The UAE Central Bank’s recent move to phase out one-time passwords (OTPs) in favor of stronger authentication methods highlights the Emirates’ leadership in protecting bank customers, especially as other regional peers lag.
New research indicates that while UAE regulators are strengthening digital security standards, banks across the GCC are showing alarming signs of complacency.
According to Proofpoint, a leading cybersecurity firm, the adoption of Domain-based Message Authentication, Reporting, and Conformance (DMARC) — a global email protocol designed to prevent phishing and spoofing — has decreased across the region. In 2024, 96% of GCC banks had published DMARC records, but by 2025, that number had dropped to just 77%. Even more concerning, only 60% of banks are enforcing the strictest “reject” policy to block fraudulent emails, compared to 71% a year prior.
These lapses are significant because phishing remains the most common fraud vector, particularly in financial services where customers rely on email for account alerts, password resets, and transaction notifications. Proofpoint’s study found nearly a quarter of top regional banks are taking no measures to prevent domain misuse. This exposes millions of customers to impersonation attacks, vulnerabilities the UAE Central Bank (CBUAE) aims to eliminate.
In July, CBUAE directed Emirates lenders to discontinue OTPs via SMS or email, seen as a weak security link. Instead, UAE banks are adopting biometric logins, app-based secure notifications, and token-driven multi-factor authentication, aligning with global best practices in financial hubs like Singapore and London, which are also moving away from OTPs vulnerable to SIM-swapping, spoofing, and interception.
Cybersecurity experts claim this regulatory foresight places the UAE steps ahead of its Gulf neighbors. “We see a concerning trend as the number of GCC financial institutions with published DMARC records decreases, exposing sensitive data to cybercriminals,” said Emile Abou Saleh, Vice President for Northern Europe, the Middle East, Turkey, and Africa at Proofpoint. “However, it’s never too late for banks to revisit security protocols and protect email traffic against phishing and fraud.”
Banking industry analysts note the stark contrast. “While the UAE tightens digital banking rules and pushes institutions toward more secure, customer-centric authentication, banks in other GCC states struggle to maintain momentum.”
Proofpoint’s analysis shows Oman, Bahrain, and Kuwait are among the weakest performers, with adoption rates below the regional average, creating a patchwork of protections across the Gulf, undermining customer confidence, and exposing cross-border transactions to greater risks.
The timing is critical as digital payments expand rapidly across the region. In the UAE, digital transaction value surpassed Dh1.5 trillion in 2024, with mobile banking adoption at record highs. Similar growth is seen in Saudi Arabia and Qatar as young, tech-savvy populations embrace cashless lifestyles. Without strong protocols like DMARC and secure authentication replacing OTPs, these gains come with increased fraud exposure.
UAE regulators also pair their policy with consumer education campaigns, ensuring residents understand phishing risks and the importance of multi-factor authentication. Conversely, analysts say several GCC markets still heavily rely on OTPs and outdated fraud-prevention tools, leaving customers less protected and more vulnerable to scams.
This divergence also impacts reputation. As the Gulf competes for international investors, demonstrating strong digital infrastructure and resilient banking security is crucial. By acting proactively, the UAE signals its ability to meet high consumer protection standards, reinforcing its position as a global financial hub. For its neighbors, the message is clear: accelerate the adoption of advanced safeguards or risk increased cybercrime exposure and diminished investor confidence.
For UAE customers, the benefits are immediate. Phasing out OTPs means reduced account takeover risks, safer digital payments, and increased trust in online banking. For the banking sector, it creates a more resilient foundation as competition intensifies across the Gulf.
Analysts emphasize the UAE sets a benchmark for the region. “While Proofpoint’s data shows backsliding elsewhere in the GCC, the UAE apex bank’s initiatives demonstrate strong regulatory leadership can pre-empt risks and drive higher standards. The question now is whether neighboring financial markets will follow or risk being left exposed as the digital banking revolution accelerates.”
