Financial Fraud Reporting in UAE — CBUAE and Police (2026)

Financial fraud in the UAE is rising. As the country has grown into a global financial hub — home to two of the world's busiest airports, hundreds of banks, and a massive expatriate population moving money internationally — fraud has grown with it. The Central Bank of the UAE (CBUAE), UAE police forces, and the banking sector have responded with dedicated fraud units, reporting systems, and recovery mechanisms. But most victims do not know which authority to contact, what evidence to preserve, or how the investigation process works. This guide walks you through the complete reporting and recovery framework. For related guidance, see our posts on Islamic finance disputes in UAE, settling bank debt in UAE, and bounced cheque laws in UAE. For category-level guidance, visit our banking lawyer hub.

What Is Financial Fraud Under UAE Law?

Financial fraud under UAE law encompasses any dishonest act committed to obtain an unlawful financial advantage — including bank fraud (forged documents, identity theft, unauthorized transactions), investment fraud (Ponzi schemes, fake investment offers), insurance fraud (false claims, staged accidents), digital fraud (phishing, card skimming, social engineering), and money laundering — prosecuted under the Federal Penal Code, the Anti-Money Laundering Law (Federal Decree-Law No. 20 of 2018), and the Cybercrime Law (Federal Decree-Law No. 34 of 2021). The penalties range from fines to 10+ years imprisonment depending on the type and scale.

Financial fraud covers a broad spectrum of conduct. The common thread is deception for financial gain.

Types of financial fraud in the UAE:

Bank fraud. Using forged documents, stolen identities, or unauthorized access to obtain bank loans, credit cards, or transfers. This includes employees who steal from customer accounts and outsiders who use social engineering to access accounts.

Investment fraud. Promoting fake investment opportunities, operating Ponzi or pyramid schemes, misrepresenting investment returns, or trading without proper SCA (Securities and Commodities Authority) licensing. The UAE has seen several high-profile cases involving fake forex trading platforms and unlicensed investment funds.

Insurance fraud. Filing false insurance claims, staging accidents, exaggerating losses, or providing misleading information on insurance applications. Both personal and commercial insurance fraud are prosecuted.

Digital/cyber fraud. Phishing emails, fake websites that harvest banking credentials, SIM swapping to intercept OTP codes, card skimming at point-of-sale terminals, and malware targeting banking apps. This is the fastest-growing category of financial fraud in the UAE.

Money laundering. Processing the proceeds of criminal activity through legitimate financial channels to obscure the funds' origin. The UAE's Anti-Money Laundering Law imposes reporting obligations on banks and designated non-financial businesses.

How Do You Report Financial Fraud to the Police?

Financial fraud should be reported to the police economic crime or cybercrime department in the emirate where the fraud occurred — in Dubai, file a report at the CID (Criminal Investigation Department) or through the Dubai Police app/eCrime platform; in Abu Dhabi, through the Abu Dhabi Police eCrime service or in person at a police station — bringing all evidence including bank statements, transaction records, communications with the fraudster, and any identification documents. Time is critical: report within 24-48 hours to maximize recovery chances.

Speed matters in fraud cases. The faster you report, the higher the chance of recovering funds before they leave the country or are moved through multiple accounts.

Dubai Police — reporting channels:

• eCrime platform (ecrime.ae): Online reporting for financial and cybercrimes. Available 24/7. Generates a case number immediately.
• Dubai Police app: Download the app, navigate to "Services" → "Criminal Reports" → "Financial Crime." Upload evidence directly.
• In person: Visit the nearest police station or the CID headquarters in Al Qusais. Bring all original documents and evidence.
• Phone: Call 901 (non-emergency) or 999 (emergency if fraud is occurring in real-time, e.g., someone at your bank attempting unauthorized transactions).

Abu Dhabi Police — reporting channels:

• Abu Dhabi Police app/website: Online reporting through the digital services portal.
• In person: Any police station or the Economic Crimes Department.
• Phone: 8002626 (Aman service) or 999 (emergency).

What to bring when reporting:

• Emirates ID and passport
• Bank statements showing unauthorized transactions
• Screenshots of phishing messages, fake websites, or fraudulent communications
• Records of money transfers (SWIFT references, exchange receipts)
• Any contracts or agreements with the fraudster
• Correspondence (emails, WhatsApp messages, text messages)
• Witness information (if others were defrauded by the same person/scheme)

Evidence preservation tips:

• Do not delete any messages or emails from the fraudster
• Take screenshots with timestamps visible
• Save URLs of fraudulent websites (they may be taken down)
• Request transaction records from your bank immediately
• If you paid through a money exchange, get the transaction receipt and CCTV footage request

How Do You Report Fraud to the Central Bank (CBUAE)?

