Major Change in UAE Banking: Goodbye SMS OTPs and Hello Biometric Authentication

If you’ve been living in the UAE, you’re probably familiar with the sound of an SMS notification containing a six-digit code. However, this familiar "ping" will soon be a thing of the past. Starting January 6, 2026, several major UAE banks will cease sending One-Time Passwords (OTPs) via text message for online card payments. This transition marks a significant shift in banking security, as mandated by the Central Bank of the UAE (CBUAE).

Why Are UAE Banks Ending SMS OTPs?

The primary motivation for this change is enhanced security. While SMS-based verification has been convenient, it operates over telecommunications networks that were never intended for high-stakes banking. This makes them vulnerable to various forms of fraud, including:

• SIM-Swapping: Criminals can trick mobile providers into transferring your number to their SIM card, gaining access to your OTPs.
• Phishing Scams: Fraudsters create counterfeit websites to deceive you into entering your OTP.
• Interception: Advanced hackers can intercept SMS messages as they travel through the air, utilizing outdated protocols.

According to industry reports, SMS-related fraud resulted in billions in global losses, with a notable rise in scams within the UAE. Consequently, the CBUAE issued Notice 2025/3057, which bans SMS and email OTPs as standalone security methods.

What Are In-App Approvals?

The future of banking in the UAE lies in "In-App Authentication." Instead of waiting for a text message and manually inputting a code, the process becomes faster and more integrated. Here’s how your next online purchase will work:

• The Trigger: You click "Pay" on a shopping site or app.
• The Notification: You’ll receive a push notification from your bank’s official mobile app.
• The Review: Tapping the notification will open the app, showing the merchant’s name and the transaction amount.
• The Approval: You confirm the transaction using biometric verification (Face ID or fingerprint) or your secure Smart Pass PIN.

This "closed-loop" system not only ensures that the person authorizing the transaction is physically holding the trusted device but also eliminates reliance on the telephone network— a significant advantage for travelers who often have trouble receiving SMS codes while roaming.

What Should Residents Do Now?

This transition is not just a technical upgrade; it affects every resident who engages in online shopping or digital banking in the UAE. Here’s how you can prepare:

• Update Your Bank’s Mobile App: Ensure you have the latest version.
• Enable Push Notifications and Biometric Login: Check the app settings for these options.
• Complete Authentication Setup: Log into your account and finalize any necessary authentication before January 6.

Why You Need to Act Now

Once SMS OTPs are phased out, you will not be able to verify online card purchases using text codes. Transactions will be declined if not verified through the bank app. This change means users of both iPhone and Android devices must ensure that their settings allow notifications from their bank app. If you haven’t transitioned to app-based authentication yet, it’s advisable to do so well ahead of the deadline to avoid any interruptions.

This is part of a broader initiative spearheaded by the Central Bank of the UAE to strengthen digital banking infrastructure. The regulators have mandated banks to phase out SMS and email OTPs by March 2026 at the latest, although many institutions have already adopted this change. The objective is to mitigate fraud risks and align with best practices as the landscape of digital fraud continues to evolve. By moving to in-app authentication featuring biometric verification and encrypted channels, banks aim to provide a more secure, convenient, and unified payment experience for their customers.