How to Report a Scam in the UAE and Try to Get Your Money Back

This guide is for UAE residents who have lost money, card details or codes to a scam that has nothing to do with a job: fake police, bank or government callers, phishing links, card or wallet payments you never made, and deposits paid to fake sellers or landlords. A fake job offer has its own guide, how to verify a UAE job offer. For an ordinary refund dispute with a shop, see consumer complaints in the UAE; if you suspect fraud, go to the police. The guide is part of the personal finance guide.

At a Glance

The First Hour

Act at once, so the bank can block the card or account and stop further payments.

Step 1 — Stop the contact. Hang up, stop replying and don't send another payment or code, whatever the caller threatens. The UAE Government Portal's advice to victims of electronic fraud is not to give in to threats and to report the incident to official authorities immediately.

Step 2 — Call your bank on a number you trust. Use the number on the back of your card or in your banking app, never one a caller or a message gave you. Central Bank of the UAE (CBUAE) standards require banks to keep digital and phone channels open around the clock so customers can report the loss, theft or misuse of their accounts and cards. When you report an unauthorized transaction, the bank must record the date and time and what you told it, tell you your options (blocking the account, card or digital instrument while it investigates, closing it, or canceling and replacing it) and take the steps needed to protect you from further unauthorized transactions. Ask for the reference number of your call.

Step 3 — Keep the evidence. Screenshot the messages, call log, links, the scammer's numbers and account details, and the transaction confirmations. Keep the original chat too, so you can hand it over when asked.

Step 4 — Report to the police. Use one of the channels in the next section and keep the report or case number.

Step 5 — Put it to the bank in writing. Raise a formal complaint through the bank's complaint channel, and add the police reference when you have it. The bank must acknowledge the complaint in writing within 2 complete business days and give it a unique reference number, which you will need if you escalate.

Where to Report a Scam

The UAE Government Portal lists the official channels for reporting cybercrime, and for fraud and scams it says to contact your local police.

It helps to have your Emirates ID, the scammer's numbers, accounts and links, your screenshots and your bank's reference ready.

Two numbers are often given for scams and do something narrower:

• 901 is Dubai Police's call center for non-emergency situations and customer inquiries, including questions about its crime reporting services.
• Aman is Abu Dhabi Police's confidential 24/7 channel for passing on information, including about phone fraud and blackmail: call 8002626, text 2828, call 009718002626 from abroad, or email aman@adpolice.gov.ae. It is free and works in Arabic, English and Urdu. Aman's own FAQ says it receives security information and is not a channel for opening an official report, so use one of the channels above for your case.

Other routes depend on what the scam pretended to be:

• Fake Central Bank messages. The government portal says fraudulent emails and internet postings claiming to be CBUAE communications can be reported to the CBUAE itself.
• Unwanted marketing calls. The Telecommunications and Digital Government Regulatory Authority (TDRA) page on telemarketing gives 2211 and 1012: send "DNCR" to join the Do Not Call Registry, and send a caller's number to report an unwanted telemarketing call. That page doesn't mention fraud, so report a call that tried to take your money or your codes through the channels above.

Which Scam Goes Where on This Site

Some scams have their own guide, with the checks that expose them and the official service to use. For the police report itself, use the channels above.

Getting Your Money Back From Your Bank

The CBUAE's Consumer Protection Regulation (Circular No. 8 of 2020) and its Standards treat payments you did not authorize very differently from payments you authorized, so the first question is whether you authorized the payment.

Payments you did not authorize

The Regulation defines an unauthorized transaction as a payment instruction carried out without your explicit authentication or authorization, and it also covers payments carried out incorrectly. For those, the Standards give you three protections:

• Time to report. Your bank must allow you at least 30 business days to report the transaction from the date you were properly informed of it. That is the minimum the bank must allow, not a reason to wait: report the same day.
• A refund deadline. The bank must reimburse an unauthorized payment once it has finished investigating, or within 30 days of the day you first reported it, whichever comes first. (The English text says 30 calendar days; the Arabic says 30 days.)
• A referral when the bank can't prove you approved it. If the bank cannot clearly confirm and document that you made or authorized the transaction and the dispute continues, the complaint must be referred straight away to a complaint resolution mechanism.

