UAE banking explained: How online payment verification works without SMS OTPs

Dubai: UAE banks are moving away from traditional SMS and email-based One-Time Passwords (OTPs), with secure in-app approvals and biometric verification becoming the preferred way to authenticate online payments.

The shift followed guidelines from the Central Bank of the UAE (CBUAE), which required banks to phase out traditional authentication methods by March 31, 2026. Many UAE banks began rolling out the new systems to customers on a wider scale during 2025, while some continued introducing the new authentication methods to customers.

When you make an online purchase, you may no longer receive an SMS containing a one-time password to enter on the payment page.

Instead, after you enter your card details, the payment screen may ask you to approve the transaction through your bank’s official mobile app.

The bank may also send an SMS alert telling you that an online card payment requires confirmation and directing you to open the banking app. Depending on the bank, you may then need to navigate to a section such as ‘Activities’ or ‘Pending Transactions’ to find the payment awaiting approval.

Once you open the transaction, the app will show details of the purchase and may give you a limited amount of time to approve or decline it.

Many UAE banking apps use biometric authentication, such as fingerprint or facial recognition, to confirm the transaction.

If you have not previously registered your biometrics with your bank’s app, you may first need to set this up. Some banks may also require you to create or activate a digital PIN or other security feature before you can use in-app transaction approvals.

For example, with Dubai Islamic Bank (DIB), customers can currently choose between receiving an SMS OTP or authenticating an online purchase through an in-app push notification. If customers choose the in-app option, they can use registered facial recognition or fingerprint authentication to verify the payment.

The exact process differs between banks. Some may require biometric registration, while others may use a Smart Pass PIN or additional security steps.

After reviewing the transaction details in your banking app, you can choose to approve or decline the payment.

If approval is required, the app may ask you to verify your identity using your registered biometric or security PIN. Once authentication is completed, the transaction is authorised without requiring you to enter or share an SMS OTP.

Important: The steps vary from one UAE bank to another. Customers should follow the instructions displayed in their bank’s official mobile app or contact their bank if they are unsure how to activate or use the new authentication method.

SMS and email OTPs are considered more vulnerable to interception and fraud than authentication methods built directly into banking apps.

Cybercriminals can use techniques such as SIM swapping to move a victim’s mobile number to another SIM card, potentially giving them access to SMS messages and OTPs. Phishing attacks can also trick customers into revealing their codes.

In-app authentication and biometric verification are designed to reduce these risks by keeping the approval process within the bank’s secure mobile application.