Card fraud and disputed transactions in the UAE: what to do

Block the card and report the transaction to your bank straight away: UAE banks must run reporting channels 24 hours a day. Central Bank rules give you at least 30 business days to report an unauthorised transaction and require the bank to refund it within 30 calendar days, unless you acted fraudulently or with gross negligence. Report scams to the police as well.

Key takeaways

• Block the card first: banks must offer phone and digital channels to report fraud 24 hours a day, 7 days a week.
• You have at least 30 business days to report an unauthorised transaction, but report it at once.
• The bank must refund an unauthorised payment within 30 calendar days of your report, or sooner if its investigation ends first.
• The refund rule does not apply if there is evidence you acted fraudulently or with gross negligence, and your bank must warn you of your liability if you share your PIN or password.
• Report scams to the police through the Dubai Police eCrime platform, Abu Dhabi Police's Aman service or the MoI app.

The rules come from the Central Bank of the UAE (CBUAE) Consumer Protection Standards and cover cards, accounts and digital payment instruments from any licensed bank or finance company. For your wider rights as a borrower, see our Borrower rights guides.

What to do in the first hour

Stop further payments first, then build a record: block the card, report every transaction you did not make and keep the bank’s reference number.

1. Block or freeze the card. Use the bank’s app or its reporting phone line. The bank must tell you how and where to report a lost or stolen card or an unauthorised transaction, so look in its app, on its website or in your card documents.
2. Report each transaction. Give the date, amount and merchant for every payment you did not make. The bank must record your report with the date and time it received it. Ask for a reference number and note who you spoke to.
3. Choose what happens to the card. The bank must explain your options: block it while it investigates, close it, or cancel it and issue a replacement. Closing has its own steps, covered in closing a credit card.
4. Change your security details. Change your online banking password and your card PIN.
5. Report to the police if you were scammed or someone obtained your card details (see below).
6. Watch your alerts. Your bank must tell you of every transaction as it happens, by free SMS or by email on request, and show the details in mobile or online banking (Standards, Article 2).

Fraud reporting channels

24/7

Licensed financial institutions must provide responsive digital and phone channels, 24 hours a day and 7 days a week, for consumers to report loss, theft, fraud or misuse of their accounts, credit or payment cards and digital instruments.

Your rights when a transaction was not yours

You have at least 30 business days to report an unauthorised transaction, and the bank must refund it within 30 calendar days of your report, unless it has evidence that you acted fraudulently or with gross negligence.

How long you have to report

The period runs from when you have been properly informed of the transaction.

Time to report an unauthorised transaction

At least 30 business days

Consumers must be allowed at least 30 business days to report an unauthorised transaction after being properly informed of it; when one is reported, the institution must record it with the date and time, tell the consumer the options of blocking, closing or cancelling and replacing the account, card or instrument while it investigates, and take the steps needed to prevent further unauthorised transactions.

When you report, the bank must also take the steps needed to protect you from further unauthorised transactions.

When the bank must refund you

The bank must refund the payment when its investigation ends or within 30 calendar days, whichever comes first. The 30 days run from the day you first reported the payment or the bank identified it.

Refund of an unauthorised payment

Within 30 calendar days

Unauthorised payments must be reimbursed to the consumer after the investigation is completed or within 30 calendar days of the day the matter was first reported by the consumer or identified by the institution, whichever is shorter, unless there is evidence that the consumer acted fraudulently or with gross negligence.

Worked example

Unauthorised online payments of AED 2,400 and AED 600, reported on 10 November 2026

The amounts and dates are illustrations. The payments are assumed to be unauthorised, and the bank is assumed to work Monday to Friday.

1. Tuesday 10 November 2026: an SMS alert shows an online payment of AED 2,400 you did not make. A second payment of AED 600 goes through before you block the card. You report both the same day.
2. Amount reported: AED 2,400 + AED 600 = AED 3,000.
3. Refund deadline: 10 November + 30 calendar days = Thursday 10 December 2026, or earlier if the bank finishes its investigation first.
4. You also complain in writing that day. Acknowledgement: 2 complete business days, Wednesday 11 and Thursday 12 November, so by Thursday 12 November.
5. Final answer to the complaint: 30 complete business days. 30 ÷ 5 business days a week = 6 weeks, so about six weeks, later if public holidays fall in that period.

On these dates, the bank must refund the AED 3,000 by Thursday 10 December 2026, unless it has evidence that you acted fraudulently or with gross negligence.

When the bank can refuse

The refund rule does not apply where there is evidence that you acted fraudulently or with gross negligence. The Standards do not define gross negligence.

A second rule sets the starting point: a payment the bank checked with proper and secure validation counts as authorised unless you can show otherwise.

When a payment counts as authorised

Presumed authorised

A transaction is considered authorised if the institution applied proper and secure validation procedures, unless the consumer provides prima facie evidence that establishes reasonable doubt that they carried out the disputed transaction.

In plain words, if a payment was approved with a one-time password or another security step that the bank applied properly, the rule starts from the position that you made it. To shift that, you need prima facie evidence: enough, on its face, to raise a reasonable doubt that you carried it out. Keep everything that shows the timeline: the alert, your report to the bank, any police reference and the messages you received. The bank decides first; Sanadak or a court can review it.

Where the bank cannot clearly confirm and document that you authorised the payment, and liability is still disputed, the Standards say your complaint must go at once to a complaint resolution mechanism (Standards, 5.1.1.48).

