Before you start: know your rights
Under the Central Bank of the UAE's (CBUAE) Consumer Protection Standards, a licensed bank must accept your report of an unauthorized transaction and reimburse a genuine unauthorized payment after investigation — or within 30 calendar days of your report, whichever comes first — unless the bank can prove you were grossly negligent (for example, sharing an OTP or password). This obligation is set out under the CBUAE Rulebook, Article 8 (Complaint Management and Resolution). It applies to fraud carried out through your card, online banking, or a manipulated transfer — not to cases where you knowingly authorized a payment that later turned out to be a scam investment, which follow a different, more contested path (see "A note on investment and romance scams" below).
Step 1: Act within the first 24 hours
Time works against you in bank fraud. According to guidance published by cybercrime-reporting advisories, delays of even 24 to 48 hours can be decisive in whether stolen funds are recoverable, since banks can freeze suspicious accounts and reverse fraudulent transfers only if notified promptly, before the money moves further downstream.
In the first 24 hours:
- Call your bank's fraud line or use the in-app freeze/block feature to stop your card or account from further use.
- Do not delete anything. Screenshot the scam message, email, fake website, or call log before a scammer's account or site disappears.
- Note the exact time, amount, and destination account of the transaction if visible in your banking app.
Step 2: File a written complaint with your bank
Raising a verbal complaint is not enough. File a written complaint through your bank's app, website, or branch, and insist on a formal complaint reference number — this record is what allows you to escalate later if the bank doesn't resolve things to your satisfaction. Make sure you're routed to the correct department; corporate and personal banking typically have separate complaint channels, and most banks also maintain a dedicated fraud or financial crimes team.
Timeline: Banks are required to acknowledge and begin resolving a complaint within 15 calendar days under the current CBUAE standard — a shorter window than the previous 30-day rule, following Sanadak's October 2025 reform.
Step 3: Report to the police or the UAE's cybercrime portal
Filing a police report does two things: it creates an official record that supports your bank complaint and any later legal action, and — for cybercrime-linked fraud such as phishing or fake investment platforms — it opens an investigation that can identify and potentially recover funds from the receiving account before they're moved further.
- For general fraud: file at your nearest police station or through your emirate's police smart app.
- For online-originated fraud: report through the UAE's eCrime portal (eCrime.ae) or the Dubai Police cybercrime channel. Anonymous reports are accepted but may slow the investigation, since authorities cannot follow up for clarification.
- For fraud involving a fake investment platform or crypto: also notify the relevant regulator — the Securities and Commodities Authority for most cases, or Dubai's Virtual Assets Regulatory Authority (VARA) if virtual assets were involved.
Timeline: Simple cybercrime cases are often resolved within 2 to 4 weeks; cases involving multiple parties or international transfers can take 2 to 6 months, according to guidance for reporting cybercrime in the UAE.
Step 4: Let the bank investigate — and track the clock
Once your written complaint is filed, the bank has a defined window to investigate and respond. This is the stage where the bank determines whether the transaction meets the threshold for a "genuine unauthorized transaction" under CBUAE rules, or whether it will argue negligence on your part (most commonly, that you shared a one-time password or login credential, even under pressure or deception).
Timeline: Up to 30 calendar days from your report, or the bank's own investigation conclusion, whichever is sooner. If the bank has not responded within 15 calendar days, you become eligible to escalate.
Step 5: Escalate to Sanadak if the bank doesn't resolve it
If your bank rejects your claim, offers an unsatisfactory resolution, or simply doesn't respond in time, you can escalate to Sanadak — the UAE's independent financial and insurance ombudsman, established by the Central Bank in 2023 as the first such body in the Middle East and North Africa. Sanadak reviews complaints against any CBUAE-licensed bank or insurer, free of charge for consumers and small businesses.
To be eligible, you generally need to have waited at least 15 calendar days after filing with your bank without resolution (reduced from 30 days under Sanadak's October 2025 reform). You can submit a complaint up to three years from the incident, or two years from when you became aware of it. Sanadak will contact your bank to verify your complaint, and once validated, the bank has a further defined window to propose a resolution aligned with CBUAE regulations.
Timeline: Sanadak has cut its target complaint-resolution time from 30 to 15 working days as of its October 2025 reform, according to Arabian Business reporting on the change.
Step 6: Appeal if you disagree with the outcome
If Sanadak's determination doesn't resolve the matter in your favor, you can appeal. Appeals carry a fee of AED 500, which is refunded if the appeal succeeds. Cases already before a court, or that fall outside the Central Bank's regulatory mandate, are not eligible for the Sanadak process and would need to proceed through civil litigation instead.
A note on investment and romance scams
The process above applies most cleanly to unauthorized transactions — money moved without your knowledge or consent, such as a hacked account or a cloned card. If you were deceived into authorizing a transfer yourself — for example, a fake investment platform, a romance scam, or a "black magic"-style confidence trick — the bank's reimbursement obligation is weaker, because you technically authorized the payment. In these cases, a criminal complaint is usually the stronger route: police can trace and potentially freeze the receiving account, and if the perpetrator has assets or a bank account in the UAE, a civil claim can pursue seizure of those assets. If the perpetrator has already left the UAE, a criminal case can still lead to an Interpol Red Notice, though recovery becomes considerably more complex.
What actually works: a documented case
Timelines aren't just theoretical. In a case reported by Gulf News, an Abu Dhabi resident who was defrauded via a fraudulent email in early January immediately reported the incident to Abu Dhabi Police and had his bank account blocked. Police returned the full stolen amount — Dh140,000 — within one month of receiving his complaint. Abu Dhabi Police cited the case specifically to encourage prompt reporting, noting that speed is what allows authorities to trace both the funds and the perpetrators before the money disappears further into the financial system.
Quick reference: who to contact
- Unauthorized card or bank transaction: Your bank's fraud line, then written complaint
- Online scam, phishing, fake website: eCrime.ae or your emirate's police cybercrime unit
- Bank won't resolve your complaint: Sanadak (sanadak.gov.ae)
- Crypto or virtual asset fraud: Police + VARA (Dubai) or SCA (federal)
- Perpetrator has left the UAE: Police criminal complaint → possible Interpol Red Notice
