Hacking electronic payment systems, digital payment tools, financial transactions, applications or websites is a criminal offence in the UAE and can result in imprisonment and substantial fines.
Question: I recently noticed several unauthorised transactions on my UAE bank account. I immediately informed my bank, but the investigation is taking longer than expected. What legal protections are available to consumers in such cases, and can the bank be held responsible for any financial losses?
Answer: Based on your query, the relevant provisions of the UAE consumer protection regulations issued by the Central Bank of the UAE, along with the country’s cybercrime laws, may apply in cases involving unauthorised banking transactions and electronic fraud.
In the UAE, unauthorised access to electronic payment systems, digital payment instruments, online transactions, applications or websites is considered a criminal offence. Individuals or groups involved in such cybercrimes may face imprisonment and/or significant fines under the country’s applicable laws.
Under Article 15 of Federal Decree Law No. 34 of 2021 on Countering Rumours and Cybercrimes (UAE Cybercrime Law), offences involving the hacking, forging, cloning or unauthorised use of electronic payment instruments are subject to criminal penalties.
The law states that anyone who forges, duplicates or copies a credit card, debit card or electronic payment instrument, or captures its data through information technology systems, may face imprisonment and/or fines ranging from Dh200,000 to Dh2 million.
The same penalties apply to individuals who:
- Create or develop technology or software intended to facilitate such offences.
- Use a credit card, debit card, electronic payment instrument, or related data without authorisation to obtain money, property or services for themselves or others.
- Accept or use forged, copied or illegally obtained payment instruments or data while knowing they are unlawful.
The UAE’s Central Bank Consumer Protection Regulations also require licensed financial institutions to take steps to protect customers from financial crime.
Under Clause 6.2.2.6 of the Consumer Protection Regulations of Financial Institutions, banks and other licensed institutions must conduct awareness campaigns to educate customers about protecting themselves against financial fraud.
Financial institutions are also required under Clause 6.2.2.5 to maintain updated security systems and adopt new cybersecurity measures when needed to address emerging threats.
Banks may also be required to compensate customers for losses caused by financial crimes, cyberattacks, misuse of assets or misuse of information.
However, compensation may not apply if the loss resulted from the customer’s gross negligence or fraudulent actions. Clause 6.2.2.4 states that licensed financial institutions must compensate consumers for financial losses and related expenses arising from financial crimes unless they can prove the loss occurred due to the consumer’s gross negligence or fraud.
Therefore, if a customer can demonstrate that they did not engage with fraudulent websites or act negligently, and that the loss resulted from a financial crime, the bank may be responsible for compensation.
Customers who experience unauthorised transactions should first submit a formal complaint to their bank and provide all relevant evidence. They may also need to file a police report and submit details of the suspicious transactions. If the issue is not resolved satisfactorily, the matter can be escalated to the Central Bank of the UAE for further review and resolution.
Ashish Mehta is the founder and managing partner of Ashish Mehta & Associates and is qualified to practise law in Dubai, the United Kingdom and India.
Disclaimer: This information is provided for general guidance only and does not constitute legal advice. Individuals should seek professional legal advice for their specific circumstances.
