UAE Scam Losses: Three Clocks That Matter

If money has left your UAE account in a suspected scam, the first useful action is to contact your bank or payment provider through its verified emergency channel, not to wait for a police case number or a regulator’s reply. A police report matters, and a formal complaint may later matter just as much. But they do different jobs. The order can affect how quickly an institution can block further use, investigate a transaction or attempt a recovery.

Robius checked the Central Bank of the UAE’s consumer-protection rules, the federal government’s crime-reporting guidance, police contact channels and Sanadak’s current complaint pages on 27 October 2026. They reveal three separate clocks: an immediate security response, rules for handling disputed unauthorised transactions, and a later ombudsman escalation. None is a blanket promise that stolen money will return. One particularly important complication is that Sanadak’s eligibility page and an older FAQ currently give different waiting periods.

Clock one: stop the next transaction

A fraud victim may be trying to solve three problems at once: money already sent, access that an attacker may still control, and evidence that can disappear. Those problems need different actions. If you suspect a card, bank account or payment instrument has been compromised, use the contact number printed on your card, the verified banking app or the provider’s official website. Ask the provider to assess whether the instrument or account should be blocked, replaced or restricted, and whether the specific transaction can be disputed or traced.

The Central Bank’s Consumer Protection Standards require licensed financial institutions to offer responsive phone and digital channels, 24 hours a day and seven days a week, for reporting loss, theft, fraud or misuse of accounts and payment instruments. The standards also require a process that does not cause undue delay in blocking further unauthorised transactions. That is a service obligation, not a promise that a particular transfer can be reversed.

Ask for a case or complaint reference, the exact time your report was recorded and confirmation of which instruments were secured. If a caller is pressuring you to move funds to a ‘safe account’, end the conversation and independently call the bank. The recurring impersonation and urgency tactics are documented in Robius’s review of six UAE scam patterns. Do not use the number or link supplied by the suspicious caller.

There is no special 60-minute statutory window identified in the rules reviewed here. The first-hour framework is Robius’s practical triage recommendation because stopping continuing access and preserving evidence are time-sensitive. It should not be confused with a legal deadline.

The 30-business-day rule is not permission to wait

Article 5 of the Central Bank’s Consumer Protection Standards says consumers must be allowed at least 30 business days to report an unauthorised transaction after they have been properly informed of it. That minimum reporting opportunity is often misunderstood. It is not advice to wait 30 business days before contacting the institution. Waiting can make it harder to contain account misuse or locate a payment that has moved onward.

When a report arrives, the institution must document the transaction and the time of the report, explain blocking and replacement options, and take appropriate measures against further unauthorised activity. The practical lesson is to make a recorded report promptly and keep proof. If the first conversation only results in a temporary card block, ask how to submit the formal transaction dispute and which documents the provider needs.

Keep the original transaction notification, amount, currency, beneficiary details, reference number, screenshots of suspicious messages, relevant phone numbers and the time you first noticed the problem. Do not send passwords, one-time passcodes or complete card details to an unverified ‘investigator’. Preserve evidence rather than editing or deleting chats; where possible, export records through official channels.

Not every scam payment is an unauthorised transaction

The distinction between an unauthorised payment and a payment a customer was tricked into approving is critical. A stolen-card transaction, an account takeover and a transfer authorised after a fake bank call can look similar in a victim’s statement but raise different questions for the provider’s investigation. The Central Bank’s standards discuss secure validation and evidence of authorisation. They do not say that every payment connected to a scam is automatically refundable.

Article 5 also provides for reimbursement of unauthorised payments after the investigation or within 30 calendar days of reporting or identification, whichever is shorter, with an exception where evidence shows fraud or gross negligence by the consumer. The application of that provision depends on the facts and the applicable institution and product. A customer should therefore ask the bank to explain its classification of the disputed transaction, the evidence it relied on and its written decision, rather than assuming that the phrase ’30 days’ guarantees recovery.

This is also why a transfer through a domestic instant-payment rail should not be treated as though it were a card purchase with identical dispute procedures. Robius’s comparison of Aani transfer limits at UAE banks shows that even the conditions for sending money vary by provider. Dispute and recovery mechanisms must be checked for the actual payment instrument involved.

Clock two: report the crime, separately

Reporting a suspicious transaction to a bank does not itself create a police case. The UAE Government’s guidance says general economic crimes, scams and cybercrime should be reported to the local police, and identifies Dubai Police’s eCrime channel for cyber-enabled financial crime. Dubai Police’s official site also provides a reporting entry point and lists 901 for non-emergency enquiries and 999 for emergencies. Do not call the emergency number merely to check the progress of an ordinary banking dispute.

In Abu Dhabi, the official police contact page lists the Aman service on 8002626 and the police call centre on 8003333. The right channel depends on the incident and where it occurred. A resident elsewhere in the UAE should use the relevant local police service rather than assuming a Dubai-only reporting form covers every emirate.

Give investigators the bank’s reference number, transaction timeline and relevant evidence. If the payment went through several institutions, provide each reference rather than a general description such as ‘money disappeared’. Robius’s investigation of the UAE-led international fraud sweep explains why identifying fraud-linked assets, restricting accounts and returning money to victims are separate stages. An arrest or an asset trace does not by itself establish a refund for an individual.

The police report and the bank dispute can proceed in parallel. If the bank asks for a police case number, supply it when available, but do not delay an urgent security report while gathering it. Conversely, a bank reference number is not a substitute for reporting a suspected crime through the appropriate authority.

