Bank Biometric Verification: UAE Banking Kills SMS Codes

Banks across the U.A.E. just stopped sending the text message codes millions of people have typed in for years. Regulators gave them until March of twenty twenty-six. Most banks moved faster, and switched things off on 1/6/2026.

If you've ever waited for a six-digit code to buzz

If you've ever waited for a six-digit code to buzz your phone before you could pay for something, this story is about you. That little text has been the lock on a lot of people's money. And it turns out the lock was easier to pick than most of us thought.

Here's what happened. Fraud tied to SIM swaps and phishing jumped by roughly thirty-eight percent in the U.A.E. last year, according to reporting from Emirates twenty-four seven. The country's Central Bank responded. It ordered banks to drop text message codes for online transactions. Banks now ask for a face scan, and in some cases an iris scan, plus an approval inside the bank's own app. So the real question is this. When a bank can't trust a text message anymore, what does it trust instead? And is that safer for you?

Start with how the old system fails. A SIM swap is when a criminal convinces your phone company to move your number onto a card they control. Then the texts meant for you go to them. Your bank code arrives on a stranger's phone.

Notice what that takes

Notice what that takes. No elite hacking. Just a convincing phone call to a customer service desk. Phishing works the same way. A fake page asks you to type in your code, and you hand it over yourself.

Now the part that moved banks. The U.A.E. Central Bank didn't just recommend a change. According to the reporting, it required refunds for fraud losses tied to text message codes, once the claim was verified. That turned a known weakness into a bill. Security teams had flagged text codes as shaky for about a decade. Nothing happened until the weakness cost the banks real money.

For banks, that's a budget decision. For the rest of us, it means the safety of your account has often followed who pays the loss, not just what's technically best.

What replaces the text

So what replaces the text? Security people sort proof into three kinds. Something you know, like a password. Something you have, like your phone. And something you are, like your face. A text code leaned on the phone in your pocket. The new setup leans on you.

The U.A.E. isn't alone. Gulf News reports Singapore and other countries are pulling away from text codes too. And early movers in the U.A.E. reportedly included Emirates N.B.D., A.D.I.B., and First Abu Dhabi Bank.

Is a face scan unbreakable? No. Critics point to spoofed faces, deepfake video held up to a camera, and the privacy cost of banks storing face data. Those are fair worries.

Notice also what N

Notice also what N.I.S.T. says. Its digital identity guidelines now restrict text codes for high-security logins. But they don't require biometrics. They leave room for hardware keys and passkeys. The U.A.E. picked faces because they're easy for millions of ordinary customers. That's a practical choice. It isn't a promise of perfection.

For anyone running a clinic, a payment business, or a government service that still texts codes, the message is plain. Your risk has a price tag now. And for the rest of us, it means that six-digit code you've trusted for years may soon be something your bank quietly retires.

The surprise is that this isn't really a story about faces beating passwords. It's a story about money. Banks didn't change because the weakness was new. They changed when the weakness became their cost.