The Regulation adds a wider rule: banks must compensate customers in a timely manner for losses and expenses caused by financial crime, misappropriation, cyber-attacks and misuse of their assets or information, unless it is proven that the loss resulted from the customer's gross negligence or fraudulent behavior. Since September 2025 the Central Bank law (Federal Decree-Law No. 6 of 2025, Article 149) has also required banks to run effective fraud prevention and detection to protect customers against unauthorized transactions, social engineering and identity theft, to notify affected customers of security breaches or fraud incidents immediately, and to take immediate corrective action to limit the damage.

The limits: verified payments, OTPs and gross negligence

Two rules cut the other way.

First, a transaction is treated as authorized if the bank applied proper and secure verification, unless you produce prima facie evidence that gives reasonable grounds to doubt that it was carried out with your knowledge. The Standards don't say which verification procedures count; a bank may say that a payment approved with your OTP or app login passed them.

Second, the refund rule does not apply at all where there is evidence that you acted fraudulently or with gross negligence. Neither the Regulation nor the Standards define gross negligence. Among the security warnings banks must give customers in writing, the Standards include the financial liability customers bear if they give their password or PIN to anyone, or leave it written down where others can see it; they don't say whether an OTP counts as a password. Whether sharing a code was gross negligence is decided first by the bank, then by Sanadak or a court if you take it further.

So if a scammer used a code you gave them, still report it, still claim, and ask the bank to explain in writing the procedure and evidence it relies on. Its final response has to give detailed reasons for a rejection, unless the reason relates to its financial crime compliance obligations (which include fraud rules) or the law prohibits giving it.

Money you sent yourself

A transfer you made to a fake seller, landlord, "investment" or "officer" is not an unauthorized transaction: you authorized it, even though you were deceived, so the refund rule above doesn't cover it. The wider compensation rule for financial-crime losses doesn't mention payments you authorized either way, and none of the texts read for this guide say whether it reaches them; you can cite it in your complaint, but don't count on it.

What you can do is ask your bank, immediately, to contact the bank that received the money and ask it to return or hold the funds, quoting your police reference. That is a request, not a right: none of the rules above require the receiving bank to return money you sent. If you sent it through an exchange house or remittance service, ask straight away about cancellation: providers must, where possible, tell you before a remittance how and within what period you can cancel it, that a refund may use a different exchange rate, and what a cancellation can cost. Neither your bank nor a police report guarantees that the receiving account is frozen or the money returned, and this guide can't promise either.

Card payments you dispute

Disputes over a card payment go through your bank's channel for disputed transactions, which credit card statements must show along with the response time. Ask the bank what it needs from you and by when. Card-network deadlines are not in the CBUAE rules this guide relies on, so take the bank's answer in writing.

Escalating to Sanadak

Sanadak is the independent unit the Central Bank set up to resolve complaints against the banks and other financial institutions and insurers it licenses. Its complaint process reviews what your bank did, for example a refusal to refund that breaks the CBUAE rules above. The crime itself goes to the police.

Before Sanadak: complain to the bank first and get the reference number. The bank has up to 30 complete business days to send its final response in writing, and that response must tell you how to escalate an unresolved complaint within the bank. Separately, the bank must tell you in writing of your right to take the complaint to Sanadak and give you Sanadak's contact details.

When you can file: Sanadak's eligibility page says it may reject a complaint if you did not wait 15 calendar days after complaining to the bank. Its FAQ, in the section on licensed financial institutions, tells consumers to wait 30 calendar days for a response, and the 2023 regulation behind it lets Sanadak reject a complaint where the bank has not had at least 30 complete business days to give its final answer, unless the Central Bank sets another limit. The regulation makes no exception for a bank that answers early, so the course least likely to be rejected is to file once 30 complete business days have passed since you complained to the bank. If the bank's final answer comes sooner and you want to file before then, ask Sanadak first.

Time limits: file within whichever ends later: 3 years from the conduct you complain about, or 2 years from when you became aware of it. Sanadak may still review a late complaint if it considers that fair, taking into account, among other things, whether and how the bank told you of your right to complain to Sanadak, any negotiations with the bank, and whether you were in extraordinary circumstances. It may reject a complaint whose subject is or has been before a UAE court; for complaints against banks you can also go to court directly.

How: online, through the Sanadak app, by phone on 800SANADAK (800 72 623 25) or in person in Abu Dhabi, with your documents and a clear description. Filing is free for consumers.

