UAE banks begin phasing out OTPs visa SMS, email from tomorrow under new rule
Digital transactions to require app authentication only
DUBAI: Banks across the United Arab Emirates (UAE) will begin replacing one-time passwords (OTPs) sent via SMS or email with app-based verification from Friday, July 25, 2025.
The move is part of a phased rollout directed by the Central Bank of the UAE (CBUAE) and applies to all types of domestic and international digital transactions.
The transition marks a significant shift in digital banking security, as OTPs delivered via SMS and email have long been vulnerable to cyberattacks such as phishing and SIM-swapping. Going forward, customers will be required to authorise transactions using their bank’s mobile application via in-app confirmation features.
Transition timeline
According to official notices highlighted by Emarat Al Youm and CBUAE spokespersons, the full phase-out of OTPs sent via SMS and email will be completed by March 31, 2026. During this period, banks will gradually disable the older methods and encourage users to shift to app authentication.
As part of the new security protocol, customers must install their bank’s official app, enable push notifications, and activate the “Authentication via App” function to continue making digital payments and fund transfers without disruption.
Improved security
The initiative is part of the UAE’s broader efforts to modernise its financial infrastructure and enhance consumer protection against cyberthreats. Banks are alerting customers to ensure their devices are app-ready and charged, especially during travel or major online purchases.
This change affects not just retail purchases and utility payments, but also includes QR-code-based dining payments, online shopping during peak sales seasons, and cross-border fund transfers.
Bank reminders
While the rollout starts July 25, some customers may temporarily continue receiving OTPs via SMS or email during the transition phase. However, banks emphasise that all users will eventually need to shift to in-app authentication to complete digital transactions securely.
Financial institutions have already begun notifying users to update their apps and become familiar with the app-based approval system, signalling a full move away from OTPs over the next 20 months.