UAE deepfake scam warning 2026
In May 2026, UAE federal cybersecurity authorities and law enforcement agencies issued an urgent public warning about the rising spread of AI-generated deepfakes and impersonation scams. This is not a future risk. It is happening to UAE residents and businesses right now. Here is what the threat actually looks like in 2026, what the government is doing about it, and what you can do today.
What the Government Actually Said
The warning, issued in May 2026 by federal cybersecurity authorities and law enforcement agencies, was not a routine advisory. It described a situation that authorities characterised as one of the most consequential challenges of the generative AI era. The Government Empowerment Department also issued specific guidance on social media identifying six warning signs for deepfake calls and fraudulent AI-generated content, according to Gulf News.
Khaleej Times reported in April 2026 that UAE businesses were being warned to prepare for a new generation of cyber threats powered by AI, with attackers using deepfake impersonation, highly personalised phishing, and automated tools capable of breaching systems within hours, and in some cases minutes. Rob Standing, Regional Vice President for the Middle East at cybersecurity firm Rubrik, told Khaleej Times: ‘The most common AI-enabled methods are highly personalised phishing, deepfake-style impersonation, automated reconnaissance, and ransomware campaigns that can adapt faster than a human operator.’
| Phishing incidents in the UAE increased by 32 percent in Q1 2026, according to Rescana’s threat landscape report. AI-driven breaches surged by 340 percent in the preceding six months. These are not slowly emerging trends. They are already here. |
What These Attacks Actually Look Like
Most people picture deepfakes as elaborate Hollywood-style video productions. The reality in 2026 is far simpler, faster, and harder to detect.
Voice cloning is the most widespread form hitting UAE residents right now. Fraudsters need as little as 3 to 10 seconds of audio to clone a voice convincingly, according to SQ Magazine’s voice phishing statistics report from March 2026. That audio can come from a public video, a voice note, a LinkedIn post with embedded audio, or any other source where someone’s voice is recorded. The cloned voice is then used to call family members claiming an emergency, to impersonate executives in business calls, or to authorise fraudulent financial transactions.
A well-documented case that has been widely cited in UAE cybersecurity discussions involved AI voice cloning being used to steal USD 35 million from a UAE bank. The attackers cloned a director’s voice and used it to authorise a transfer. The technology required to replicate this attack has become significantly cheaper and more accessible since that case occurred.
Personalised phishing is the other major vector. Traditional phishing relied on generic templates with obvious errors. AI-generated phishing emails in 2026 reference specific details about the target, use the correct tone and writing style of the supposed sender, and contain no grammatical errors. Rescana’s UAE threat landscape report noted that over 75 percent of UAE breaches originate from phishing or fraudulent messages, and that AI tools are being used to craft business email compromise attacks impersonating executives or trusted suppliers.
The third category is synthetic identity fraud, where AI-generated personas, complete with fake photographs, fabricated LinkedIn profiles, and AI-written employment histories, are used for loan fraud, money laundering, and various other financial crimes. Digital Dubai’s May 2026 advisory specifically flagged this pattern as a growing area of concern.
Why the UAE Is a Particularly Attractive Target
Several factors make UAE residents and businesses more exposed to these attacks than populations in some other markets.
The first is the high concentration of international financial transactions. Dubai is a global business hub where large transfers between parties who may not know each other well are routine. That environment is exactly where voice-cloned authorisation scams and business email compromise attacks work best.
The second is the multilingual, multinational workforce. With residents from over 185 nationalities, there is no single cultural baseline that makes suspicious communications obviously out of place. An email that seems slightly off to a native English speaker may not register as unusual to someone operating in their third language.
The third is high AI adoption. At 70.1 percent of the working-age population using AI tools, as reported by Microsoft’s Q1 2026 index, the UAE is the world’s most AI-active country. The productivity benefits are real. But the same high adoption rate means that AI-generated content is more expected, normalised, and therefore less scrutinised than in lower-adoption environments.
What the UAE Government Is Doing About It
The response described in the Digital Dubai advisory includes new legislation, advanced detection technology, public education campaigns, and active enforcement. The UAE’s response also includes international cooperation through Interpol, regional security organisations, and bilateral law enforcement partnerships.
The UAE Cybersecurity Council’s national monitoring framework has been described by industry experts as one of the more advanced in the region. Rob Standing told Khaleej Times that the UAE has made incredible progress, citing the 2025 to 2031 national cybersecurity strategy and a highly effective centralised monitoring framework. Public figures previously cited by the UAE Cybersecurity Council show the country blocking large volumes of attempted attacks every day.
What the government cannot do is protect individual residents and employees from falling for attacks that exploit human trust rather than technical vulnerabilities. The Government Empowerment Department was explicit about this, saying that recognising warning signs makes people the strongest link in the cybersecurity chain rather than the weakest one.
Six Practical Steps That Actually Help
- Verify before you transfer. If a call, message, or email asks you to move money or share credentials, hang up and call the person back on a number you know independently. Do not use the number provided in the suspicious communication. This one step stops the majority of voice cloning and CEO fraud attacks.
- Enable multi-factor authentication on everything that matters. Bank accounts, email, UAE Pass, MOHRE, DubaiNow, and any platform holding your personal or financial information. An attacker with your password cannot access an MFA-protected account without also having your phone.
- Treat any urgent request with extra suspicion. Urgency is the primary manipulation tool in social engineering. Legitimate banks, government bodies, and employers do not demand immediate action and threaten consequences if you pause to verify. That urgency is engineered.
- Be careful what voice recordings you make public. Deepfake voice cloning requires audio. Limit the volume of your voice that appears in public videos, voice messages shared broadly, or publicly accessible recordings. For business leaders and public figures, this risk is higher.
- Understand that AI-generated text no longer has obvious errors. The spelling mistake and awkward phrasing heuristics that worked five years ago do not work in 2026. Judge communications by context, request type, and verification, not by how well they are written.
- Report suspected deepfake scams and cybercrime to ecrime.ae in Dubai or contact the UAE Cybersecurity Council. The data from reported incidents is what builds the national threat picture that enables better detection.
| If someone calls you, sounds exactly like your boss or your bank manager, and asks you to do something financially significant right now: hang up. Call back on a number you know. That pause is the single most effective protection available to any UAE resident today. |
Sources: Gulf News (May 2026 and earlier), Khaleej Times (April 2026), Digital Dubai AI Advisory (May 2026), Rescana UAE Cyber Threat Landscape 2026, SQ Magazine Voice Phishing Statistics (March 2026), UAE Government Empowerment Department, Digital Watch Observatory (January 2026).
Robius.news — Dubai, UAE — June 2026 | Built to be first. Built to be trusted.
