UAE banks to phase out one-time passwords by end of 2025

Dubai: UAE Banks are moving to eliminate one-time passwords (OTPs) for online transactions, shifting instead to smart application-based authentication in line with Central Bank directives.

Several major banks, which together serve more than 90 per cent of customers, have already completed the transition. 

The rest are expected to phase out OTPs by the end of next year. Under the new system, transactions are confirmed through a bank’s mobile app, typically by swiping or scanning, rather than by entering a password sent via text message.

Customers unwilling to use mobile apps may request to keep OTPs, but only by filing a written request with their bank. In such cases, institutions will disclaim responsibility for any fraud or unauthorized withdrawals linked to OTP use.

Notices sent to customers described the change as offering faster, safer, and more convenient authentication. Instead of waiting for an SMS code, users will be prompted through the app to confirm payments made with debit or credit cards.

 “This is a very positive step aligned with digital transformation across the economy,” said Awatif Al Harmoody, a banking expert. She noted that more than 90 per cent of customers already prefer to use mobile apps for banking. “It is more secure and reliable than OTPs, which have been shown to have vulnerabilities over the years.”

 Al Harmoody acknowledged that a small segment of customers may resist the change, but said that, as with earlier digital transitions, adoption will accelerate once the new system becomes the norm.

The shift underscores the Central Bank’s push to tighten cybersecurity in financial services, while accelerating the sector’s broader move toward digital-first transactions, Emarat Al Youm reported.