A leading UAE bank will begin replacing SMS one-time passwords (OTPs) with a more secure, faster app-based authentication method for online transactions starting November 1.
Dubai-based Emirates NBD bank said customers will soon receive push notifications on their mobile devices prompting them to approve transactions directly in the ENBD X app, eliminating the need for codes sent via SMS or email.
The shift is part of a sector-wide transition mandated by the Central Bank of the UAE, which has instructed banks to fully phase out SMS and email OTPs by March 2026.
“App-based authentication is both faster and safer. It minimises the risk of fraud linked to SIM-swap attacks, SMS interception and phishing scams,” the bank said.
Rollout in phases
The first phase, beginning 1 November, will cover account transfers and low-value alerts, reportedly including transactions of Dh100 or less. Push-based approvals for debit and credit card transactions will follow in later phases.
The bank has urged customers to update the ENBD X app, enable push notifications and activate biometric login to ensure smooth access once the new system is in place.
Why the change matters
SMS and email OTPs have long been a target for cyber-fraud. Criminals often exploit weak telecom security or trick customers into sharing OTPs.
App-based authentication instead verifies transactions inside a secured app bound to the customer’s registered device, often requiring a fingerprint or facial recognition scan before approval.
Industry experts say the new process improves security, speeds up approvals and reduces reliance on SMS networks, which can sometimes be delayed or blocked, especially for overseas users.
What customers should do
Emirates NBD advises its customers to take these steps:
- Download or update the ENBD X app.
- Register their mobile device and enable push notifications and biometrics.
- Ensure their contact details are up to date with the bank.
- Familiarise themselves with fallback options, such as Smart Pass or customer support lines, in case they lose their device or face issues while travelling.
The bank warned that customers who do not activate in-app authentication may face delays or disruptions in processing online payments, including peer-to-peer transfers, international remittances and card-linked online shopping transactions.
