What should I do if a platform asks for my UPI PIN?

Stop. The platform is either fraudulent or compromised. Close the session, do not enter any details, and report to the desk.

How do I verify a platform's RNG certificate?

Cross-check the certificate number against the issuing lab's public registry (iTech Labs, GLI, BMM Testlabs).

What if my KYC is rejected without explanation?

Ask the platform for the rejection reason in writing; if it does not respond within 48 hours, escalate to its regulator.

Rummy Safety Primer: KYC, RNG, Payment Security & Controls

Editorial photograph of a ledger open to a security and verification checklist beside a passport

KYC — what a real verification step looks like

Editorial photograph of a PAN card and an Aadhaar card laid out on a wood desk, soft natural light

KYC stands for "Know Your Customer" — the regulator-required verification of identity and bank account before real-cash play. A standard KYC step combines three checks: a Permanent Account Number (PAN) verification, an address proof, and a bank account verification.

The PAN verification matches your name to the Income Tax Department's records. The address proof is usually Aadhaar (pre-filled via DigiLocker is the cleanest option), Voter ID, driving licence, or a recent utility bill. The bank account verification is typically a UPI handle linked to a savings account, or a penny-drop test for IMPS and net-banking.

What KYC is not: it is not a request for your card PIN, your OTP, or a screenshot of your bank balance. If a platform asks for any of those, stop. The legitimate KYC step only requires the document image and the bank handle.

RNG — how deck shuffle transparency works

Editorial photograph of a sealed deck of cards beside a magnifying glass, soft daylight

An RNG (Random Number Generator) is the cryptographic system that decides the order of cards in every online rummy deal. The certification comes from an independent testing lab — commonly iTech Labs, Gaming Laboratories International (GLI), or BMM Testlabs. The lab audits the RNG's seed entropy, distribution uniformity, and unpredictability over millions of simulated deals.

A platform that publishes a current RNG certificate from one of those labs earns the bonus signal. A platform that publishes no certificate, or that relies on an in-house audit with no independent review, scores lower in the safety ledger.

RNG certification is not a one-time event. The certificate expires (typically every twelve months) and the platform is expected to re-certify. The safety ledger tracks the certificate expiry date.

Payment rail security

Editorial photograph of a UPI payment confirmation on a phone screen beside a brass pen

UPI (Unified Payments Interface) is the default rail for Indian rummy readers. A platform that supports UPI deposit and withdrawal routes through an RBI-recognised payment aggregator. The aggregator holds the PCI-DSS certification; the platform holds the merchant agreement.

The security layer for UPI is the customer's UPI PIN. The platform never sees the PIN; it only sees the transaction ID and the success / failure status. A platform that asks for the UPI PIN or the OTP has crossed into fraud territory — close the session.

For non-UPI rails (IMPS, NEFT, cards), the security layer is the bank's two-factor authentication. The platform initiates the request; the bank confirms the customer; the platform receives the success notification. Disputes flow through the bank's chargeback process.

Responsible-play controls every operator owes you

A licensed operator publishes a controls directory before the first deposit. The directory lists the deposit cap, the session timeout, the reality check interval, the self-exclusion window, and the helpline. The directory is the contract; if the platform makes a change without notice, that is a safety flag.

The four controls the desk requires:

Deposit cap — set before the first deposit and adjustable at any time. The cap should be a daily, weekly, and monthly limit, not a single value.
Session timeout — automatic logout after a fixed idle window. Defaults vary; the platform should publish its own.
Reality check — a periodic interrupt showing session time and net position. Required in most regulated jurisdictions.
Self-exclusion — a temporary or permanent block on the account. The minimum exclusion window is six months in most regulatory frameworks.

Helplines and support resources

If you are worried about your own play or someone else's, the Indian helpline network is the right first call. iCall (9152987821) and the Vandrevala Foundation (1860-2662-345) are the two most widely cited helplines for gambling-related support in India. The Responsible Play page on this desk links to both.

Safety questions, answered

What should I do if a platform asks for my UPI PIN?
Stop. The platform is either fraudulent or compromised. Close the session, do not enter any details, and report the platform to the desk via the corrections page.
How do I verify a platform's RNG certificate?
The certificate is usually linked from the platform's footer or its responsible-play page. Cross-check the certificate number against the issuing lab's public registry (iTech Labs, GLI, BMM Testlabs).
What if my KYC is rejected without explanation?
Ask the platform for the rejection reason in writing. If the platform does not respond within 48 hours, escalate to its regulator (MeitY for online skill games, or the relevant state authority for offline rooms).
Can I delete my account after a self-exclusion?
Yes. The delete account page walks through the closure request and the data-retention timeline.
Where can I read more about Indian gambling law?
The is it legal page walks through the Public Gambling Act, 1867, the state-by-state variations, and the skill-vs-chance framework.