Why the UAE Is Killing the One-Time Password

For nearly two decades, the six-digit code sent to your phone was the backbone of digital security. Banks, email providers, and government portals all leaned on the one-time password (OTP) as the thing standing between your account and anyone who guessed your password. In the UAE, that era is ending — and what's replacing it says a lot about where authentication is headed everywhere else.

The Problem With the Code You Trust Most

OTPs feel secure because they're temporary and sent to a device you hold. But that's exactly the weakness fraudsters have learned to exploit. SIM-swap fraud — where a scammer convinces a telecom provider to port your number onto their SIM — lets criminals intercept OTPs meant for you. Social engineering is even simpler: a fake bank call or phishing SMS talks victims into reading their own OTP aloud or typing it into a lookalike site. Khaleej Times reported on a case in the UAE where a cloned SIM card was used to intercept a one-time password intended for the real account holder, and quoted banking sources describing a steady rise in scams built around tricking customers into handing over their codes.

The Central Bank of the UAE (CBUAE) has been responding to this since 2024, pushing lenders to overhaul how they verify customers. Khaleej Times reported that banks were directed to gradually phase out OTPs sent via SMS and email for digital transactions, shifting instead to in-app confirmation within mobile banking apps — moving from what one source described as "soft" authentication to "hard" authentication tied to a verified, registered device. A RAKBank executive cited in local coverage pointed to the same driver: most successful scams don't break encryption, they just trick someone into giving up their OTP.

Enter the Passkey

The technology increasingly sitting behind that shift is the passkey — and it works nothing like a password or a code. A passkey is a cryptographic key pair generated on your device: a private key that never leaves your phone or laptop's secure hardware, and a public key that gets stored with the website or app. When you log in, the service sends a challenge, your device signs it with the private key — unlocked by your fingerprint, face, or PIN — and sends back the signed proof. No secret ever crosses the network, which means there's nothing for a phisher to steal or a fake login page to capture.

This is built on FIDO2 and the WebAuthn standard, developed by the FIDO Alliance (whose members include Apple, Google, Microsoft, and most major banks and card networks) alongside the W3C. Because a passkey is cryptographically bound to the exact domain it was created for, a convincing fake version of your bank's login page simply cannot use it — the browser or OS won't offer a matching passkey for the wrong domain. That single property is why security researchers consistently describe passkeys as phishing-resistant in a way OTPs and even app-based push notifications aren't.

Khaleej Times quoted a UAE-based cybersecurity expert saying local banks are already piloting passkey-based logins specifically to replace or supplement OTPs, framing it as part of the same regulatory push that's killing SMS codes.

The Numbers Behind the Shift

The FIDO Alliance's own 2026 State of Passkeys report, released around World Passkey Day, estimates roughly 5 billion passkeys are now in active use worldwide, based on surveys of 11,000 consumers and 1,400 enterprise decision-makers across ten countries. Consumer awareness of passkeys has reached 90%, and 75% of respondents say they've enabled a passkey on at least one account — though actual regular use is lower, at 49%, reflecting how habits lag behind availability. On the enterprise side, 68% of organizations report they've deployed or are actively deploying passkeys for employee sign-in, even though only 28% have reached a fully passwordless state.

Independent tracking cited by identity-security researchers puts passkey support at roughly 48% of the world's top 100 websites — more than double where it stood in 2022 — a sign this isn't a niche feature anymore but a default option being built into major platforms, from Google and Apple accounts to e-commerce checkouts.

Why the UAE Is a Useful Test Case

What makes the UAE's rollout notable isn't just that a regulator mandated change — plenty of markets have guidelines urging stronger authentication. It's that the CBUAE tied the shift directly to a visible fraud problem and gave banks a concrete deadline to move off a technology (SMS OTP) that customers were used to and trusted. That's a harder sell than launching passkeys as an optional convenience feature, which is how most Western tech companies have introduced them so far.

It also puts the UAE's famously fast-moving digital-government and digital-banking infrastructure to a real test: a population used to doing almost everything through a phone app, in a market with heavy reliance on expatriate banking relationships and cross-border transactions, where fraud attempts via social engineering have been rising. If passkey-based banking logins take hold smoothly here, it's a strong signal for how the technology can scale in other high-smartphone-penetration markets working through similar fraud waves — rather than staying the preserve of early-adopter tech accounts.

The Catch

Passkeys aren't a silver bullet. They're tied to a device or an account's cloud keychain (iCloud Keychain, Google Password Manager), which means losing access to that ecosystem — or switching platforms — can complicate recovery. Banks still need fallback verification methods for lost phones, and passwords aren't disappearing from the internet overnight; they'll coexist with passkeys for years. Security researchers also note a gap worth watching: more than half of organizations surveyed in follow-up analysis of the FIDO data still lean on phishable methods for primary sign-in, meaning passkey availability and passkey use are two very different numbers.

Still, the direction is clear. What started as a convenience feature for unlocking a phone has become a regulatory tool for fighting bank fraud — and the UAE's OTP phase-out is one of the more concrete examples yet of a government deciding passwords and codes have had their run.