UAE Banks Phase Out SMS OTPs in Shift Toward App-Based Security

In a sweeping digital security overhaul, major banks across the United Arab Emirates have begun phasing out SMS-based One-Time Passwords (OTPs) in favor of app-based authentication systems. The transition, now underway, is part of a broader effort to enhance customer protection and reduce the growing risk of fraud.

The new system requires customers to verify transactions, logins, and updates through secure mobile banking apps rather than receiving OTPs via text messages. According to industry experts, SMS OTPs are increasingly vulnerable to cyber threats such as SIM-swap fraud, message interception, and phishing schemes.

“This shift is essential in today’s threat landscape,” said cyber risk analyst Rana Al Qassimi. “App-based authentication is encrypted end-to-end, making it significantly harder for fraudsters to hijack sensitive data.”

Leading institutions, including Emirates NBD, ADCB, and First Abu Dhabi Bank, have started notifying users through in-app messages and official emails, advising them to update or download the latest versions of their banking apps. Customers are also encouraged to verify contact information, activate biometrics, and familiarize themselves with push notification approvals that will now replace SMS codes.

For many users, the change marks a learning curve, especially for those unfamiliar with mobile-first security. Banks have launched dedicated help centers and FAQ pages to assist with onboarding.

While the move may pose temporary inconvenience, experts say it’s a necessary step toward building more resilient digital banking infrastructure. The Central Bank of the UAE has endorsed the migration as part of the country’s broader digital transformation and fintech security roadmap.

With the transition expected to be completed by the end of 2025, app-based OTPs will become the new standard for banking verification—ushering in a more secure era for UAE customers.