What the evidence pack should prove

A useful incident record answers four questions: what was the legitimate action you intended, what did the attacker ask you to do, what transaction actually occurred, and when did you alert each institution? Record the exact beneficiary name shown in your app if available, the transfer reference, the time zone, and whether you personally approved an authentication request. Distinguish facts you can document from suspicions about the offender.

If you were persuaded to install remote-access software, tell the bank that device access may have been compromised. Change credentials through a clean device or verified recovery process, review other connected accounts and ask the provider about additional restrictions. Do not rely on simply deleting a suspicious message. For complex cases involving wallets or multiple accounts, the Sharjah Police cybercrime investigation covered by Robius illustrates how the trail can span stolen identities, wallets and several organisations.

Avoid posting full bank statements, identity documents, card details or case files on social media in an attempt to attract attention. Share evidence only through authenticated reporting channels. If someone later promises to recover your funds for an advance fee, treat that as a fresh, unverified claim, not as a continuation of your police or bank case.

Clock three: Sanadak comes after the bank complaint

Sanadak is the UAE’s independent financial and insurance ombudsman channel for complaints about institutions licensed by the Central Bank. It is not the first emergency contact for an active scam and it does not replace police. Its eligibility page says a consumer should first submit an official complaint to the financial institution, then wait 15 calendar days and have received no written response or be dissatisfied with the response. It also lists restrictions for matters already before a court, duplicates and cases outside its remit.

There is an inconsistency on Sanadak’s own website. The live complaint-eligibility form and eligibility criteria say 15 calendar days, while a separate FAQ still tells consumers to wait 30 calendar days. The FAQ page carries an older update date. Robius cannot resolve that discrepancy on the authority’s behalf. A complainant should use the current eligibility checker and seek direct clarification from Sanadak if the form and another page conflict, while retaining the date of the original bank complaint.

Sanadak says the initial complaint is free for consumers and SMEs, while an appeal can carry an AED500 fee, refundable if the appeal succeeds. ‘Free complaint’ therefore does not mean every subsequent procedure is without cost. The service’s scope concerns the conduct of the licensed institution, not a guarantee that police will recover funds from an external fraudster.

The 15-calendar-day Sanadak eligibility threshold, the Central Bank’s minimum 30-business-day reporting opportunity and the 30-calendar-day unauthorised-payment reimbursement provision measure different events. They should never be merged into one ‘UAE scam refund deadline’. A person can report to the bank and police immediately, later submit a formal ombudsman complaint when eligible, and still face a disputed authorisation or recovery question.

Follow the money, not the headline

Suppose a resident notices an unfamiliar card charge. The immediate tasks are to report the charge, secure the card, preserve the notification and ask for a formal dispute reference. Now suppose another resident knowingly sent a bank transfer after a convincing impersonation call. The immediate tasks are still to contact the bank and report the suspected fraud, but the institution may need to assess a different authorisation and recovery path. The second case should not be presented as automatically covered by the same reimbursement rule.

Cross-border transfers, stored-value wallets and virtual assets can involve different providers and legal regimes. Identify the actual institution holding the customer relationship, not just the app’s brand name. Where the provider is not licensed by the Central Bank, Sanadak may not be the correct complaints route. Verify the provider’s regulator and available dispute mechanism before filing. A payment service’s marketing claim of ‘instant’ or ‘secure’ is not evidence of guaranteed reversibility.

The Robius framework is therefore contain, document, report, escalate. Contain access through the provider immediately. Document the transaction and every official contact. Report suspected criminal conduct to police through the appropriate emirate’s channels. Escalate an unresolved complaint about a Central Bank-licensed institution through Sanadak when the current eligibility conditions are met. Keep these records linked, but do not confuse the institutions’ roles.

The useful outcome is an accountable case

There is no single button that reverses every UAE scam. The regulatory framework provides meaningful obligations for receiving fraud reports and handling unauthorised transactions, while police channels address criminal conduct and Sanadak provides an independent complaint route. Those are real protections, but each has limits. A quick response improves the chance of containing damage; it does not establish that the original money remains recoverable.

The Robius conclusion: the first question after suspected fraud should not be ‘Which authority will refund me?’ It should be ‘Who can stop further loss right now, and what evidence will the next decision-maker need?’ The most useful record is one that shows the payment, the authorisation dispute, the first bank contact, the police report and any later ombudsman complaint without mixing up their deadlines. Residents should monitor Sanadak’s live eligibility rules, especially the unresolved 15-versus-30-day inconsistency, and request a written explanation when a provider rejects a disputed transaction.

Sources

• Central Bank of the UAE, Consumer Protection Standards, Article 5: unauthorised transaction reporting and reimbursement
• Central Bank of the UAE: consumer protection and referral of licensed-institution complaints to Sanadak
• Sanadak: current complaint eligibility and 15-calendar-day criterion
• Sanadak: FAQ containing a conflicting 30-calendar-day waiting period and appeal fee details
• Sanadak: complaint submission portal and eligibility checker
• UAE Government: reporting economic crimes and Dubai Police eCrime channel
• Dubai Police: official reporting portal and non-emergency contact information
• Abu Dhabi Police: Aman and police contact numbers

Checked 27 October 2026 against the official pages above. Sanadak’s eligibility page and its FAQ contain inconsistent waiting periods. This is a source-based UAE guide, not legal advice or a promise of recovery. Product-specific terms and complaint eligibility should be verified with the relevant institution.

Robius.news | Dubai, UAE | 2026 | Built to be first. Built to be trusted.