"This is your bank's fraud team. We have blocked a suspicious transaction on your card. You will receive a code by SMS — please read it back to secure your account." The tone is urgent and the message feels official, and the code on your screen is real: your bank really did send it. But the caller is a fraudster, and reading the code aloud is exactly what lets them drain your account. This "verify your card" pattern — sometimes combined with a SIM swap — is one of the most reported bank scams in the UAE.
How the OTP trick works
The caller already holds fragments of your information, often a partial card number obtained from a leaked database. The one-time password (OTP) is the last piece they need. Your bank's SMS is actually a security warning, but the fraudster presents it as "verification". Once you read the code back, they can approve a payment, register your card in a digital wallet, or empty a linked account. A real bank employee will never ask for your full OTP, your password or your PIN. Anyone who does is a fraudster.
When a SIM swap is involved
In the SIM-swap version, the criminal contacts your mobile provider pretending to be you and requests a replacement SIM, moving your number to a card they control. From then on, your bank's OTPs arrive on their phone, not yours. Warning signs include your phone suddenly showing "no service" or losing signal for no reason in a well-covered area, and SMS messages that stop arriving. If you notice either, contact your telecom provider immediately using the number on its official website — not any number that called you.
How to check safely
Never share an OTP with someone who called you, even if caller ID shows your bank's name — caller ID can be spoofed. End the call and open your bank's official app or website yourself, ignoring every link in the suspicious message. Check your recent transactions, and if anything looks wrong, use the app's "freeze card" option before doing anything else. Keep your own note of your bank's real phone number, stored separately from the scammer's message.
If you have already been tricked
Speed matters more than embarrassment. Call your bank using the number printed on the back of your card, ask it to freeze your accounts and cards, and change your app password right away. Keep the suspicious message and the caller's number as evidence. Report what happened — the earlier the authorities know, the better the chance of tracing the money.
How to report it
In the UAE, report financial scams through Dubai Police's e-crime reporting service (available in the Dubai Police app) or the UAE's official e-crime platform. The current official reporting channels are also listed on cyberawareuk.com/report — always open links from official sources, never from the scammer.
Emergency
UAE police emergency: 999. If a fraud is in progress or someone is being pressured, call 999 first — your bank will not penalise you for reporting quickly.