Bank fraud or scam in the UAE: getting your money back

If money left your account without your approval, call your bank's fraud line at once, block the card or account, then report to the police. The Central Bank of the UAE's Consumer Protection Standards give you at least 30 business days to report an unauthorised transaction. The bank must reimburse it after its investigation or within 30 calendar days, whichever is shorter, unless there is evidence you acted fraudulently or with gross negligence (clause 5.1.1.47). Unresolved disputes can go to Sanadak.

Who this guide is for

• People who see card payments, transfers or withdrawals they did not make.
• People tricked into sharing a one-time password (OTP) or sending money to a scammer.
• Relatives helping an older family member after a scam.

This guide is about recovering money from a bank licensed by the Central Bank of the UAE (CBUAE). For the criminal side, such as blackmail, fake profiles and online insults, see our cybercrime guide.

What to do in the first hour

Speed matters, because the bank can only block further transactions once it knows.

When you call the bank, the Standards say it must record the date, time and details of your report, explain your options to block, close or replace the account or card, and take steps to protect you from further unauthorised transactions (5.1.1.46). Ask for a reference number and write it down.

Will the bank refund me?

The answer depends on whether the payment counts as unauthorised.

Unauthorised transactions. These are payments you did not make or approve. The bank must reimburse them after its investigation or within 30 calendar days of your report, whichever is shorter. This does not apply where there is evidence you acted fraudulently or with gross negligence (5.1.1.47).

When the bank's checks were followed. A transaction is treated as authorised if the bank applied proper and secure validation, unless you can give prima facie evidence raising reasonable doubt that you made it (5.1.1.45). If the bank cannot clearly confirm and document your authorisation and the dispute continues, the Standards say it must be referred at once to a complaint resolution mechanism (5.1.1.48).

Sharing your PIN or OTP. Banks must warn customers in writing about their financial liability if they give their password or PIN to anyone (6.2.1.7). The Standards do not define "gross negligence" in these provisions, so whether sharing a code affects a refund depends on the facts. Give the bank your full account of how it happened.

Bank security failures. A bank may be liable for direct losses caused by breaches of its own security controls (6.2.1.11).

Payments you sent yourself. If a scammer persuaded you to make a transfer, the bank may treat it as authorised. Ask the bank at once whether it can contact the receiving bank to try to stop or recall the money. No official source found guarantees a recall. If an international transfer comes back, your bank must tell you within 2 complete business days and credit the money when received, unless it is carrying out a financial crime investigation (5.1.5.6).

Escalating to Sanadak

If the bank refuses a refund or does not reply, complain to it in writing first. The Standards require banks to acknowledge complaints within 2 complete business days and send a final written response within 30 complete business days, or another period the Central Bank sets (8.1.3.7). Sanadak's eligibility page says you can go to Sanadak once 15 calendar days have passed without a satisfactory written reply, while its FAQs say 30 calendar days, so confirm the current waiting period with Sanadak. Sanadak's scope includes financial loss caused by deceptive, misleading, fraudulent or unfair conduct by or for the institution, and filing is free. See our Sanadak guide for eligibility, appeals and timelines.

Step by step

1. Call your bank's fraud line. Report the transaction and ask for the card or account to be blocked.
2. Get a reference number. Note the date, time and the staff member's name.
3. Secure your accounts. Change your banking password and PIN from a clean device.
4. Report to the police. Use the channel for your emirate, and attach the bank reference.
5. Dispute in writing. Email the bank listing each transaction, the amount and why it was not authorised.
6. Ask about a recall. For a transfer, ask whether the bank can contact the receiving bank.
7. Keep evidence private. Save messages, call logs and links without forwarding them.
8. Track the 30-day refund period. Diary 30 calendar days from your report.
9. Complain formally if refused. Ask for the bank's final response with reasons in writing.
10. Escalate to Sanadak. File with the bank's reply and your police reference.

The legal deadline organiser can help you track these dates.

Documents checklist

• Bank statement or app screenshots showing each disputed transaction
• The bank's fraud reference number and any written replies
• Police report reference (eCrime, Aman, MOI or police station)
• Screenshots of the scam messages, calls, links or websites, with dates
• The receiving account name or IBAN, if you sent the money yourself
• A short timeline of what happened and when
• Emirates ID and UAE Pass access for online reporting

Common mistakes

• Calling the police before the bank. The bank is the one that can block further payments, so call it first.
• Replying to the scammer. Do not engage, pay more or share more codes.
• Missing the reporting window. You have at least 30 business days to report, but earlier is better.
• Leaving out details. Explain honestly how the transaction happened, including any code you shared.
• Trusting "recovery" agents. People who promise to recover money for a fee are a common follow-up scam.
• Skipping the written complaint. Sanadak normally needs proof that you complained to the bank first.

When to speak to a licensed lawyer

Consider licensed advice if a large sum is involved, the bank alleges gross negligence, the money went abroad, or you want to claim against the recipient or the bank in court. The free case check can help you set out the facts first, and CaseDaleel can introduce an independent licensed professional only if you choose.

Frequently asked questions

Will my bank refund an unauthorised transaction?

Under the Central Bank Standards, the bank must reimburse it within 30 calendar days of your report or after its investigation, whichever is shorter, unless there is evidence of fraud or gross negligence by you.

How long do I have to report a fraudulent transaction?

The Standards require banks to allow at least 30 business days after you were properly informed of the transaction, but report it as soon as you notice.

What if I gave the scammer my OTP?

The bank will consider how the transaction happened, and gross negligence can exclude a refund, so give the bank a full and honest account and escalate if you disagree.

Can a transfer I made myself be recalled?

Ask your bank immediately to contact the receiving bank; a recall may be possible, but no official source found guarantees it.

Which police channel should I use?

Use Dubai Police eCrime for incidents in Dubai, Aman in Abu Dhabi, or the MOI eCrimes platform in the MOI UAE app; call 999 in an emergency.

Can I complain to the Central Bank?

Complaints about CBUAE-licensed banks go to Sanadak, the ombudsman unit set up by the Central Bank, after you have complained to the bank.

Is a police report enough to get a refund?

No, the refund is decided by the bank under the Central Bank rules, so file a written dispute with the bank as well as the police report.

Official sources

• CBUAE Rulebook — Consumer Protection Standards, Article 5: Business Conduct
• CBUAE Rulebook — Consumer Protection Standards, Article 6: Protection of Consumer Data and Assets
• Dubai Police — Reporting E-Crime service
• Abu Dhabi Police — Aman service contact
• UAE Government portal (u.ae) — Cyber safety and digital security

General information, not legal advice. CaseDaleel is not a law firm.