UAE banks drop SMS OTPs and switch to biometric verification - what this means for your banking app access

Abu Dhabi: Banks in the UAE have suspended smart banking app access for customers who have not completed biometric identity verification - a process that uses facial and iris recognition to confirm the account holder’s identity - in a move to strengthen the security of digital banking services. Customers said that they were unable to access their banking apps, and a message appeared when they tried to open it, in which the bank asked them to confirm digital verification in order to continue accessing banking services. This measure follows banks’ transition away from SMS one-time passwords (OTPs) for verifying digital transactions. Banks now require customers to confirm transfers and payments directly through their smart banking apps - a change designed to enhance security by linking transaction approvals to a verified digital channel rather than a phone number. Failure to complete the digital access procedures will result in an inability to access the banking app. Customers will be prevented from using the services available, or confirming electronic transactions, until the verification requirements are met and the bank’s approved authentication method is activated. The step comes as part of efforts to enhance the security of digital banking channels and reduce the risks of electronic fraud and misuse of verification codes, especially with regard to financial transfers and transactions that require explicit consent from the account holder. The banks advised their customers to review the notifications they have already received, complete the digital login procedures through official apps and channels, and contact their bank to learn about the activation steps and the mechanism for approving electronic transactions and transfers. It is worth noting that the UAE Central Bank began, as of July 25, 2025, to implement the gradual cancellation of One-Time Passwords (OTPs), which are sent via SMS or email, and to replace them with more advanced authentication mechanisms that rely on smart applications specific to banks. This trend came in response to the increase in electronic fraud attempts targeting customers in recent years, as fraudsters, in some cases, exploited verification codes sent via text messages to access bank accounts or carry out unauthorised financial transactions. Through the new system, transactions are authenticated directly via the bank’s app, using biometric verification methods such as fingerprinting, facial recognition, or the app’s passcode, which enhances the level of protection and reduces security risks. The Central Bank confirmed at the time that this step falls within a comprehensive strategy to develop the digital infrastructure of the financial sector, raise the efficiency of electronic banking services, and enhance customer confidence in digital channels. Banks also called on their customers to update their smart apps and ensure that the ‘authentication via application’ feature is activated. This transformation has contributed to reducing financial fraud crimes related to the theft or interception of verification codes, as well as improving the user experience by providing faster and more secure verification methods, in line with best practices and global standards in the field of information security and digital financial services. The Central Bank confirmed in its disclosure that the customer should not agree to any financial transaction unless all banking details are clear, and the name of the merchant and the amount are verified.