Card Fraud in the UAE: The Chargeback and Central Bank Dispute Process

A practical guide to reversing fraudulent card charges in the UAE, the chargeback process, your rights under Central Bank rules, and how to escalate to Sanadak when your bank says no.

If money leaves your account through a card transaction you did not make, call your bank immediately, freeze the card, and file a formal written dispute. Under the Central Bank of the UAE (CBUAE) Consumer Protection Standards, a licensed bank must let you report an unauthorized transaction and must reimburse a genuine unauthorized payment after its investigation or within 30 calendar days of the report, whichever is shorter, unless it can prove you acted fraudulently or with gross negligence (CBUAE Consumer Protection Standards). Speed matters, because the clock and the paper trail decide these cases.

Every week UAE residents post the same nightmare online: “10,000 AED gone overnight,” a card charged for online purchases they never made, or a subscription that keeps billing after they tried to cancel. This guide separates a true unauthorized fraud, where the bank carries the burden of proof, from a merchant dispute you argue on different grounds. It walks through the immediate steps, the chargeback mechanism, the bank’s investigation window, the honest truth about OTP sharing, and the exact escalation ladder from the bank’s complaints unit to Sanadak, the CBUAE’s independent ombudsman, and to Dubai Police eCrime.

First hour: block the card and report in writing

The first hour is the most important. Call the number on the back of your card or use your banking app to freeze or block the card so no further charges can post. Then report the specific transaction to the bank in writing, not just by phone, and get a reference number. If your card details were exposed through a phishing message or a fake website, read our guide to common UAE scams and how to report them to eCrime so you can recognize the tactic and preserve evidence.

To stop card fraud in the UAE, do three things in the first hour: freeze or block the card through your banking app or the bank’s hotline, submit a written dispute for each unauthorized charge and keep the reference number, and screenshot every message, receipt, and transaction alert. Written reports start the bank’s formal investigation clock.

What to capture as evidence

Save the SMS or app alerts showing the transaction, the merchant name and amount, the exact date and time, and any phishing message, call, or link that preceded the charge. If you noticed the fraud after a lost or stolen phone, note when the device left your control. This detail feeds directly into the bank’s investigation file, which the CBUAE Consumer Protection Standards require the bank to document, including the date and time your report was received (CBUAE Consumer Protection Standards).

Your rights under CBUAE Consumer Protection rules

Card disputes in the UAE are governed by the CBUAE Consumer Protection Regulation (Circular 8/2020) and its accompanying Consumer Protection Standards, which apply to every bank licensed by the Central Bank (CBUAE Consumer Protection). Two obligations matter most in a fraud case: the bank must give you a fair window to report the transaction, and once you do, the bank, not you, carries the burden of proving what happened.

On the reporting window, the Standards require banks to allow consumers a minimum of 30 business days to report an unauthorized transaction after they have been properly informed of it. On resolution, an unauthorized payment must be reimbursed after the investigation is complete or within 30 calendar days of the day you first reported it, whichever period is shorter. The one exception is where the bank has evidence that you acted fraudulently or with gross negligence (CBUAE Consumer Protection Standards).

Under CBUAE rules, a bank must reimburse a genuine unauthorized transaction after completing its investigation or within 30 calendar days of your report, whichever is sooner, unless it can prove you acted fraudulently or with gross negligence. You are entitled to at least 30 business days to report the transaction once the bank has properly informed you of it.

There is a further protection specific to card-not-present fraud. Since the CBUAE tightened authentication rules, banks carry full liability for 3D Secure fraud that occurs while weaker SMS one-time passwords are still in use, which pushed banks to move verification into their own apps. If your bank still authenticates online payments by SMS OTP, that liability position works in your favor. Our explainer on the shift from SMS OTP to in-app two-factor authentication covers what changed and why.

Chargeback versus merchant dispute: know which case you have

A chargeback is the card-scheme mechanism your issuing bank uses to claw back funds from the merchant’s bank through Visa or Mastercard rules. It exists for both fraud and legitimate merchant complaints, but the two are argued very differently, and choosing the wrong lane slows everything down. A genuine unauthorized transaction is one you never authorized at all. A merchant dispute, sometimes called a “friendly” chargeback, is a transaction you did make but where the goods never arrived, the refund was never processed, or a “free trial” quietly became a recurring charge.

The distinction decides who has to prove what. In a true fraud claim, CBUAE rules put the burden on the bank to show the transaction was authorized or that you were grossly negligent. In a merchant dispute, you generally have to show you tried to resolve it with the merchant first and that the merchant failed to deliver or refund. Filing a subscription you forgot to cancel as “fraud” can backfire and delay a valid claim.

