Fraud prevention tips for UAE consumers
The CBUAE requires banks and payment providers in the UAE to run fraud awareness campaigns each year. Here is what that awareness actually looks like: practical tips on passwords, OTPs, phishing, and what to do if fraud is suspected.
The Central Bank of the UAE's Consumer Protection Standards direct licensed financial institutions, meaning every bank, finance company, insurer, exchange house, and payment service provider, to run fraud awareness campaigns for their customers at least once a year under Article 9, Consumer Education and Awareness, and more often when fraud activity increases. Article 121(2) of the relevant Decretal Law adds a parallel duty: the Central Bank and licensed financial institutions "shall work together to raise public awareness of the types of banking services and financial products and their inherent risk through all means of communications and media." The practical version of that awareness is simple: knowing what a real fraud attempt looks like, and what to do the moment one shows up.
Password and PIN habits worth repeating
Weak or guessable passwords are still the most common way an account gets taken over. Birthdays, anniversaries, phone numbers, and other numbers tied to a personal date are the first combinations a fraudster tries, so consumers should avoid them. A password manager, or at minimum a phrase mixing letters, numbers, and symbols, holds up better than a memorable date. Passwords and PINs should change on a regular schedule, not only after something goes wrong, and the same password should not cover a banking app, an email account, and other financial services at once. The same caution applies at an ATM or when paying with a card in person: cover the keypad, and never keep a PIN written down near a card.
One time passcodes should never leave the consumer's hands
A one time passcode exists to prove that whoever is using an account is the person who owns it. No bank, payment service provider, or government office will ever call or message a consumer and ask them to read that code aloud or forward it. A request for an OTP, a PIN, or full card details by phone, text, or messaging app is a fraud attempt, no matter how convincing the caller sounds or how urgent the situation seems. Handing over an OTP, a PIN, or any kind of account access to someone else, even someone who sounds official, is difficult to undo: transactions made after that handover are hard to reverse, and the account holder is often the one left proving what happened.
Phishing, smishing, and vishing use the same setup
Phishing arrives by email, smishing by text message, vishing by phone call, but the setup is the same: a message creates urgency and asks the consumer to click a link, open an attachment, or share sensitive details right away. Warning signs include a sender address that looks slightly wrong, a link that does not match the institution's real domain, spelling that feels rushed, and any threat of an account freeze unless the consumer acts within minutes. The safer response is to close the message and contact the institution directly, using the number on the back of a card or a number saved from an earlier legitimate contact, never a number or link supplied in the suspicious message.
Unsolicited calls and links deserve default suspicion
A call or message a consumer did not ask for, from someone claiming to represent a bank, a courier, a government office, or a telecom provider, should be treated as unverified until proven otherwise. Legitimate institutions rarely ask a consumer to install remote access software, move money to a safe account, or confirm full card details over an inbound call. Consumers should hang up, look up the institution's published number on their own, and call back on their own terms. The same caution applies to links shared through social media, messaging apps, and unfamiliar shopping sites, since one tap can open a lookalike login page built to capture a password.
Watching the account is part of the defense
Fraud against a single account is often repeated rather than a one-off: a fraudster who gets close once tends to try again. Checking account activity regularly, instead of waiting for a statement, turning on transaction alerts where the service offers them, and treating a small unfamiliar charge as seriously as a large one all help catch that pattern early. Fraudsters often test a card with a tiny transaction before attempting a bigger one, and a bank or provider that flags repeated attempts on an account is giving a real signal worth acting on immediately.
What to do the moment fraud is suspected
Speed matters more than certainty. A consumer who suspects fraud, whether from an unfamiliar transaction, a suspicious message, or an OTP they did not request, should contact their institution right away through an official channel, freeze or block the card or account where that option exists, and change the password or PIN as a precaution even before any loss is confirmed. Reporting early gives the institution the best chance to stop a repeat attempt, and gives the consumer clear, timestamped proof of when they raised the concern.
Awareness is a habit, not a one-time read
None of this works as a single read. Fraud tactics shift, and the habits above, being skeptical of unsolicited contact, protective of OTPs and PINs, watching account activity, only hold up if they are kept up. The campaigns and written guidance banks and payment providers are required to send periodically exist to keep this front of mind, not to replace it. Reading a fraud advisory a bank or provider actually sends, rather than skimming past it, is itself part of staying protected.
NymCard operates payments infrastructure for licensed institutions across regulated markets, including the UAE, and shares this guidance in the spirit of the consumer awareness initiatives its bank and payment provider partners are required to run under Article 9. For anything specific to an account, the first call should always be to that bank or provider directly.