Who Pays When You Are Scammed? Understanding the UAE’s New OTP Fraud Protection Rules

Online banking has made financial transactions faster and more convenient than ever before. Unfortunately, it has also created new opportunities for fraudsters, particularly through scams involving one-time passwords (OTPs).

Recognising the growing risks associated with SMS-based authentication, the UAE Central Bank has recently clarified the responsibilities of licensed financial institutions where customers fall victim to certain types of OTP fraud in the UAE.

For banking customers across the UAE, the clarification represents an important development in consumer protection. However, it should not be misunderstood as a guarantee that every victim of financial fraud will automatically receive reimbursement.

Understanding the scope of these protections is essential for both consumers and financial institutions.

What Has Changed?

According to the Central Bank's clarification, licensed financial institutions are expected to provide stronger protection against fraud by adopting more secure authentication methods, including biometric verification and secure authentication through official banking applications.

Importantly, where a customer becomes the victim of fraud solely as a result of an SMS one-time password (OTP), the financial institution may be required to reimburse the customer after verifying the validity of the complaint.

The clarification reflects the increasing recognition that SMS-based authentication has become vulnerable to sophisticated phishing attacks, SIM-swap fraud and other forms of cybercrime.

Does Every Fraud Victim Receive Compensation?

No.

One of the most important aspects of the Central Bank's clarification is that it does not create an automatic right to reimbursement for every banking fraud.

Instead, reimbursement depends on the specific circumstances of the incident.

Among other considerations, financial institutions are expected to verify that:

• the fraud involved SMS OTP authentication;
• the complaint is genuine;
• the transaction falls within the applicable framework established by the Central Bank; and
• the relevant conditions for reimbursement have been satisfied.

Each case will therefore require an individual assessment.

Why SMS OTPs Are Becoming Less Reliable

For many years, SMS one-time passwords were considered an effective security measure for online banking.

However, cybercriminals have developed increasingly sophisticated methods to intercept or manipulate these authentication processes.

Common techniques include:

• phishing messages designed to trick customers into revealing OTPs;
• fraudulent websites that imitate legitimate banking platforms;
• social engineering attacks;
• SIM-swap fraud; and
• malware capable of compromising mobile devices.

As these threats continue to evolve, financial regulators worldwide are encouraging stronger forms of customer authentication.

Stronger Authentication Is Becoming the New Standard

The Central Bank has indicated that licensed financial institutions should increasingly rely on more secure verification methods, including:

• biometric authentication such as fingerprint recognition;
• facial recognition;
• secure authentication through official banking applications; and
• encrypted customer verification technologies.

These methods are generally considered significantly more resistant to fraud than traditional SMS-based authentication.

For customers, this transition represents an additional layer of protection against increasingly sophisticated cybercriminals.

What Should Customers Do If They Become Victims of Fraud?

Speed is critical.

Anyone who believes they have become the victim of banking fraud should immediately:

• contact their bank or financial institution;
• request that affected cards or accounts be frozen where appropriate;
• report the suspicious transaction;
• preserve all relevant messages, emails and screenshots;
• cooperate fully with the bank's investigation; and
• consider reporting the incident to the relevant UAE authorities where necessary.

Prompt reporting may significantly improve the chances of limiting financial losses and assisting any subsequent investigation.

What Does This Mean for Banks?

The clarification reinforces the responsibility of licensed financial institutions to continually strengthen cybersecurity measures and customer authentication procedures.

It also reflects a broader regulatory shift towards balancing technological innovation with enhanced consumer protection.

Banks are increasingly expected not only to provide secure digital services but also to implement authentication systems capable of addressing evolving cyber threats.

Why This Matters

Financial fraud continues to evolve at an extraordinary pace.

As criminals adopt increasingly sophisticated techniques, regulators must continually adapt consumer protection measures to maintain confidence in digital banking.

The UAE's latest clarification demonstrates an ongoing commitment to strengthening customer protection while encouraging financial institutions to adopt more secure authentication technologies.

Although customers should remain vigilant and continue exercising caution when conducting online banking transactions, the evolving regulatory framework provides additional reassurance that licensed institutions also have an important role to play in preventing and responding to fraud.

Conclusion

The UAE Central Bank's clarification marks another significant step in the evolution of digital banking security.

While it does not guarantee reimbursement in every case of financial fraud, it reinforces important protections for customers affected by certain SMS OTP-related scams and encourages the adoption of stronger authentication methods across the banking sector.

For consumers, the message is clear: remain vigilant, report suspected fraud immediately and understand your rights. For financial institutions, the development underscores the continuing importance of investing in robust cybersecurity and authentication systems capable of keeping pace with an increasingly sophisticated threat landscape.

Al Kabban & Associates

For businesses seeking guidance, Al Kabban & Associates, with over 30 years of experience in UAE law and recognition by Legal 500, stands ready to help corporations build resilience against legal risks while ensuring compliance with local and international standards. For more information or to schedule a consultation, contact us at +971 4 453 9090 or visit www.alkabban.com. You can also follow us on social media for more updates on everything law related in the UAE: @Alkabban_Law

ALSO READ -

Abu Dhabi Strengthens Its Fight Against Human Trafficking with a Specialised Court

Can a Private WhatsApp Message Become a Criminal Offence in the UAE?

UAE Sets Social Media Age Limit at 15: What the New Rules Mean for Parents, Children and Platforms