The CBUAE accepts fraud complaints through its Consumer Protection Department — accessible via the CBUAE website complaint form, the CBUAE phone line (800-CBUAE / 800-22823), or by email to [email protected] — particularly for complaints against licensed banks, exchange houses, and financial institutions regarding unauthorized transactions, failure to protect customer data, or refusal to investigate fraud. The CBUAE has regulatory authority to compel banks to investigate and respond.

The CBUAE's role is different from the police. The police investigate criminal fraud. The CBUAE ensures that banks and financial institutions comply with their regulatory obligations — including fraud prevention, detection, and customer protection.

When to report to CBUAE (in addition to police):

• Your bank refused to investigate a fraud complaint
• Your bank delayed freezing a compromised account
• The bank's security failure enabled the fraud (weak authentication, data breach)
• An exchange house processed a fraudulent transfer without proper KYC
• A financial institution refused to provide transaction records needed for your police report
• You believe the bank was complicit or negligent in enabling the fraud

CBUAE complaint process:

What CBUAE can do:

• Order the bank to freeze accounts associated with fraud
• Require the bank to reimburse the customer if the bank's negligence contributed to the fraud
• Impose fines on the bank for security failures
• Require the bank to improve its fraud prevention systems
• Refer criminal matters to the police/prosecution
• Issue industry-wide directives based on patterns of fraud

What Happens During a Bank Fraud Investigation?

When a bank receives a fraud complaint, it follows a mandated investigation process: immediate account freeze or temporary hold on the compromised account, internal investigation by the bank's fraud department (reviewing transaction logs, CCTV, IP addresses), filing a Suspicious Transaction Report (STR) with the Financial Intelligence Unit if applicable, coordination with other banks if funds were transferred, and a written response to the customer within 15-30 business days. Banks are required by CBUAE regulations to have dedicated fraud investigation teams.

Understanding the bank's investigation process helps you manage expectations and identify when the bank is not meeting its obligations.

Immediate response (0-24 hours):

• The bank freezes or places a temporary hold on the compromised account or card
• New cards are issued if card fraud is suspected
• Online banking credentials are reset
• The bank contacts the receiving bank (if funds were transferred) to request a hold on the receiving account

Investigation phase (1-30 days):

• The bank's fraud department reviews transaction logs, login records, and IP addresses
• CCTV footage is reviewed for in-person transactions
• Customer authentication records are examined (was OTP properly verified? Was biometric used?)
• The bank contacts correspondent banks for cross-border transfers
• The bank files an STR with the UAE Financial Intelligence Unit (FIU) if the fraud meets reporting thresholds

Resolution (15-60 days):

• The bank issues a written finding: whether the fraud was confirmed, the bank's assessment of liability, and any refund or compensation offered
• If the bank determines that its security was not compromised and the customer was negligent (e.g., shared their OTP or clicked a phishing link), the bank may deny the claim
• If the bank's systems failed (e.g., the transaction was processed without proper authentication), the bank should reimburse the customer

What Are Your Options for Recovering Lost Funds?

Fund recovery options depend on how and where the money was sent: for domestic transfers, the police can freeze the receiving account and the court can order recovery; for international transfers, recovery requires SWIFT recall requests, mutual legal assistance treaties, and cooperation from foreign authorities; for cryptocurrency, recovery is extremely difficult but blockchain tracing can sometimes identify the receiving wallets — in all cases, speed of reporting is the single most important factor in successful recovery. Recovery rates drop dramatically after 72 hours.

Recovery is the hardest part of the fraud response. Money moves fast — once funds leave the UAE banking system, recovery becomes exponentially more difficult.

Domestic fund recovery:

If the fraudulent transfer went to another UAE bank account:

1. Your bank contacts the receiving bank to request a freeze
2. The police issue a freeze order on the receiving account
3. The prosecution files a court application for fund recovery
4. The court orders the receiving bank to return the funds to the victim
5. Timeline: 2 weeks to 6 months depending on complications

International fund recovery:

If the funds were sent abroad:

1. Your bank sends a SWIFT recall/cancellation request to the correspondent bank
2. The police coordinate with Interpol or the foreign country's authorities
3. A Mutual Legal Assistance Treaty (MLAT) request may be needed for formal cooperation
4. The foreign authority freezes the account (if funds are still there)
5. Court proceedings in the foreign jurisdiction may be required
6. Timeline: 3 months to 2+ years

Recovery rates by fraud type:

What Are the Anti-Money Laundering Reporting Requirements?

Under Federal Decree-Law No. 20 of 2018, banks, exchange houses, insurance companies, real estate agents, precious metal dealers, and other designated entities must report suspicious transactions to the UAE Financial Intelligence Unit (FIU) — failure to report is a criminal offence carrying fines of AED 100,000-5,000,000 and up to 5 years imprisonment, and reporting entities are protected from civil and criminal liability for good-faith reports. Individuals can also report money laundering suspicions directly to the FIU.

