Phishing, smishing and fake calls

Most money scams in the UAE start with a text, WhatsApp message, email or call pretending to be your bank, a courier or the police. One rule protects you from most of them: no genuine bank or government body will ever ask for your OTP, PIN or card security code.

What genuine banks and authorities will never ask for

• Dubai Police have said no government or banking agency will ask for confidential bank data such as the card security code (CVV) or one-time password (OTP). Anyone who asks for these on a call should be treated as a scammer.
• ADCB states that banks will never ask for your card number, the 3-digit CVV on the back, or your OTP, and that 'anyone requesting an OTP over the phone is almost certainly trying to defraud you'.
• Never share your PIN, password, security code or OTP with anyone (ADCB).
• The national fraud awareness campaign by the Central Bank of the UAE, UAE Banks Federation, Abu Dhabi Police and Dubai Police warned people not to share account numbers, card numbers, passwords, identification codes or the security code on the back of cards.
• Dubai Police also warned in 2026 about callers posing as a 'Dubai Crisis Management' department and asking for UAE Pass login details and Emirates ID data. Authorities never request passwords or verification codes by call or text.

Common UAE scripts to recognise

• Fake parcel fee: a text or email asks for a small payment (reported as Dh4 to Dh12) to release a parcel, using a courier's name and logo. The link leads to a fake page that collects card details and CVV (Khaleej Times, reporting UAE police warnings).
• Fake traffic fine: Dubai Police warned of emails, texts and calls from people posing as Dubai Police staff, demanding immediate payment of fines through a link.
• Fake bank alert: an email or text says your account is blocked, needs updating or is due a refund, and pushes you to act urgently (ADCB).
• Fake government caller: someone claims to be from the police or Central Bank and asks for an OTP to 'update' your details or stop a visa being cancelled (ADCB).
• Fake WhatsApp from a 'friend' or 'relative' with a new number asking for money urgently. Call the person on the number you already have before doing anything.

How to read a suspicious message

• Ask: do I have an account with this company, and was I expecting this? If not, it may well be phishing (FTC).
• Look for red flags Dubai Police list: urgent payment demands, poor grammar or spelling, payment links, and unknown numbers or IDs that do not show an authority's name.
• Check email addresses carefully. Fake ones are often very similar to the real address (Khaleej Times, reporting Sharjah Police advice).
• Generic greetings such as 'Dear customer' and claims that your account is 'on hold' are common signs of phishing (FTC).
• The FTC notes that legitimate companies will not email or text you a link to update your payment information.

Read your OTP message, every time

• An OTP text from your bank usually says what it is for. ADCB advises reading the full OTP message to understand the transaction, and checking that the amount and merchant name match what you meant to pay.
• If you receive an OTP you did not request, someone may be trying to use your card or log in to your account. Do not share it, and call your bank on its official number.
• Sharjah Police have warned of a variant where a fake OTP step is used so the fraudster can complete a purchase with your card details (Khaleej Times).
• An OTP is like the key to your front door. Nobody legitimate needs you to read it out to them.

How to check safely and what to do if you clicked

• Never use the link or number in the message. Contact the organisation through a website or phone number you already know is real (FTC, NCSC).
• If you entered card details or bank details, contact your bank straight away and ask them to block the card (ADCB, NCSC).
• If you typed in a password, change it on that account and on any other account that uses the same password (NCSC).
• If you opened a link or installed something, run a security scan and let it fix any problems (NCSC, FTC).
• Report the message: Dubai Police ask people to report fake fine messages to their e-Crime service or call 901 (Gulf News, 2024).