"Your UAE Pass has been suspended due to unusual activity. Verify your identity within 24 hours or your account will be closed." The message looks official, carries a government logo, and the link in it leads to a page that looks exactly like the real UAE Pass login — right down to the branding. The only problem: the page is fake, and the moment you enter your password and the one-time code, a fraudster now controls your digital identity. This digital-ID phishing pattern — aimed at UAE Pass, Emirates ID and government app users — is one of the fastest-growing scams in the UAE, because the UAE Pass is the master key to banking, government services and property records.
How the digital-ID trick works
The fraudster sends an SMS, email or WhatsApp message pretending to be from UAE Pass, the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP), or a government department. The message creates urgency: your identity is "blocked", "expired", "under review", or a fine needs paying immediately. The link inside leads to a cloned page — sometimes a near-perfect copy of the official login, sometimes a page that asks for your Emirates ID number, passport details and the OTP from your phone.
Two things make this scam dangerous. First, the fake page captures everything you type. Second, the fraudster triggers a real OTP so the code on your screen looks legitimate — then uses it to reset your UAE Pass PIN, access your account, or verify a transaction in an app you use. Your digital identity is worth more to criminals than a single card number, because it unlocks everything else.
The official UAE Pass rules that expose the scam
- UAE Pass never sends links asking you to "verify" or "unlock" your account by entering your password and an OTP on a web page reached from a message. You log in only through the official UAE Pass app.
- Official UAE government services are reached through u.ae or the official apps of each authority — never through a link in a text message.
- No government body will ask for your OTP, PIN or full Emirates ID details over a phone call, SMS or WhatsApp. Any request for a one-time password is a red flag by itself.
- If your account really were suspended, the warning would appear inside the official app when you open it — not in an SMS demanding you act within hours.
Red flags
- A message that arrives late at night or on a weekend with a tight deadline.
- A link that is not on an official domain ending in .ae or u.ae — check the exact spelling; cloned addresses swap letters (for example "u-ae-login" or "uae-pass-verify").
- Spelling errors, generic greetings like "Dear customer", or threats to close your account.
- Any request for your OTP, no matter how official the message looks.
- The same pattern appears across the Gulf with Absher in Saudi Arabia, Tawakkalna, Metrash2 in Qatar and government apps elsewhere — the trick is identical, only the logo changes. See our Saudi digital-ID guidance and the official reporting routes for each country.
If you have already clicked and entered your details
- Do not wait. If you shared an OTP, contact your bank immediately and ask it to freeze your accounts and cards — a fraudster may already be trying to use your identity to authorise payments.
- Open the official UAE Pass app and change your PIN and password. If you cannot access your account, use the official UAE Pass support channel to report that your account has been compromised.
- Change the passwords of any other service where you reused the same credentials.
- Keep screenshots of the message, the link, and the fake page as evidence.
- Report the incident — see the reporting routes below.
How to report it
In the UAE, report digital-ID and government-app phishing through Dubai Police's e-crime service (available in the Dubai Police app) or the UAE's official e-crime platform, and notify ICP through its official channels if your Emirates ID data was involved. Always open official reporting links from cyberawareuk.com/report, never from a message you received.
Emergency
UAE police emergency: 999. If money has been taken or a fraud is in progress, call 999 first — no bank or authority will penalise you for reporting quickly.
Remember: your digital identity is your master key. The real UAE Pass never asks you to prove it works by clicking a link in a text message.