Topic starter
08/06/2026 4:19 pm
TL;DR: The Central Bank of the UAE has issued new rules that ban SMS OTP, email OTP, and static passwords as sole methods for financial transactions and account provisioning, while requiring step-up authentication, real-time fraud detection, and stronger beneficiary confirmation, according to OneSpan. The shift makes authentication quality, transaction monitoring, and mobile session controls central to banking identity governance.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “La Banque centrale des Émirats arabes unis renforce la protection des consommateurs contre la fraude”.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
A: Because the attacker’s goal is usually not just login, but misuse of an authenticated session to move money or alter account settings.
Q: What are the warning signs that a digital banking session may already be compromised?
A: Screen sharing, active remote-access tools, unexpected malware signals and live phone calls during sensitive banking actions are all signs that the session may be under pressure or takeover.
Practitioner guidance
- Replace sole-factor transaction approval Remove SMS OTP, email OTP and static passwords as standalone approval methods for financial transactions and account provisioning, then map each high-risk journey to stronger second-channel or device-bound proof.
- Embed beneficiary verification into payment flows Show payee name, account number, bank details and account type before transfer completion so the customer confirms the destination, not only the payment amount.
- Add runtime session-risk interruption Suspend mobile and online banking sessions when screen sharing, malware, remote-access tools or active calls are detected, and prevent continuation when screen-sharing apps are present.
Bottom line: The CBUAE rules treat weak authentication as an insufficient defence for digital banking, especially when the same session can be used to authorise payments or change account settings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/06/2026 5:54 pm
Weak-factor authentication is no longer a sufficient control boundary for regulated banking. The CBUAE rules show that customer identity assurance must now be evaluated at the transaction layer, not just the login layer. That is a structural shift for IAM teams because the control that matters is the one that binds the customer to a high-risk action, not the one that merely opens the session.
A question worth separating out:
Q: What should banks do when a regulator makes fraud detection part of authentication governance?
A: They should connect identity assurance, transaction monitoring and account-risk analytics into one control plane. That means step-up rules, beneficiary checks, mobile-session protection and anomalous-activity detection need to trigger from the same governance model, so fraud prevention is enforced at the point of action rather than after the loss.
👉 Read our full editorial: Uae banking fraud rules push stronger customer authentication