Several major UAE banks have confirmed that, from 6 January 2026, they will no longer use SMS one-time passwords (OTPs) to authenticate online card transactions. Instead, customers must approve payments via their bank’s mobile app using biometrics or a secure PIN, in line with Central Bank of the UAE guidance aimed at curbing digital fraud.
For international assignees and frequent travellers this is more than a cybersecurity tweak. SMS OTPs often fail when phones are roaming or carry foreign SIMs, leading to card declines that can strand travellers at hotels, rental-car desks or e-gate top-up kiosks. The shift to app-based authentication removes dependence on local mobile networks and should, in theory, make payments smoother for expatriates and visiting business travellers.
![UAE Banks to Scrap SMS OTPs on 6 January; Biometric In-App Approval Becomes Mandatory]()
Global mobility managers should alert relocating employees to download and register the relevant banking apps, enable push notifications and set up Face ID or fingerprint log-ins before the cutoff date. Failure to prepare could leave newcomers unable to pay deposits on housing, schooling or utilities upon arrival.
Corporate travel cards issued by UAE banks will follow the same rules; programme administrators should verify that cardholders have app access and biometric-capable devices. Finance teams may need to update expense-policy guidance to reflect the new approval flow and to assist travellers whose transactions are declined for lack of in-app authentication.
The change underscores a broader regional trend toward digital-identity verification, with GCC regulators expected to monitor the UAE rollout as a possible template for cross-border payment security.
For international assignees and frequent travellers this is more than a cybersecurity tweak. SMS OTPs often fail when phones are roaming or carry foreign SIMs, leading to card declines that can strand travellers at hotels, rental-car desks or e-gate top-up kiosks. The shift to app-based authentication removes dependence on local mobile networks and should, in theory, make payments smoother for expatriates and visiting business travellers.
Global mobility managers should alert relocating employees to download and register the relevant banking apps, enable push notifications and set up Face ID or fingerprint log-ins before the cutoff date. Failure to prepare could leave newcomers unable to pay deposits on housing, schooling or utilities upon arrival.
Corporate travel cards issued by UAE banks will follow the same rules; programme administrators should verify that cardholders have app access and biometric-capable devices. Finance teams may need to update expense-policy guidance to reflect the new approval flow and to assist travellers whose transactions are declined for lack of in-app authentication.
The change underscores a broader regional trend toward digital-identity verification, with GCC regulators expected to monitor the UAE rollout as a possible template for cross-border payment security.