Feature	Unauthorized fraud	Merchant dispute (friendly chargeback)
What happened	You never made or approved the transaction (skimming, stolen data, phishing, account takeover).	You made the payment, but goods or services failed, or a subscription kept billing.
Who proves the case	The bank must prove it was authorized or that you were grossly negligent.	You must show you contacted the merchant and it failed to deliver or refund.
First action	Block the card, file a written fraud dispute, report to eCrime.	Contact the merchant, cancel the subscription, then dispute if unresolved.
Card status	The compromised card is usually cancelled and reissued.	The card often stays active; only the disputed charge is contested.

How the chargeback process and timelines actually work

Once you file, the bank opens an investigation, may issue a temporary or provisional credit while it reviews, and raises the chargeback through the card scheme against the merchant’s acquiring bank. The merchant can accept the reversal or contest it with evidence, which can extend the process. In practice, straightforward fraud reversals often resolve within a few weeks, while contested cases run longer. What is fixed by regulation is the outer boundary: for a confirmed unauthorized transaction, reimbursement is due after the investigation or within 30 calendar days of your report, whichever is shorter (CBUAE Consumer Protection Standards).

Separately, the bank’s complaint-handling rules give you procedural deadlines you can hold it to. Under the CBUAE complaint management standard, a bank must acknowledge a complaint within 2 complete business days and send a final written response with detailed reasons within 30 complete business days of receiving it (CBUAE Article 8, Complaint Management). If the bank freezes the wider account during its review, our guide on why UAE banks freeze accounts and how to unfreeze them explains the parallel process.

If the transaction is stuck because of a technical failure

Not every missing amount is fraud. A duplicated charge or a debit that posts twice during an app or network failure is a service issue the bank must correct. If your dispute stems from a banking-app outage rather than a criminal, see what you are owed in our guide to your rights during a UAE bank app outage before filing it as fraud.

The honest truth about sharing an OTP

This is where many claims fail. If you handed a one-time password, card PIN, or full card and CVV details to someone who called, messaged, or emailed pretending to be your bank, the bank will likely argue you acted with gross negligence, which is the express exception to its reimbursement duty under the Consumer Protection Standards (CBUAE Consumer Protection Standards). Banks in the UAE state on every alert that they will never ask for your OTP, and that warning is the basis for treating disclosure as negligence.

Sharing your OTP, PIN, or full card details with anyone can turn a winnable fraud claim into a rejected one, because CBUAE rules exempt banks from reimbursing losses caused by the consumer’s gross negligence. If you never received or entered an OTP and the charge still went through, that supports your claim that the transaction was unauthorized.

Be honest with the bank about what happened. Even where OTP disclosure occurred, the outcome is not automatic. The bank must still show its own security systems were adequate and that your conduct met the gross-negligence threshold, and if it cannot, liability can shift back to it. Present your case, and if the bank rejects it on negligence grounds you disagree with, that decision can be escalated.

When the bank refuses: escalate to Sanadak

If the bank rejects your dispute or misses its deadlines, you do not stop there. Sanadak is the independent ombudsman unit for banking and insurance complaints, established by the Central Bank of the UAE in 2023, and it resolves consumer complaints against licensed financial institutions free of charge (Sanadak). It covers bank accounts, credit cards, and related services, and it also serves SMEs.

The sequence is strict: you must raise a formal complaint with your bank first, then escalate to Sanadak if you are unsatisfied with the response or it is not resolved in time. The UAE Government portal states that Sanadak may reject a complaint if you have not waited the required period after raising it with the bank, and lists a minimum of 15 calendar days after the complaint was raised with the institution (UAE Government portal). Because the bank itself has up to 30 business days to issue its final response, the practical trigger is usually either that final response or the lapse of that window. You can submit to Sanadak online, through its mobile app, by call center, or in person, and filing is free for consumers and SMEs.

Step	Where	Typical timeline
1. Block card and report	Your bank (app or hotline), in writing	Immediately; acknowledgment within 2 business days
2. Formal complaint to the bank	Bank complaints unit	Final written response within 30 business days
3. Escalate if unresolved	Sanadak (online, app, call center, in person)	After the bank’s final response or the minimum wait; free to file
4. Report the crime	Dubai Police eCrime (ecrime.ae) or 901	Any time; supports the bank and Sanadak case

Sanadak’s committees issue decisions that are binding on the bank up to a monetary threshold, with a defined appeal route above it, and while filing is free, an appeal carries a fee (Sanadak FAQs). Note one limit that matters if your money was held for compliance reasons rather than fraud: Sanadak’s remit is narrower where a matter relates to a bank’s anti-money-laundering practices. If your funds were locked under a CID or AML hold rather than taken by a fraudster, our guide on a bank account blocked by a CID or AML hold is the more relevant route.

