In March 2026, the UAE became the first country in the world to completely ban SMS OTP authentication for financial transactions. The Central Bank of the UAE (CBUAE) Notice No. 3057 gave every bank, payment provider, and e-wallet operator until 31 March 2026 to replace one-time passwords sent via text message with biometric and in-app verification. The shift is complete. If you are living in the UAE, your mobile number just became the most important digital asset you own — and choosing the right one on MobileNumber.ae is no longer just about prestige. It is about security, identity, and access to every service that matters.
More than 11 million UAE Pass users, over 15,000 government and private services, and every major bank now rely on the device linked to your mobile number for authentication. Meanwhile, Dubai Police issued fresh SIM swap fraud warnings in March 2026 after scammers exploited regional tensions to steal banking credentials. This guide explains everything that changed, what it means for your number, and how to protect yourself.
What Exactly Changed with the UAE SMS OTP Ban?
The CBUAE issued Notice No. CBUAE/FCMCP/2025/3057 in May 2025, giving the financial sector roughly 20 months to phase out SMS-based one-time passwords. The rollout happened in stages. Banks stopped sending SMS OTPs for online card payments on 6 January 2026. The absolute deadline for full compliance across all financial institutions hit on 31 March 2026.
The ban covers:
- SMS OTP: No more six-digit codes sent via text message for banking transactions
- Email OTP: One-time codes sent to email addresses are equally banned
- Static passwords: Standing alone, a username-and-password combination no longer qualifies as sufficient authentication
Every entity licensed by the CBUAE must comply — retail banks, card issuers, payment service providers, e-wallet platforms, digital banks, finance companies, exchange houses, and insurers. Non-compliance carries fines of up to AED 250,000 per violation.
| Milestone | Date | What Happened |
|---|---|---|
| CBUAE Notice 3057 issued | May 2025 | Phase-out officially mandated |
| Liability shift | July 2025 | Banks must refund any 3DS fraud involving SMS OTP |
| Early adopters live | September 2025 | Emirates NBD, ADIB, FAB, Mashreq, ADCB switch to biometric auth |
| Card payments | 6 January 2026 | SMS OTP stopped for online card transactions |
| Full compliance deadline | 31 March 2026 | All financial institutions must use biometric or in-app authentication |
Market Insider: The UAE is the first nation on earth to mandate this at a regulatory level. Other countries — including the EU with PSD2 — encouraged stronger authentication but never outright banned SMS OTP. This positions the UAE as the global leader in financial security, and it makes your UAE mobile number arguably more important than your bank card.
Why Did the UAE Central Bank Ban SMS OTP?
SMS OTPs were vulnerable to multiple attack vectors that put UAE residents at serious financial risk. The CBUAE acted after global SIM swap fraud surged by 1,000%, costing the telecommunications industry USD 6.7 billion in 2023 alone.
The core problems with SMS OTP:
- SIM swap attacks: Criminals convince carriers to transfer your number to their SIM, intercepting every OTP meant for you
- SS7 protocol vulnerabilities: The signalling system that routes SMS messages between networks has known exploits that allow interception
- Phishing: Attackers send fake banking pages that capture OTPs in real time — 83% of email-based attacks in the UAE use phishing
- SMS pumping: Artificially triggering OTP sends to premium-rate numbers, generating revenue for fraudsters
- Social engineering: Callers impersonating bank staff or government officials trick victims into reading out their OTP codes
Between 2021 and 2023, an estimated AED 1.2 billion was lost to fraud in the UAE. Over 40,000 residents fell victim to scams in 2023 alone, with an average loss of approximately AED 8,060 per victim. Only 9% of victims who lost money fully recovered their funds.
How Does the New Biometric Banking System Work?
Instead of receiving a text message, you now authenticate transactions directly inside your banking app using biometrics tied to your physical device. The device linked to your UAE mobile number becomes your authentication key.
Approved authentication methods under CBUAE Notice 3057:
- In-app biometric verification: Face ID or fingerprint scan within your bank's mobile app
- Secure in-app PIN: A PIN entered inside the banking app (not via SMS)
- FIDO2 passkeys: Cryptographic keys stored on your device — explicitly endorsed by the CBUAE
- Push notification approval: A notification sent to your registered device asking you to approve or deny the transaction
- Emirates Face Recognition (EFR): A UAE-developed facial recognition system with 99.8% accuracy, operating since 2012
- Behavioral biometrics: Advanced systems that analyse how you type, swipe, and hold your phone
The critical point: all of these methods are device-bound. They work on the specific smartphone linked to your mobile number and banking profile. If someone steals your SIM, they still cannot authenticate — because they do not have your face, your fingerprint, or your registered device.
