Starting January 6, UAE banks will discontinue OTPs (One-Time Passwords) for online card purchases, shifting toward mandatory payment authorization through banking mobile applications. This move, part of a phased roll-out aligned with UAE Central Bank guidelines, aims to enhance transaction security and reduce fraud risks such as OTP theft or phishing scams. While the OTP service for card transactions was initially halted last July, the complete transition is now being implemented nationwide.
Customers who prefer to retain OTP-based verification can submit a written request to their bank, but they will assume full responsibility for any financial fraud or losses that may occur. For the majority of users, completing an online payment will now involve logging into their bank’s app to review and authorize each transaction after entering their preset app password. This two-step verification—both on the merchant’s site and within the banking app—adds an additional layer of identity confirmation.
The new process requires users to approve payments via a “Payment Review” notification in their banking app before returning to the merchant site to finalize the transaction. Steps may vary slightly between banks, but the core principle remains: payments will only be processed after in-app authorization. This system is designed to ensure that only the legitimate account holder can complete online purchases, even if card details are compromised.
The shift underscores the UAE’s push toward digital banking security and smart transaction ecosystems. By moving validation entirely into authenticated banking apps, authorities and financial institutions aim to curb rising online payment fraud while providing customers with greater transparency and control over their real-time transaction activity.
