Available in USContent
Most of the friction players experience with Tombola happens at the login screen, not inside the games. That is true of any UKGC-licensed operator: the regulator’s Licence Conditions and Codes of Practice require operators to layer identity, location and account-status checks behind every successful credential pair, and those layers occasionally get in the way. Tombola’s login flow itself is straightforward. What’s worth understanding is the verification machinery sitting behind it, and the small set of conditions under which a perfectly valid password will still not get you into your account.
Where the Login Lives: Desktop, Mobile Browser and the App
Tombola exposes the same account across three access points: the desktop website, a responsive mobile browser version of that website, and the dedicated Tombola app on iOS and Android. There is one account record per player. Credentials are interchangeable. Logging in via the app does not create a separate identity from logging in via the browser, and the deposit, bonus and self-exclusion state travels with the account, not the device.
The login button on the desktop site sits in the top-right of the homepage. On the mobile browser it is reached via the menu icon or a dedicated prompt. On the app it appears on launch, with a biometric option (Face ID, Touch ID or Android fingerprint) replacing the password after first setup. Tombola allows the device’s own password manager to autofill on browser logins; on the app the equivalent is biometric authentication.
Verification Layers Behind the Login
A correct password is the first of several gates. On any UKGC-licensed account, additional checks run silently in the background and occasionally surface as prompts. The most common one is new-device verification: a login attempt from an unfamiliar IP address, browser or geolocation triggers a one-time code by email or SMS. The check is consistent with the UKGC’s expectations on account integrity and is not a sign of a fault.
The platform also runs a session-status check. If the account is currently subject to a cool-off period, a deposit-limit pause, or a full self-exclusion, the login attempt may succeed but the gambling features will be unavailable until the relevant period expires. This is by design — the regulator requires the block to hold even when the credentials are correct.
When Login Fails: The Common Causes
Forgotten passwords are the dominant cause. Tombola’s reset flow runs through the registered email: tap Forgot password, request a reset link, follow it within the validity window. If the reset email does not arrive within a few minutes, the spam folder is the first place to check — automated gambling emails are heavily filtered by some providers. If the registered email itself is no longer accessible, the only route is customer support, who will require identity verification before changing the address on file.
Temporary lockouts happen after multiple failed password attempts. The lock is usually short and self-clears within minutes. A persistent lock typically means a security flag has been raised on the account; support is the right channel for that case rather than further password attempts.
Browser cache and cookie issues cause a smaller but stubborn subset of login failures: the form refuses to submit, or rejects credentials that are demonstrably correct. Clearing site cookies, opening an incognito window, or — on the app — uninstalling and reinstalling, resolves most of these. Two-factor codes that never arrive are usually a mobile-network or email-deliverability problem rather than an account problem.
Account Security: Biometrics, 2FA and Session Handling
Tombola enforces minimum password complexity — character mix and length — consistent with what UK banking and high-value-transaction platforms require. Reused passwords from other services are the main attack vector for any consumer account; a unique, strong password is the single most useful defensive change a player can make.
Two-factor authentication, where enabled, requires a second factor — typically a code to the registered mobile number — on top of the password. Biometric login on the app is functionally a stronger second factor because it requires physical possession of the enrolled device. Inactive sessions are logged out automatically after a set window, which matters most on shared devices.
Login Locks That Aren’t About Passwords
A small share of “I can’t log in” cases are not credential issues at all. A self-exclusion initiated through Tombola directly will lock the account for the chosen period. A GamStop self-exclusion will block access not just to Tombola but to every UKGC-licensed operator in the GamStop network. Account closures requested in writing to support take effect once verified and are not reversible by re-registering, because Tombola’s KYC checks will match the new registration to the closed account.
These locks are deliberately impossible to bypass with a password change or a new device. If you find yourself unable to log in and none of the standard fixes apply, the next question is whether the account has been excluded — voluntarily or by enforcement — rather than whether the password is wrong.
Frequently Asked Questions
Why does Tombola ask me to verify when I log in from a new device?
Tombola flags first-time devices, new IP addresses and new locations and requests a one-time code via email or SMS. This is a standard UKGC-aligned security measure for licensed gambling accounts and confirms the login is authorised by the account holder.
Can I recover a Tombola account if I no longer have access to my registered email?
Yes, but only via customer support. You will be asked to verify your identity through information held on file before the email address on the account can be changed. The standard self-service password reset cannot be used because that flow relies on the registered email.
Will Tombola let me back in if I’ve previously self-excluded?
No. Self-exclusion locks are enforced at the account level for the full duration of the exclusion period — and at the network level if the exclusion is via GamStop. No password reset or device change will override this. The block is intentional.
Is biometric login (Face ID, fingerprint) secure?
Biometric data never leaves the device. The Tombola app asks the device whether the user matches the enrolled biometric, and the device returns yes or no. The same framework is used by UK banking apps and is generally considered more secure than password-only access.
See also: the parent Tombola app review, the sign-up walkthrough. Browser-based access without installing the app is covered in the feature comparison section of the app review.