UAE banks must phase out SMS OTPs for online payments by March 31, 2026

UAE banks are moving away from traditional SMS and email-based One-Time Passwords (OTPs), with secure in-app approvals and biometric verification becoming the preferred way to authenticate online payments. The shift followed guidelines from the Central Bank of the UAE (CBUAE), which required banks to phase out traditional authentication methods by March 31, 2026. Many UAE banks began rolling out the new systems to customers on a wider scale during 2025, while some continued introducing the new authentication methods to customers. When you make an online purchase, you may no longer receive an SMS containing a one-time password to enter on the payment page. Instead, after you enter your card details, the payment screen may ask you to approve the transaction through your bank's official mobile app. Many UAE banking apps use biometric authentication, such as fingerprint or facial recognition, to confirm the transaction. SMS and email OTPs are considered more vulnerable to interception and fraud than authentication methods built directly into banking apps.