UAE central bank ban on SMS OTPs raises the bar for auth

At a glance

What this is: The article explains how the UAE central bank’s OTP ban changes authentication expectations for consumer-facing financial institutions, especially by pushing them toward phishing-resistant methods and away from SMS and email one-time passwords.

Why it matters: IAM and security teams in regulated environments should treat OTP retirement as an identity governance and fraud-liability issue, not just an authentication upgrade.

By the numbers:

• digital banking fraud in the UAE rose by 73% in early 2025, according to the National Financial Ombudsman Scheme cited by Descope.

Context

The core issue is not that SMS OTP stopped working at the login screen. The problem is that shared, interceptable authentication methods can no longer support the assurance and liability expectations now being imposed on consumer-facing financial institutions.

For identity and access teams, this is a human IAM and fraud-control story with direct programme implications. The UAE central bank’s Notice 2025/3057 turns OTP retirement into a governance decision, because authentication choice now affects compliance, session handling, and who absorbs fraud loss.

The article frames the UAE as an early mover in a broader shift away from vulnerable factors toward phishing-resistant auth such as passkeys, in-app approval, biometrics, and hardware or software tokens.

Key questions

Q: What should banks do first when SMS OTP is banned by a regulator?

A: Start by inventorying every flow that still depends on SMS or email OTP, then isolate the highest-risk paths such as 3D Secure and customer account recovery. That gives the programme a clear migration order and exposes where liability, user friction, and fraud loss are concentrated.

Q: Why do shared OTPs create more fraud risk than phishing-resistant authentication?

A: Shared OTPs can be intercepted, replayed, or socially engineered because the secret travels through a reachable channel rather than staying cryptographically bound to the intended device and site. Phishing-resistant methods reduce that interception window, which is why they are becoming the preferred control in regulated consumer banking.

Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?

A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.

Q: How should financial institutions govern authentication and fraud controls together?

A: They should treat authentication, device telemetry, and fraud decisioning as one operating model. If session compromise, impossible travel, or remote access tools are detected, the identity system should be able to challenge or stop the session before transaction completion, with clear ownership across IAM and fraud teams.

Technical breakdown

Why SMS OTP fails the phishing-resistant authentication test

SMS OTP depends on a shared secret delivered through channels that can be intercepted, proxied, or socially engineered. That makes it vulnerable to SIM swapping, phishing, man-in-the-middle interception, and credential stuffing, even when the code itself is short-lived. The weakness is structural: the factor is tied to possession of a reachable channel, not to a cryptographic proof bound to the legitimate device and application context. In regulated banking, that distinction matters because attackers do not need to defeat the code generation logic if they can redirect or replay the code path.

Practical implication: treat SMS OTP as an interceptable channel, not a strong second factor, when designing regulated customer authentication.

How passkeys change the authentication model

FIDO2 passkeys replace shared OTP delivery with cryptographic authentication bound to the user’s device and the relying party’s site or app. That binding prevents a spoofed site from reusing the credential, which is why passkeys are materially different from OTPs rather than just a more convenient factor. The same logic applies to in-app auth and hardware or software tokens when they are used to confirm intent inside a controlled application flow. This is an assurance shift, not only a user-experience shift.

Practical implication: prioritise phishing-resistant factors where the institution must prove the factor is bound to the intended user, device, and channel.

Why session protection and real-time fraud signals now sit inside auth

Notice 3057 extends beyond initial authentication by requiring institutions to suspend sessions when they detect malware, screen-sharing software, or remote access tools, and to integrate device, location, and behavioural analysis into fraud detection. That means authentication is no longer a single event. It is a continuously evaluated control surface where unusual geography, multiple failed logins, or bot-like behaviour can trigger step-up or termination. In practice, the auth stack becomes part of fraud operations, not just access management.

Practical implication: connect authentication, device signals, and fraud telemetry so suspicious sessions can be challenged or ended in real time.

Threat narrative

Attacker objective: The attacker’s objective is to authenticate as the customer long enough to approve fraudulent activity and monetize access before detection.

