Topic starter
06/07/2026 9:38 am
TL;DR: The UAE central bank has ordered consumer-facing financial institutions to eliminate SMS and email OTPs and move toward phishing-resistant authentication, while also shifting liability for 3D Secure fraud involving SMS OTPs, according to Descope. Legacy OTPs no longer fail only at the login step, they now create direct operational and financial exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “UAE Central Bank Bans SMS & Email OTP: What You Need to Know”.
By the numbers:
- digital banking fraud in the UAE rose by 73% in early 2025, according to the National Financial Ombudsman Scheme cited by Descope.
Key questions
Q: What should banks do first when SMS OTP is banned by a regulator?
A: Start by inventorying every flow that still depends on SMS or email OTP, then isolate the highest-risk paths such as 3D Secure and customer account recovery.
Q: Why do shared OTPs create more fraud risk than phishing-resistant authentication?
A: Shared OTPs can be intercepted, replayed, or socially engineered because the secret travels through a reachable channel rather than staying cryptographically bound to the intended device and site.
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Practitioner guidance
- Audit every OTP dependency Map SMS and email OTP usage across mobile apps, web banking, call centres, and branch-assisted flows, then prioritise 3D Secure paths first because liability has already shifted there.
- Replace shared secrets with phishing-resistant factors Move high-risk customer journeys to FIDO2 passkeys, in-app approvals, or hardware or software tokens that are bound to the legitimate device and application.
- Add session interruption controls Terminate or suspend authenticated sessions when endpoint compromise signals appear, including malware, screen-sharing tools, or remote access utilities.
Bottom line: The article shows that SMS OTP is no longer just a weak login factor, but a direct compliance and fraud-liability problem for consumer finance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:52 am
Legacy OTP retirement is now a governance problem, not a UX preference: Once a regulator bans SMS and email OTPs for consumer finance, authentication choice becomes part of the control environment, not a front-end design option. Institutions that still treat OTPs as acceptable fallback factors are carrying both compliance risk and fraud exposure. The practical consequence is that identity teams must reclassify weak factors as liabilities, not conveniences.
Session risk now belongs in identity policy: When regulators require institutions to suspend sessions for malware, screen-sharing, or remote access tools, authentication stops being a one-time gate. IAM teams need to define when an authenticated session has become unsafe, because the attack surface now extends into live customer activity.
A question worth separating out:
Q: How should financial institutions govern authentication and fraud controls together?
A: They should treat authentication, device telemetry, and fraud decisioning as one operating model. If session compromise, impossible travel, or remote access tools are detected, the identity system should be able to challenge or stop the session before transaction completion, with clear ownership across IAM and fraud teams.
👉 Read our full editorial: UAE central bank ban on SMS OTPs raises the bar for auth