If the bank’s own security failed

A licensed bank may be liable for direct losses caused by breaches of its own security controls (Standards, Article 6). It must also tell you without delay if your personal data has been accessed without authorisation in a way that may put your financial security at risk.

Card machines are covered too. Banks must monitor ATMs and point-of-sale terminals for fraud, and where there is evidence of tampering, they must review their records and related complaints to find past transactions treated as authorised that need to be reversed (Standards, 5.1.2.9).

Disputing a payment you did make

If you made the payment but something went wrong, such as the wrong amount, a double charge or goods that never arrived, contact the merchant first, then challenge the item with your bank, which must investigate immediately.

Wrong amount, double charge or goods not received

Banks and finance companies must investigate immediately when you challenge any item on your credit card statement (Regulation 29/2011, Article 5(d)). That article sets no deadline for the investigation. The Central Bank’s definition of an unauthorised transaction also includes an incorrectly executed payment (Consumer Protection Regulation, Article 1), but the rules we read do not say whether a merchant’s double charge or wrong amount counts as one. Ask the bank in writing which timetable it applies; the complaint deadlines further down apply in any case.

Your monthly statement must list the bank’s channels for reporting disputed transactions and making complaints, with its response time (Standards, Article 2). Before you raise a dispute, keep the receipt, order confirmation, delivery tracking and your messages with the merchant. If you need a copy of the sales voucher, the bank’s fee is capped, with VAT added on top.

Maximum fee for a copy of a sales voucher

AED 65

The fee for a copy of a credit card sales voucher is capped at AED 65.

The rules we read do not say whether interest or a late fee can run on a disputed amount while the bank investigates. Ask the bank in writing how it will treat the amount, and see credit card interest and fees for how card interest works. To see what interest on an unpaid balance would cost, try the credit card payoff calculator.

What a chargeback is

A chargeback is the process your bank uses, through the card network, to reclaim a card payment from the merchant’s bank. You do not deal with the network yourself: you raise a disputed transaction with your bank. The Central Bank rules we read set no chargeback steps or time limits, so ask your bank what evidence it needs and by when.

Scams where you approved the payment

If you were tricked into approving a payment or sharing a one-time password, the payment may count as authorised, and the refund rule excludes gross negligence. Report it at once to the bank and the police anyway.

Such scams include phishing calls and messages, fake payment links and requests to read out a one-time password. The government’s cyber safety page advises against clicking unknown links sent by text message and says victims of electronic fraud should report it to the official authorities immediately and not give in to threats (u.ae).

Banks must warn you about the consequences of sharing your personal information, PIN or other security details, and advise you in writing of your financial liability if you give your password or PIN to anyone (Standards, Article 2 and Article 6). The Standards do not define gross negligence or list what counts as it, so if you disagree with the bank’s decision, use the complaint route below.

Reporting fraud to the police

Report online through the Ministry of Interior, Dubai Police or Abu Dhabi Police channels, or at a police station.

Where to report online fraud

eCrime, Aman, MoI app, 999

The UAE Government portal lists these channels to report cybercrimes online: the Ministry of Interior eCrimes platform in the MoI UAE app, the Dubai Police eCrime website, the Abu Dhabi Police Aman service and the Federal Public Prosecution's My Safe Society app; crimes can also be reported at the nearest police station or by calling 999.

The government’s economic crimes page says cyber-enabled financial crimes and scams can be reported through the Dubai Police eCrime platform, and that for fraud and scams in general you contact your local police. The same page says the Central Bank takes reports of fake emails and postings that pretend to be Central Bank messages (u.ae).

Keep the police report and its reference number: a dated record helps when you deal with the bank and in any complaint.

If the bank refuses or does not answer

Complain to the bank in writing, then take it to Sanadak, the ombudsman, if the answer does not settle it.

Bank's acknowledgement of your complaint

2 business days

A bank or other licensed institution must acknowledge a written complaint within 2 complete business days.

Bank's final answer

30 business days

A licensed institution must send its final written response to a complaint, with detailed reasons, within 30 complete business days of receiving it, or another limit the Central Bank sets.

Filing with Sanadak is free for consumers and SMEs (Sanadak FAQs), but it may turn a complaint away if the bank has not had time to answer.

Wait before going to Sanadak

15 calendar days

Sanadak may reject a complaint if the consumer did not first complain formally to the bank or insurer, or did not wait 15 calendar days after raising it there.

Who can file, time limits and appeals are set out in how to complain about a bank and use Sanadak, and the rules banks follow in your consumer protection rights.

Check your credit report afterwards

If the fraud led to a card or loan in your name, or the bank reported arrears on a disputed amount, ask for the data to be corrected. You can ask the lender directly:

Lender's correction of credit data

7 business days

When a consumer asks a licensed institution to update or correct data it reported to a credit information agency, the institution must acknowledge the request and check whether it is accurate; if a correction is needed, it must report it to the agency within 7 complete business days of being notified by the consumer.

Or go through the Etihad Credit Bureau (AECB), which passes your request to the lender:

Correcting your AECB report

Free

Data correction is free for any credit report bought in the last 30 days; the bureau passes the request to the information provider, and the report should be updated within 10 working days.

To see what lenders have reported, check your AECB report, and use our guide to reading your AECB credit report to spot accounts you do not recognise. Disputing an error directly with the bureau is covered in a separate guide we plan to publish.