Market Insider: If you are considering buying a VIP mobile number or switching numbers, do it before setting up biometric authentication across your banking apps. Changing your number after biometric enrolment means re-registering with every bank, UAE Pass, Emirates ID, and dozens of other services. Choose your number carefully — it is a long-term commitment now more than ever.
Which UAE Banks Have Switched to Biometric Authentication?
All major UAE banks completed the transition by the 31 March 2026 deadline. Five banks led the way, finishing their shift months ahead of schedule by September 2025.
| Bank | Authentication Method | Completion Date |
|---|---|---|
| Emirates NBD | In-app biometric + push notifications | September 2025 |
| First Abu Dhabi Bank (FAB) | In-app biometric + secure PIN | September 2025 |
| Abu Dhabi Islamic Bank (ADIB) | In-app biometric authentication | September 2025 |
| Mashreq | Smart OTP + app-based approval | September 2025 |
| Abu Dhabi Commercial Bank (ADCB) | App-based authentication | September 2025 |
| United Arab Bank (UAB) | Emirates Face Recognition integration | 2025 |
In January 2026, the CBUAE also launched a biometric payment pilot in partnership with PopID and Network International — testing face and palm recognition for in-store payments at the Dubai Land Department. No card, no phone, no PIN. Just your face. While this is still in proof-of-concept stage, it signals where the UAE is heading: your biological identity, linked to your mobile number and Emirates ID, becomes your payment method.
How Is Your Mobile Number Linked to Emirates ID and UAE Pass?
Your UAE mobile number is not just a phone line. It is the thread that connects your entire digital identity in the Emirates. Every UAE resident — citizen and expat alike — must link a valid UAE mobile number to their Emirates ID.
Emirates ID: Your mobile number is a mandatory field on your Emirates ID record. It is used for:
- Receiving notifications from the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP)
- Verifying your identity when accessing government services
- Linking to your visa, residency file, healthcare, driving licence, and traffic records
- Two-factor verification across government and private-sector platforms
UAE Pass: Your mobile number is the primary verification channel during UAE Pass registration. Without a valid, linked UAE number, you cannot create or use a UAE Pass account. As of 2026, UAE Pass has:
- 11 million+ registered users
- 15,000+ services from 350+ government and private entities
- 2.6 billion+ digital transactions processed
- 600 million+ login operations completed
Every time you renew a visa, pay a traffic fine, register a business, apply for a government service, or sign a digital document — your mobile number is involved. Change your number without updating every linked service, and you risk losing access to critical accounts.
How Many Services Actually Depend on Your UAE Mobile Number?
The answer is: virtually everything. Your UAE mobile number is your single point of contact for an interconnected ecosystem of government, financial, and daily services.
| Category | Services Linked to Your Number | Impact If Number Changes |
|---|---|---|
| Government | UAE Pass, Emirates ID, GDRFA, visa processing, traffic fines, healthcare | Loss of access to 15,000+ services |
| Banking | All bank accounts, credit cards, e-wallets, insurance, exchange houses | Transaction authentication fails |
| Telecom | Account management, billing, data plans | Account access issues |
| Business | Trade licences, corporate accounts, supplier communications | Business continuity risk |
| Daily Life | WhatsApp, delivery apps, ride-hailing, social media verification | Account lockouts, missed communications |
The UAE operates a unified number system that ties your visa, residency, healthcare, education, driving licence, and traffic records together. Your mobile number is the primary communication channel for all of these. This is precisely why the decision to buy a golden number or VIP number should not be taken lightly. You will live with this number for years — potentially decades.
What Is SIM Swap Fraud and How Does It Threaten UAE Residents?
SIM swap fraud occurs when a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they receive every call, text message, and authentication code meant for you.
The UAE has taken stronger measures than most countries against traditional SIM swaps. TDRA requires biometric Emirates ID verification (chip reader + fingerprint scan) for any SIM reissuance. This has nearly eliminated the traditional walk-into-a-store SIM swap attack.
However, social engineering attacks remain a real threat. In March 2026, Dubai Police issued urgent warnings after criminals exploited regional tensions to run a new type of scam:
- Scammers impersonated a fictitious "Dubai Crisis Management" department
- They called victims claiming to need UAE Pass credentials and Emirates ID details for "safety verification"
- Goal: obtain enough information to access banking apps or perform identity theft
- Dubai Police confirmed they never request confidential information or verification codes by phone
Globally, SIM swap fraud surged 1,055% in the UK (2024) and 240% in Australia (2024). The FBI logged 982 complaints with nearly USD 26 million in losses in 2024 alone. The UAE's biometric SIM verification puts it ahead of these countries — but the social engineering vector means you must still actively protect your number.
