Fake bank SMS in the UAE: OTP, app approvals, and UAE Pass scams
If a UAE bank message asks you to share an OTP, approve something in an app, update UAE Pass, confirm Emirates ID, unblock a card, or call a number inside the SMS, treat it as suspicious.
Open your bank app yourself. If the alert is real, it should appear there too.
The message may use the name of a real UAE bank. That is not enough. Check the route.
Why UAE bank scams feel believable
UAE residents are used to digital services: bank apps, UAE Pass, Emirates ID, app approvals, card alerts, and government portals.
That gives scammers familiar words to copy.
| Message says | What to check |
|---|---|
| "Your card is blocked" | Does the same alert appear inside the bank app? |
| "Approve this transaction" | Did you start the transaction yourself? |
| "Share the OTP to cancel" | Banks do not need you to read codes to a caller. |
| "Update Emirates ID" | Did the bank request this through the official app or branch? |
| "UAE Pass verification required" | Did you open UAE Pass yourself, or did a link send you there? |
| "Your account will close today" | Is the deadline trying to make you skip verification? |
The UAE Pass and Emirates ID angle
UAE Pass and Emirates ID are powerful because residents use them for real services.
News reporting on a Dubai Police warning described scammers impersonating officials and asking for UAE Pass credentials and Emirates ID details. The reported risk included SIM swap and mobile banking access.
Plain English:
If a message asks you to use UAE Pass, Emirates ID, or a bank app from a link inside the message, pause.
Open the official app yourself.
What to do before you tap or reply
- Do not tap the link.
- Do not share an OTP.
- Do not approve anything you did not start.
- Open the bank app yourself.
- Call the number on your card or official bank website.
- If UAE Pass is involved, open UAE Pass yourself, not from the SMS link.
- Save a screenshot if you need to report it.
If you already shared a code
Call the bank immediately from the official number. Say:
"I shared an OTP after a suspicious bank message."
Then change your bank password or app PIN if the bank tells you to, review recent transfers, and check whether your phone number or device was changed.
Reporting in the UAE
Reporting depends on where you live and what happened.
- Dubai residents can start with Dubai Police eCrime or the Dubai Police app/website.
- Abu Dhabi residents can start with Abu Dhabi Police Aman.
- The UAE government portal also lists cybercrime reporting resources.
- For bank fraud, contact the bank first.
Do not rely on a phone number sent inside the suspicious message.
FAQ
Do UAE banks ask for OTPs by SMS or phone?
Banks may send OTPs, but they should not ask you to read the code back to a caller or type it into a link you did not request. If the message says the OTP will "cancel" fraud, stop and call the bank through the official number.
What if the SMS uses my real bank name?
That only proves the scammer knows which bank to copy. Open the bank app yourself and check whether the same alert appears there.
Can a UAE Pass request be part of a bank scam?
Yes. UAE Pass, Emirates ID, SIM swap risk, and bank access can overlap. Treat a surprise UAE Pass approval or identity request as sensitive.
Read next
- /ae/blog/how-to-report-scam-text-uae/
- /ae/blog/uae-pass-emirates-id-scam/
- /us/blog/spear-phishing-when-scams-seem-way-too-real/
Sources
- UAE government portal, report cybercrimes online: https://u.ae/en/information-and-services/justice-safety-and-the-law/cyber-safety-and-digital-security/report-cybercrimes-online
- Dubai Police eCrime service path: https://www.dubaipolice.gov.ae/wps/portal/home/services/individualservicescontent/cybercrime
- Reporting on Dubai Police UAE Pass and Emirates ID warning: https://m.economictimes.com/magazines/panache/madhavan-shares-a-message-from-dubai-police-warning-about-scamsters-targeting-uae-pass-and-emirates-id-details/articleshow/129006318.cms
- SMS phishing systematic review: https://arxiv.org/abs/2604.11429