No more OTPs? Here's how banks will fight scams

Onetime passwords or OTPs are now outdated in the face of the dramatic rise in sophisticated banking frauds, a Dubai-based cybersecurity expert told Khaleej Times, following news that UAE banks will gradually stop sending onetime passwords (OTPs) via SMS and email for digital transactions starting July 25.

- Angel Tesorero

Instead of OTPs, banks will shift to authentication via mobile banking apps, using in-app confirmation features. Cybersecurity expert Rayad Kamal Ayub praised UAE banks and regulators for "adopting groundbreaking authentication technologies to secure transactions, safeguard customer identities and provide frictionless user experiences". "The Central Bank of the UAE has taken decisive steps since 2024, spurred by persistent calls from industry leaders and media like Khaleej Times, to overhaul traditional authentication methods — especially OTPs — which have proven vulnerable to modern hacking techniques," he added.

Rayad, who is also managing director of UAE-based Rayad Group, also shared emerging authentication technologies, and how each type encounters fraud risks and redefines customer trust in the banking sector.

1. Passkeys & FIDO2 authentication

"The era of easily compromised passwords is drawing to a close," noted Rayad. Passkeys, built on the FIDO2 (Fast IDentity Online 2) standards, enable password-less authentication by leveraging cryptographic keys stored directly on a user’s device. When combined with biometric sensors — like face ID, touch ID, or Android’s equivalent — passkeys offer a seamless, one-touch login experience.

Key features:

>> Passwordless, leveraging asymmetric cryptography for security

>> Biometric integration (facial recognition, fingerprints)

>>> Resistant to phishing attacks, SIM swaps and credential stuffing that are frequently used by scammers

Rayad said UAE banks are piloting passkey-based logins to replace or augment OTPs, drastically reducing the risk of interception or duplication. "Because of this, customers benefit from smoother, faster access to services, while institutions see a drop in account takeover attempts.

2. Decentralised Identity (DID)