How to Protect Your Mobile Number in the UAE — Step by Step
Whether you own a fancy number worth thousands or a standard SIM, these steps are essential in 2026.
Set Up a Carrier Security PIN
e& (Etisalat): Call 101 to set up a 4-digit security PIN. This PIN is required for any SIM replacement, ownership transfer, or account modification. A confirmation SMS is sent to your registered number and email. The PIN does not expire, but you should change it periodically.
du: Visit a du service centre with your Emirates ID for biometric verification. Ensure your account details are up to date via the du app.
Virgin Mobile: Contact customer support to verify your account security settings. Ensure your Emirates ID is current on file.
Use the TDRA Hesabati Service
Hesabati ("My Account") is a free service from TDRA that lets you check all mobile and fixed-line numbers registered under your Emirates ID. Access it through TDRA with UAE Pass. If you find a SIM registered without your knowledge, report it immediately.
Enable Biometric Authentication Everywhere
Update every banking app to the latest version and enable Face ID or fingerprint authentication. Turn on push notifications so you receive transaction approval requests on your registered device.
Never Share Credentials by Phone
No UAE government entity, bank, or carrier will ever ask for your UAE Pass credentials, Emirates ID details, or verification codes over the phone. If you receive such a call, hang up and report it to Dubai Police by calling 901 or through the eCrime platform.
Check Your Linked Services
Use the MobileNumber.ae Number Value Calculator to understand what your current number is worth. Then audit every service linked to it — banking, UAE Pass, social media, delivery apps — and ensure recovery options are current.
What Happens If You Need to Change Your Mobile Number?
Changing your mobile number in the UAE is no longer a simple swap. Because your number is now tied to biometric banking authentication, Emirates ID, UAE Pass, and dozens of other services, the process requires careful planning.
Updating your number on Emirates ID:
- Cost: AED 53 (through ICP Smart Services) or free at Smart Police Stations
- Methods: ICP Smart Services portal, UAEICP mobile app, accredited typing centres (Amer/Tasheel), or Smart Police Stations
- Processing time: 2–7 days via ICP; immediate at Smart Police Stations
- Legal requirement: You must report any change within one month per ICP rules
Beyond Emirates ID, you will need to update:
- UAE Pass: Re-register with new number and biometric verification
- Every bank account: Visit branches or use in-app number change (re-enrol biometrics)
- Insurance, exchange houses, e-wallets: Update contact details
- WhatsApp and social media: Transfer accounts to new number
- Delivery and ride-hailing apps: Update profile
- Business registrations and trade licences: Notify relevant authorities
Market Insider: This is exactly why buying the right number from the start saves you enormous hassle down the line. Browse all available UAE numbers on MobileNumber.ae, use the Value Calculator to find a number worth keeping for the long term, and avoid the costly process of switching later. A number you are proud of is a number you will keep.
Why VIP Number Owners Should Take Security Especially Seriously
If you own a golden number, a repeating pattern number, or any premium mobile number, you are a higher-value target for social engineering attacks. Here is why:
- Public visibility: VIP numbers are often displayed on business cards, vehicles, shop signage, and social media profiles — making the owner easier to identify and target
- Assumed wealth: A number that costs AED 5,000 to AED 500,000 signals financial means, making the owner a more attractive target for scammers
- Business use: Many business owners link their VIP number to banking, payment processing, and corporate accounts — amplifying the damage if compromised
- Resale value: The number itself has monetary value, creating an incentive for theft through fraudulent ownership transfers
If you own or are planning to buy a VIP number on MobileNumber.ae, treat it like a valuable asset from day one. Set up the carrier security PIN, enable biometric banking, and never share any account details when someone calls you. The TDRA legal framework protects legitimate number ownership — but only if you take basic precautions.
How to Verify Number Ownership Before Buying a Premium Number
The SMS OTP ban and increased focus on mobile number security make ownership verification more important than ever when purchasing a VIP number on the secondary market.
