UAE banks shift from traditional OTPs to biometric verification and in-app approvals.
Dubai: UAE banks are moving away from traditional one-time passwords (OTPs) sent by SMS or email, with in-app approvals and biometric verification increasingly being used to authenticate online payments.
The transition follows guidelines from the Central Bank of the UAE (CBUAE), requiring banks to phase out traditional authentication methods by March 31, 2026. Many banks began introducing the newer verification systems more widely during 2025, with the rollout continuing across the sector.
How do UAE banks verify online purchases now?
When making an online purchase, customers may no longer receive an SMS containing a one-time password to enter on the merchant’s payment page.
Instead, after card details are submitted, customers may be prompted to verify the transaction through their bank’s official mobile app. The approval can typically be completed using the bank’s secure authentication process, which may include biometric verification such as fingerprint or facial recognition.
Banks may still send an SMS notification informing customers that an online card transaction requires verification. Instead of containing an OTP, the message may direct the customer to open the bank’s official mobile app to approve the payment.
Depending on the bank, customers may need to visit a section such as ‘Activities’ or ‘Pending Transactions’ to locate the purchase awaiting verification.
The banking app will then display the transaction details and provide the option to approve or decline the payment, usually within a limited time window for added security.
How does biometric verification work?
Many UAE banking apps now use biometric authentication, such as fingerprint scanning or facial recognition, to verify online transactions securely.
Customers who have not previously registered their biometrics with their bank’s mobile app may need to complete the setup before using this feature. Depending on the bank, they may also be required to create or activate a digital PIN, Smart Pass or another security feature for in-app approvals.
For example, Dubai Islamic Bank (DIB) currently allows customers to choose between receiving an SMS OTP and approving an online purchase through an in-app push notification. Customers selecting the in-app option can authenticate the transaction using their registered fingerprint or facial recognition.
The verification process varies between banks. While some primarily use biometric authentication, others may require a Smart Pass PIN or additional security checks before a transaction is approved.
What happens when you approve a payment?
After checking the transaction details in your bank’s mobile app, you can either approve or decline the payment.
If you choose to proceed, the app may ask you to confirm your identity using a registered fingerprint, facial recognition, security PIN or another authentication method. Once your identity is verified, the transaction can be authorised without entering or sharing an SMS OTP.
Important: The exact process varies between UAE banks. Customers should follow the instructions provided through their bank’s official mobile app and contact the bank directly if they are unsure how to activate or use its authentication system.
Why are SMS OTPs being replaced?
SMS and email-based OTPs can be more exposed to risks such as interception, phishing and other forms of fraud. In-app authentication adds an additional layer of security by keeping the approval process within the bank’s official application and linking verification more closely to the customer’s registered device and identity.
Cybercriminals may use methods such as SIM swapping to transfer a victim’s mobile number to another SIM card, potentially allowing them to intercept SMS messages and one-time passwords. Phishing scams can also be used to deceive customers into sharing their OTPs or other sensitive information.
In-app authentication and biometric verification aim to reduce these risks by keeping transaction approvals within the bank’s secure mobile application and requiring customers to verify their identity directly through the app.