What it can decide: the complaint is upheld, partly upheld or rejected. If it is upheld in whole or in part, Sanadak can direct the bank to correct what it did and recommend that it pay a reasonable amount for the actual loss or harm the bank's conduct caused. The bank must comply within the period set; if it doesn't, Sanadak (or the Appeals Committee) reports the case to the Central Bank for investigation and any enforcement action it deems appropriate. Either side can appeal to the Appeals Committee within 30 business days of the decision. An appeal costs AED 500: Sanadak's FAQ says the fee is refunded if the appeal goes your way, while the regulation leaves the refund to its discretion, and Sanadak's head (the Chief Ombudsman in the English text, the Director General in the Arabic) can waive all fees for complainants who cannot afford them.

Article 148 of the 2025 Central Bank law, which provides for the Central Bank's independent complaints unit, also provides for dispute committees within that unit, each headed by a judge. Their decisions are final and enforceable against the bank, which cannot challenge them, in disputes up to AED 100,000. Above that amount a decision is not final and enforceable on issue, and the bank or the customer can challenge it in the Court of Appeal within 30 days of its issue or of learning of it.

Frequently Asked Questions

I got scammed in Dubai. What should I do?

Call your bank's fraud line first, on the number on your card or in your app, and block the card or account. Then report it through Dubai Police's eCrime platform, the Ministry of Interior's eCrimes platform in the MOI UAE app, the Public Prosecution's My Safe Society app or a police station, or call 999 if it is an emergency. Keep the police reference number and add it to your written complaint to the bank.

How do I report a scam call or number in the UAE?

Report it through the official channels: the eCrimes platform in the MOI UAE app, Dubai Police's eCrime platform, the My Safe Society app or your local police station. In Abu Dhabi you can also pass the number to the police's Aman service on 8002626 or by SMS to 2828, but Aman does not open official reports. The 2211 and 1012 codes on TDRA's page are for joining the Do Not Call Registry and reporting unwanted telemarketing; that page doesn't mention fraud.

Will my bank refund money I lost to a scam?

It depends on whether you authorized the payment. Central Bank rules require a bank to reimburse an unauthorized payment after its investigation, or within 30 days of your first report, whichever comes first, unless there is evidence you acted fraudulently or with gross negligence. A payment that passed the bank's proper and secure verification counts as authorized unless you give prima facie evidence raising reasonable doubt that it was made with your knowledge. A transfer you made yourself is not an unauthorized transaction, and getting it back is not guaranteed.

I gave my OTP to a fake police caller. Can I get my money back?

Possibly, but not automatically. Report it to your bank and the police at once and claim anyway. The bank may say the payment passed its proper and secure verification and so counts as authorized; it does not if you give prima facie evidence raising reasonable doubt that it was made with your knowledge. The bank may also say sharing the code was gross negligence, in which case the refund rule does not apply. The rules don't define gross negligence or say whether an OTP counts as a password. Ask the bank to explain its decision in writing, and if you disagree, take the case to Sanadak.

How do I report a scam website?

Report it through the same official channels as any cybercrime: the MOI eCrimes platform, Dubai Police's eCrime platform, the My Safe Society app or a police station. If it posed as a Central Bank communication, the government portal says fraudulent emails and internet postings claiming to be from the CBUAE can also be reported to the CBUAE. If you entered card details on it, call your bank before anything else.

Can I report a scam from outside the UAE?

Partly. Call your bank's fraud line first. The government portal lists online channels but doesn't say whether they work from abroad, and Dubai Police's website and the eCrime Hub did not open from outside the UAE when this guide was checked on 14 November 2026. Abu Dhabi's Aman takes information from abroad on 009718002626 but does not open official reports. Report to the police where you are as well.

How long do I have to report an unauthorized transaction to my bank?

Your bank must allow you at least 30 business days from the date you were properly informed of the transaction. That is the minimum the bank must allow, not a reason to wait: report the same day, so the bank can block further payments.

Is Sanadak free, and when can I use it?

Filing is free for consumers; an appeal costs AED 500. Complain to your bank first: Sanadak can reject a complaint you have not raised with the bank. Its eligibility page says it may reject one filed less than 15 calendar days after you complained, and its regulation lets it reject one filed before the bank has had 30 complete business days to answer. Filing once 30 complete business days have passed meets both; if the bank answers sooner, ask Sanadak before filing early. File within 3 years of the conduct or 2 years of learning about it, whichever is later.