Before completing any purchase:
- Verify the seller owns the number: Ask for proof that the number is registered under their Emirates ID
- Check for outstanding bills: Postpaid numbers may carry unpaid balances that transfer with ownership
- Confirm carrier transfer process: Both buyer and seller must visit the carrier store with Emirates IDs for biometric verification
- Use a trusted platform: MobileNumber.ae lists 19,000+ verified numbers from all four UAE carriers — Etisalat (e&), du, Virgin Mobile, and DOMC — with transparent pricing and zero commission for buyers
The MNP transfer guide on MobileNumber.ae walks you through the entire process, including what documents you need and how long the transfer takes with each carrier.
The Bigger Picture: Your Number as a Lifelong Digital Asset
The SMS OTP ban is not an isolated regulation. It is part of a broader shift in the UAE toward treating your mobile number as a core component of your digital identity. Consider the trajectory:
- 2012: Emirates Face Recognition launched for identity verification
- 2017: UAE Pass launched, requiring mobile number for registration
- 2021: TDRA mandated biometric ID verification for all SIM registrations
- 2025: CBUAE issued Notice 3057 banning SMS OTP
- 2026: Biometric palm and face payment pilot launched at Dubai Land Department
Each step ties your mobile number more tightly to your financial, governmental, and social identity. The UAE is building an ecosystem where your phone number, your biometric data, and your Emirates ID form an inseparable triangle. Choosing a number you will keep for years — one that represents you professionally and personally — is no longer a luxury decision. It is a practical one.
Whether you are looking for a lucky number, a 786 number with cultural significance, or a classic 050 Etisalat number, the choice you make today will follow you through every bank account, every government interaction, and every business relationship for years to come.
Frequently Asked Questions
When did UAE banks stop using SMS OTP?
UAE banks stopped sending SMS OTP for online card payments on 6 January 2026. The CBUAE set 31 March 2026 as the absolute deadline for all financial institutions to fully phase out SMS and email OTP under Notice No. 3057.
Why did the UAE ban SMS OTP for banking?
SMS OTPs are vulnerable to SIM swap fraud, SS7 protocol exploits, and phishing attacks. Globally, SIM swap fraud surged 1,000%, and the UAE experienced an estimated AED 1.2 billion in fraud losses between 2021 and 2023. Biometric authentication is significantly harder to compromise.
Is the UAE the first country to ban SMS OTP?
Yes. The UAE is the first nation in the world to mandate a complete regulatory phase-out of SMS OTP for financial transactions. Other countries like the EU encouraged stronger authentication through PSD2 but did not outright ban SMS codes.
What replaced SMS OTP in UAE banking?
Banks now use in-app biometric verification (Face ID, fingerprint), secure in-app PINs, FIDO2 passkeys, push notification approvals, and Emirates Face Recognition. All methods are device-bound, meaning they work only on your registered smartphone.
What happens if I do not update my banking app?
Your online card payments will be declined. Banks cannot fall back to SMS OTP after the 31 March 2026 deadline. You must update to the latest version of your banking app and enrol your biometrics to continue making online transactions.
Can I still use SMS OTP if I do not have a smartphone?
Some banks may allow SMS OTP for customers who submit a written request confirming they lack a smartphone. However, this shifts liability from the bank to the customer, meaning the bank is not obligated to refund fraud losses on your account.
What is SIM swap fraud?
SIM swap fraud happens when a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. They then receive all your calls, texts, and authentication codes. The UAE requires biometric Emirates ID verification for SIM reissuance, which has nearly eliminated traditional SIM swaps.
Is SIM swap still possible in the UAE?
Traditional SIM swaps at carrier stores are nearly impossible due to mandatory Emirates ID biometric verification. However, social engineering attacks — where scammers trick you into revealing UAE Pass credentials or Emirates ID details — remain a threat. Dubai Police issued specific warnings about this in March 2026.
How do I set up a security PIN with Etisalat?
Call 101 from your Etisalat number to set up a 4-digit security PIN. This PIN is required for any SIM replacement or ownership transfer. It does not expire, but Etisalat recommends changing it periodically for safety.
What is the TDRA Hesabati service?
Hesabati is a free TDRA service that shows all mobile and fixed-line numbers registered under your Emirates ID. You can access it via UAE Pass through the TDRA website. It helps you detect any SIMs registered without your knowledge.
How do I report a SIM swap scam in the UAE?
Contact Dubai Police immediately by calling 901 or filing a report through the eCrime platform. Also contact your mobile carrier to freeze your account and visit a carrier store with your Emirates ID to reclaim your number.
How much does it cost to change my mobile number on Emirates ID?
Updating your mobile number on Emirates ID costs AED 53 through ICP Smart Services or the UAEICP mobile app. The change is free at Smart Police Stations. Processing takes 2–7 days through ICP or is immediate at Smart Police Stations.