Anti-money laundering (AML) is the regulatory backbone of the UAE's fight against financial fraud. The reporting framework creates a web of surveillance across the financial system.

Who must report:

• Banks and financial institutions
• Exchange houses and money service businesses
• Insurance companies and brokers
• Securities firms and investment funds
• Real estate agents and developers
• Precious metals and stones dealers
• Lawyers and accountants (for certain transaction types)
• Designated non-financial businesses and professions

What triggers a report:

• Transactions inconsistent with the customer's known profile
• Large cash deposits or withdrawals without business justification
• Rapid movement of funds through multiple accounts
• Transactions involving high-risk jurisdictions
• Structuring (breaking large transactions into smaller ones to avoid reporting thresholds)
• Customer reluctance to provide identification or source-of-funds information

Whistleblower protections. The AML law protects individuals who report suspicious activities:

• Identity of the reporter is kept confidential
• Good-faith reporters are protected from civil and criminal liability
• Retaliation against reporters is a criminal offence
• Reports can be made anonymously through the FIU

How Do You Protect Yourself from Financial Fraud?

Protection requires a combination of technological safeguards and behavioural vigilance: enable two-factor authentication on all banking apps, never share OTP codes with anyone (banks will never ask for them), verify sender identity before responding to messages about your accounts, use dedicated devices for banking, monitor accounts daily for unauthorized transactions, set transaction alerts for all amounts, and report suspicious contact immediately to your bank and police. Most UAE bank fraud in 2025-2026 involves social engineering — the human element, not system breaches.

Prevention is far more effective than recovery. The majority of successful frauds in the UAE exploit human behaviour, not technical vulnerabilities.

The social engineering threat. The most common fraud method in the UAE involves a caller or message sender impersonating your bank, a government authority (such as police or immigration), or a delivery company. They create urgency — "your account will be frozen," "you have an unpaid fine," "your package requires a customs payment" — and direct you to share your banking credentials or OTP code.

Protection checklist:

• Never share OTP codes with anyone, for any reason
• Never click links in SMS messages claiming to be from your bank
• Always access your bank through the official app or by typing the URL directly
• Enable biometric authentication (fingerprint/face) on banking apps
• Set transaction alerts for ALL amounts (not just large transactions)
• Use a dedicated email address for banking — not your general email
• Regularly check your AECB credit report for unauthorized credit applications
• Use virtual/disposable card numbers for online shopping
• Enable card controls (block international transactions, block online transactions) when not in use

Frequently Asked Questions

How long does a fraud investigation take? Bank investigations typically take 15-30 business days. Police investigations take 2-6 months for straightforward cases and can extend to 1-2 years for complex international fraud. Court proceedings for fund recovery add another 6-18 months. The total time from reporting to full resolution is typically 6-24 months. Throughout this period, your banking lawyer can push for faster progress.

Will the bank reimburse me if I was scammed? It depends on the circumstances. If the bank's security systems failed (e.g., a transaction was processed without proper authentication), the bank should reimburse you. If you willingly shared your OTP or banking credentials with the fraudster (even unknowingly), the bank may argue that you were negligent and deny the claim. This is the most contested area — and where a banking lawyer's involvement becomes critical, as they can argue that the bank had a duty to detect and prevent the unusual transaction pattern.

Can I sue the person who defrauded me in addition to filing a police report? Yes. Criminal proceedings (police/prosecution) and civil proceedings (your lawsuit for damages) run in parallel. You do not need to wait for the criminal case to conclude before filing a civil claim. A civil claim can seek recovery of the stolen funds plus compensation for damages, legal costs, and emotional distress. If the fraudster is convicted criminally, the criminal conviction serves as strong evidence in the civil case.

What if the fraud was committed by a bank employee? Report it to both the police and the CBUAE. Employee fraud is a particularly serious matter because it involves a breach of fiduciary duty and compromises the bank's security. The bank bears liability for the acts of its employees performed within the scope of their employment. The CBUAE will investigate the bank's internal controls and may impose regulatory sanctions in addition to the criminal prosecution of the individual employee.

Is cryptocurrency fraud covered by UAE law? Yes. The Cybercrime Law (Federal Decree-Law No. 34 of 2021) covers fraud committed through digital means, including cryptocurrency. The Virtual Assets Regulatory Authority (VARA) in Dubai regulates virtual asset service providers. If you were defrauded through a regulated crypto exchange, you can complain to VARA. If through an unregulated platform, the police cybercrime unit handles the investigation. Recovery of cryptocurrency is technically possible through blockchain tracing, but success rates are low.

Keep Reading

• Islamic Finance Disputes in UAE
• Settle Bank Debt in UAE
• Bounced Cheque Laws in UAE
• Complete Guide to Banking Lawyers in UAE

Victim of financial fraud? Find a Banking Lawyer in Dubai →