Report the fraud to Dubai Police eCrime

File a report on the Dubai Police eCrime platform at ecrime.ae, through the MoI UAE app, or by calling 901 for financial-fraud reports (UAE Government portal, report cybercrimes online). A police report is not just about catching the criminal. The reference number and case record strengthen your bank dispute and any Sanadak escalation by documenting that you treated the loss as a crime and reported it promptly. Include the transaction details, the merchant name, and any phishing message or link.

Prevention: cut your exposure before it happens

Prevention is cheaper than any dispute. Turn on instant transaction alerts so a fraudulent charge is visible within seconds, set sensible online and international spending limits in your banking app, and disable online or overseas use on cards you rarely use that way. Never share an OTP, PIN, or CVV, and treat any inbound call or message asking for them as fraud regardless of how official it looks.

For online spending, a credit card usually gives stronger chargeback leverage and keeps fraud away from your main current account balance; our comparison of the best credit cards in the UAE covers protection features to look for. Use virtual or single-use card numbers for subscriptions and unfamiliar merchants, and keep only a small balance on any card linked to auto-renewing services. If your concern is the broader safety of money held in UAE banks, see our guide to deposit safety and protection in UAE banks. And when a dispute is with a merchant over goods rather than a card criminal, your consumer rights on returns, refunds, and counterfeit goods may apply instead of a fraud claim.

FAQ

How long do I have to report an unauthorized transaction to my UAE bank?

The CBUAE Consumer Protection Standards require banks to allow consumers a minimum of 30 business days to report an unauthorized transaction after being properly informed of it. Report as soon as you notice it, because faster reporting strengthens your case and limits further losses.

Does the bank have to refund a fraudulent card charge?

Yes, for a genuine unauthorized transaction the bank must reimburse you after completing its investigation or within 30 calendar days of your report, whichever is shorter. The only exception is where the bank can prove you acted fraudulently or with gross negligence, such as sharing your OTP or PIN.

What is the difference between a chargeback and a fraud dispute?

A chargeback is the technical card-scheme reversal your bank raises against the merchant. It is used both for fraud you never authorized and for merchant disputes over undelivered goods or unwanted subscriptions. In a fraud case the bank must prove authorization; in a merchant dispute you must show the merchant failed to deliver or refund.

How long does a chargeback take in the UAE?

Timelines vary. Straightforward fraud reversals often resolve within a few weeks, while contested cases where the merchant fights the claim take longer. For a confirmed unauthorized transaction, reimbursement is due after the investigation or within 30 calendar days of your report, whichever is shorter.

What happens if I shared my OTP with a scammer?

The bank will likely treat sharing an OTP, PIN, or full card details as gross negligence, which is the express exception to its duty to reimburse. Be honest about what happened. The bank must still show its security was adequate, and if you disagree with a rejection you can escalate to Sanadak.

What is Sanadak and when can I use it?

Sanadak is the CBUAE’s independent ombudsman for banking and insurance complaints, launched in 2023. You use it after raising a formal complaint with your bank and being unsatisfied with the response or waiting the required period. Filing is free for consumers and SMEs.

Do I need a police report for a card fraud dispute?

A police report is not always mandatory for the bank to investigate, but it helps. Filing with Dubai Police eCrime at ecrime.ae creates an official record that supports your bank dispute and any Sanadak escalation, and it is required for many criminal follow-ups.

Can I dispute a subscription that keeps charging me after I cancelled?

Yes, but this is usually a merchant dispute, not fraud. Cancel the subscription, keep proof of the cancellation attempt, and ask the merchant for a refund first. If the merchant refuses and keeps billing, you can raise a chargeback for the disputed charges through your bank.

Is filing a complaint with Sanadak free?

Yes, filing a complaint with Sanadak is free for consumers and SMEs. Sanadak’s decisions are binding on the bank up to a monetary threshold, with a defined appeal route above it. An appeal against a decision carries a fee, but the initial complaint does not.

What if the bank misses its own deadlines?

Under CBUAE complaint-handling rules, a bank must acknowledge your complaint within 2 business days and issue a final written response within 30 business days. If it misses these deadlines or the resolution is unsatisfactory, you can escalate the matter to Sanadak.

Official Sources

• CBUAE Rulebook: Consumer Protection Standards (unauthorized transactions and reporting)
• CBUAE Rulebook: Consumer Protection Regulation (Circular 8/2020)
• CBUAE Rulebook:Article 8, Complaint Management and Resolution
• Central Bank of the UAE:Consumer Protection
• Sanadak:Independent Financial and Insurance Ombudsman
• UAE Government Portal:Raising Complaints Against Financial Institutions
• UAE Government Portal:Report Cybercrimes Online (Dubai Police eCrime)

Information is current as of July 2026. Regulations, timelines, fees, and escalation thresholds are subject to change, and outcomes depend on the facts of each case. This article is general guidance, not legal or financial advice. Verify current requirements directly with your bank, the Central Bank of the UAE, Sanadak, and Dubai Police before acting.