How is my mobile number linked to UAE Pass?
UAE Pass requires a valid UAE mobile number during registration. An OTP is sent to your number for verification, and your number remains the primary contact for authentication. Without a linked UAE number, you cannot create or use UAE Pass, which provides access to over 15,000 services.
What is Emirates Face Recognition?
Emirates Face Recognition (EFR) is a UAE-developed facial recognition technology operating since 2012 with 99.8% accuracy. It is integrated into several banking apps and government identity verification systems, providing biometric authentication as part of the post-OTP security framework.
What are FIDO2 passkeys in UAE banking?
FIDO2 passkeys are cryptographic keys stored securely on your device. They replace passwords and OTPs with a simple biometric scan (fingerprint or Face ID) to authenticate transactions. The CBUAE explicitly endorses FIDO2 as an approved authentication method under Notice 3057.
Does the OTP ban affect non-banking apps?
CBUAE Notice 3057 specifically covers financial institutions. Non-banking apps like social media, delivery services, and e-commerce platforms may still use SMS OTP. However, the trend toward biometric and in-app authentication is expected to spread across all sectors.
Are VIP mobile numbers more at risk from SIM swap?
VIP and golden number owners face higher social engineering risk because their numbers are often publicly visible on business cards, vehicles, and social media. The number itself also has monetary resale value, creating additional incentive for fraud. Setting up a carrier security PIN is essential.
Can someone steal my mobile number in the UAE?
Physical SIM theft at carrier stores is nearly impossible due to mandatory Emirates ID biometric verification. However, social engineering — where criminals trick you into revealing credentials — remains a threat. Never share your UAE Pass details, Emirates ID information, or any verification codes with callers.
What penalty do banks face for using SMS OTP after the deadline?
Banks and financial institutions that continue using SMS OTP after 31 March 2026 face fines of up to AED 250,000 per violation. Since July 2025, banks must also fully refund any 3DS fraud that involved SMS OTP authentication.
Should I buy a VIP number before or after setting up biometric banking?
Buy your number first. Once you enrol biometrics with your bank, changing your number means re-registering with every bank, UAE Pass, Emirates ID, and linked services. Choose the right number on MobileNumber.ae before locking in your biometric authentication setup.
How does number portability work with the new OTP system?
The MNP (Mobile Number Portability) process remains the same — both carrier stores verify your Emirates ID biometrically. After porting, update your banking apps on the new carrier network. The biometric authentication transfers with your device, not the SIM.
What is the biometric payment pilot in the UAE?
In January 2026, the CBUAE launched a proof-of-concept at the Dubai Land Department where customers can pay using face or palm recognition — no card, phone, or PIN needed. It is a partnership between PopID and Network International, and signals the future of payments in the UAE.
How do I check if someone registered a SIM under my Emirates ID?
Use the free Hesabati service from TDRA. Log in with UAE Pass at the TDRA website to see every mobile and fixed-line number registered under your Emirates ID. If you find an unauthorised SIM, report it immediately to your carrier and TDRA.
Why does choosing a mobile number matter more now?
Your mobile number is linked to banking authentication, Emirates ID, UAE Pass (15,000+ services), business registrations, and every digital service in the UAE. Changing it requires updating all these services at a cost of AED 53+ and significant time. A VIP number you are proud of is a number you will keep — and keeping the same number is now a security advantage.
Your Mobile Number Is Your Digital Identity — Choose It Wisely
The UAE's SMS OTP ban marks a turning point. Your mobile number is no longer just a way to make calls — it is the key to your banking, your government identity, your business, and your daily life. Here is what you should take away:
- The UAE is the first country in the world to fully ban SMS OTP for financial transactions, setting a new global standard for mobile security
- Your mobile number is now device-bound to your banking authentication — changing it means re-enrolling biometrics across every bank and government service
- SIM swap protection in the UAE is among the strongest globally, but social engineering remains a threat — set up your carrier security PIN and never share credentials
- Over 15,000 government and private services depend on your UAE Pass, which is linked to your mobile number
- Choosing the right number from the start saves you the hassle, cost, and security risk of changing it later
Browse 19,000+ UAE mobile numbers on MobileNumber.ae — from budget-friendly options under AED 1,000 to exclusive golden numbers and VIP numbers. Use the free Number Value Calculator to check what any number is worth. Want to list your current number for sale? It takes less than two minutes. Looking for something specific? Post a wanted request and let sellers come to you.
In 2026, your mobile number is your most important digital asset. Make sure it is one worth keeping.