1. Entry begins when attackers use phishing, spoofed URLs, or fake landing pages to capture credentials and SMS OTPs in real time.
2. Escalation occurs when the stolen OTP is replayed through the victim’s live authentication flow, allowing account takeover or fraudulent transaction approval.
3. Impact follows through unauthorised transfers, 3D Secure fraud, or broader customer account abuse that now creates direct refund liability for banks.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy OTP retirement is now a governance problem, not a UX preference: Once a regulator bans SMS and email OTPs for consumer finance, authentication choice becomes part of the control environment, not a front-end design option. Institutions that still treat OTPs as acceptable fallback factors are carrying both compliance risk and fraud exposure. The practical consequence is that identity teams must reclassify weak factors as liabilities, not conveniences.

Phishing-resistant authentication is the new baseline for assurance-bound banking: Passkeys, in-app approval, and device-bound cryptographic tokens change the assurance model because they reduce the value of intercepted secrets. That matters because the attacker is no longer fighting the code generator alone but the trust relationship between user, device, and relying party. For banking programmes, the control question shifts from whether MFA exists to whether the factor can be phished at all.

Session-level fraud controls now belong inside identity governance: The directive’s requirements for malware detection, screen-sharing awareness, and remote-access interruption show that authentication no longer ends at login. Banks must govern the active session as part of the identity lifecycle, because compromise can emerge after authentication succeeds. The implication is that IAM, fraud, and runtime device telemetry need shared operating assumptions, not isolated ownership.

Identity assurance and fraud liability are converging into one operating model: The article shows a market pattern in which auth controls, fraud refund exposure, and customer trust are being linked by regulation. That convergence means identity programmes will be judged on loss prevention as much as access assurance. Organisations that still separate authentication policy from financial risk management will struggle to justify weak factors once liability shifts.

Regulatory pressure is accelerating the end of shared-secret login patterns: The UAE, Singapore, the Philippines, and the EU all point in the same direction: factors that can be intercepted, shared, or replayed are losing acceptability in consumer finance. That does not make every deployment uniform, but it does make the direction of travel unambiguous. Practitioners should treat OTP retirement as a category transition, not a one-off compliance event.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Session risk now belongs in identity policy: When regulators require institutions to suspend sessions for malware, screen-sharing, or remote access tools, authentication stops being a one-time gate. IAM teams need to define when an authenticated session has become unsafe, because the attack surface now extends into live customer activity.

Phishing-resistant factors reduce trust in the channel, not just the login form: Passkeys and in-app approvals matter because they change what can be intercepted or replayed during the authentication event. That shift is more important than interface simplicity for regulated finance, where assurance and liability are converging.

The broader signal for practitioners is that OTP retirement is moving from optional hardening to expected baseline practice in consumer financial services, especially where fraud liability attaches to the authentication method.

For practitioners

• Audit every OTP dependency Map SMS and email OTP usage across mobile apps, web banking, call centres, and branch-assisted flows, then prioritise 3D Secure paths first because liability has already shifted there.
• Replace shared secrets with phishing-resistant factors Move high-risk customer journeys to FIDO2 passkeys, in-app approvals, or hardware or software tokens that are bound to the legitimate device and application.
• Add session interruption controls Terminate or suspend authenticated sessions when endpoint compromise signals appear, including malware, screen-sharing tools, or remote access utilities.
• Wire fraud telemetry into authentication decisions Feed device, location, and behavioural signals into step-up logic so unusual logins, impossible travel, and bot-like behaviour can trigger stronger checks before transaction approval.
• Plan a phased customer migration Use segmented rollout, customer communications, and A/B testing to reduce friction while retiring SMS OTP from regulated flows.

Key takeaways

• The article shows that SMS OTP is no longer just a weak login factor, but a direct compliance and fraud-liability problem for consumer finance.
• The evidence point is the UAE central bank’s move plus the article’s cited rise in UAE digital banking fraud, which together show why regulators are acting now.
• Banks that still depend on shared OTPs should treat migration to phishing-resistant authentication and session-level fraud controls as an urgent governance change.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• EMV 3D Secure: A card authentication protocol that adds an extra verification step during online payments. It is used to reduce card-not-present fraud by helping issuers assess transaction risk before approval. In practice, it can strengthen security while also introducing friction that merchants must manage carefully.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
• Session suspension: Session suspension is the practice of interrupting an active digital session when environmental risk signals appear, such as screen sharing, remote access tools, or malware. In identity governance, it shifts control from static login approval to runtime trust management.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.