You set up two-factor security by turning on app-based verification or one-time codes in each bank app and government account, starting with UAE PASS, your email, and your main UAE bank. In Dubai this takes about an hour to do properly for all your key accounts, and it is the single best protection against the SMS and WhatsApp scams that target residents every week. Do your bank, UAE PASS and email first — everything else can follow.
Quick facts
- Cost: Free — authenticator apps and UAE PASS cost nothing
- Time needed: 10–15 minutes per account, about 60 minutes for your full set
- Where it happens: In each app’s security settings, plus UAE PASS and DubaiNow
- What you need: Your Emirates ID, your UAE mobile number, and a second device or notebook for backup codes
- Strongest option: Authenticator app or hardware approval beats SMS codes wherever it is offered
Step-by-step: Secure your accounts in the right order
- Secure your UAE mobile number first. Your SIM is the key to almost everything. Set a PIN on your du or Etisalat by e& account, never share one-time codes with anyone who calls you, and remember that Dubai Police and your bank will never ask you to read out a code.
- Turn on UAE PASS verified login. Download UAE PASS, verify your Emirates ID with facial recognition, and set a PIN and biometric unlock. Enable notifications so you see every sign-in request and can reject one you did not make.
- Protect your email account. Your email resets everything else. Turn on two-step verification in Gmail, Outlook or iCloud, save the backup codes offline, and check which devices are already signed in — remove any you do not recognise.
- Open each bank app’s security centre. In apps for Emirates NBD, FAB, ADCB, Mashreq, HSBC UAE and others, enable biometric login, transaction notifications for every amount, and device binding so the app only works on your phone. Turn on instant alerts for online and international transactions.
- Add two-factor to DubaiNow and government portals. DubaiNow, ICP, GDRFA, MOHRE and TAMM accounts should all require UAE PASS or a one-time code. Sign in once with UAE PASS linked properly rather than keeping old passwords.
- Secure WhatsApp and social accounts. In WhatsApp, go to Settings, Account, Two-step verification and set a PIN — this stops the common account-takeover scam that then targets your contacts. Do the same for Instagram and Facebook.
- Save backup codes safely. Write recovery codes on paper kept at home or store them in a reputable password manager. Do not screenshot them into a photo album that syncs everywhere.
- Test everything. Sign out and back in on one account to confirm the second step works and notifications reach you. Check what happens if you lose your phone — your bank’s call centre number should be saved in a second place.
Which second factor should you choose?
Banks in the UAE mostly use in-app approval, SMS codes, or both. In-app push approval is strongest because it is tied to your specific device. Authenticator apps such as Microsoft Authenticator or Google Authenticator are excellent for email and social accounts. SMS codes are better than nothing but are the weakest option, because a swapped or hijacked SIM receives your codes. If your bank lets you disable SMS fallback after enabling app approval, consider doing so. For very large transfers, many UAE banks already add a cooling period for new beneficiaries — leave that protection on, even if it feels slow the first time.
Documents and settings to check
You do not need documents beyond your Emirates ID for UAE PASS, but do check that the mobile number registered with your bank, ICP and your telecom provider is the same current number. An old number still on file is a common reason residents get locked out after changing SIMs. Also update your email address with your bank if you still use a work email you could lose when you change jobs. In DubaiNow, review the linked services once you have secured UAE PASS, so a single strong login protects your DEWA, RTA and Dubai Police services together.
Common mistakes to avoid
Never approve a UAE PASS or bank notification you did not trigger — deny it and call the bank on the number on your card. Never install remote-access software at a caller’s request, and never move money to a so-called safe account; no UAE bank or Dubai Police officer will ask you to do that. Another mistake is using the same password for your bank, email and a shopping site — use a password manager and unique passwords. Finally, do not ignore small test transactions or unfamiliar device logins in your alerts. Report them the same day, because banks can block cards and reverse pending transfers far more easily in the first few hours.
FAQ
What should I do if I lose the phone that has my authenticator?
Use your saved backup codes to sign in, then re-enrol your new phone and cancel the old device in each app. Call your bank immediately to deregister the lost device and suspend mobile banking until you are set up again.
Is SMS two-factor good enough for UAE bank accounts?
It helps, but in-app approval tied to your device is stronger. Enable biometric login and push approvals wherever your bank offers them, keep SMS only as a backup, and protect your SIM with a PIN and account password.
Someone called claiming to be Dubai Police and asked for my OTP. What do I do?
Hang up. Dubai Police and UAE banks never ask for one-time codes, PINs or UAE PASS approvals by phone. Report the number through Dubai Police eCrime or the bank’s official fraud line found in its app.
