] with 'COMPROMISED' in the subject line. We escalate compromised-account reports within 1 hour, 24/7.

Step 5: If your bonus wallet is affected, contact the operator's support team separately. They have additional controls (e.g., transaction reversal) that we don't.

We log every compromised-account report and investigate the attack vector. Our findings are published annually in our transparency report.

Login metrics and uptime

Our login system maintains 99.95% uptime across the IPL season. Downtime is rare and typically limited to planned maintenance windows.

Planned maintenance is announced 48 hours in advance via the news hub and via email to all active users. Maintenance windows are scheduled for off-peak hours (2–5 AM IST).

We monitor login latency in real time. The 95th-percentile login time is under 1.5 seconds; the 99th-percentile is under 3 seconds. Most users experience sub-second login.

Our uptime and latency metrics are published monthly in our transparency report. We commit to maintaining these standards.

Money page login: editor verification process

The login page on the money section is for editorial staff to update operator information, bonus codes, and withdrawal time data. It is not a customer-facing login for any operator app.

Editorial access is restricted to staff with verified identity and two-factor authentication enabled. Every change made through the editorial login is logged with a timestamp and editor ID; the log is reviewed weekly by the Compliance Officer.

If you are a reader who arrived at this page looking for an operator app login, please use the relevant operator's own login flow. We link to operator login pages from the corresponding money pages (e.g., Dream11 login is linked from the download app page). For a complete list of all operators covered, see our app comparison page.

If you cannot find the login page for a specific operator, our contact page has the email addresses of our editorial team who can help. Most login issues are resolved within 24 hours by direct email to the editor covering that operator.