SMS OTPs are ending at UAE banks: what to do now
UAE banks are moving online payment verification away from one-time passwords sent by SMS and email and towards approval inside the bank’s own app. Central Bank of the UAE (CBUAE) guidelines require banks to shift to app-based authentication for domestic and international transactions, including online payments.
Timeline
| Date | What happens |
|---|---|
| 25 July 2025 | Banks begin phasing out SMS and email OTPs and moving customers to app-based authentication |
| Transition period | Some customers can still receive OTPs while the switch is under way |
| End of March 2026 | Target for SMS and email OTPs to be fully discontinued at licensed financial institutions |
Larger banks are generally further along, while some smaller institutions were still working through the requirements. If you still receive an OTP, treat it as a transition arrangement, not a permanent feature.
What replaces them
The bank sends a push notification, you open the app to review the transaction, confirm your identity with fingerprint, face recognition or PIN, and then approve or decline. The app shows the amount, recipient name and purpose before you approve. Emirates NBD, Mashreq, ADCB and FAB are among the banks rolling out features called “App-based Authentication” or “Smart OTP”.
Old way versus new way
| SMS or email OTP | In-app approval | |
|---|---|---|
| How you confirm | Type a code sent to your phone or inbox | Tap approve in the bank app after biometric or PIN check |
| What you see | Often just a code | Amount, recipient and purpose |
| Main weakness | Codes can be intercepted, phished or talked out of you | You must still read the screen before approving |
| Needs | Mobile signal or email access | Updated app and a data connection |
How to switch
- Update your bank’s app to the latest version.
- Open the security or authentication settings.
- Turn on biometric login.
- Turn on app-based authorisation for online payments.
- If you cannot find the option, check the bank’s website or call customer service.
Good habits with in-app approval
- Read the amount and recipient on the approval screen before you tap approve.
- Decline any approval request you did not start, then tell your bank.
- Keep your phone’s own lock screen and OS updates switched on.
- Never share a code or approve a request because a caller told you to. Banks do not ask for this.
Why the change
Text-message codes can be intercepted or talked out of customers, and the new approach is designed to cut fraud such as phishing and SIM swapping while making checkout simpler. For how the approval flow works at the checkout and what the bank’s text alerts are for, see our guide to bank app approvals and biometric logins. If money has already left your account, read how to get your money back after a UAE bank scam, and for a quick routine when a message feels wrong, see the stop, verify, act guide.
Frequently asked questions
Will I still get text alerts from my bank?
Informational alerts can continue; the change is about the codes used to approve payments.
What if I still receive an OTP?
Some customers still receive OTPs during the transition. Move to in-app approval now so you are ready when the option is withdrawn.
Does this apply to international payments?
Yes. The CBUAE guidelines cover domestic and international transactions.
Where to go next
- How biometric bank app approvals work
- UAE bank scam: how to get your money back
- Stop, verify, act: online scam safety
Related guides
