UAE authorities have issued several public warnings this year about scams built around Emirates ID and biometric data.
Face scans, fingerprints, and UAE Pass logins are being collected or hijacked, then used to commit financial fraud in the victim’s name.
These are confirmed patterns flagged by ICP, TDRA, and foreign consulates in the UAE — not hypothetical risks.
Here’s exactly how each one works, and what to do about it.
Real UAE biometric scams fall into three patterns: fake “agents” collecting face or fingerprint scans to open bank accounts or loans in your name; callers impersonating police or banks to get a UAE Pass OTP; and fake calls or websites impersonating ICP.
One fact defeats all three: no genuine UAE government body or bank will ever ask for your OTP or UAE Pass code by phone, text, or call.
A broader guide to spotting and stopping online scams, beyond the biometric-specific patterns covered here.
The Indian Consulate in Dubai has publicly warned residents about unauthorised agents posing as visa or immigration helpers.
The pattern applies to anyone approached by an unlicensed “agent,” regardless of nationality.
These agents ask for passport details, Emirates ID information, and biometric data — face, eye, and fingerprint scans — claiming it’s needed for visa or job paperwork.
Once collected, that data has been used to open unauthorised bank accounts and loans in the victim’s name, entirely without their knowledge.
Victims can be held financially and legally responsible for accounts and loans they never opened.
That means outstanding debts, fines, travel bans, and in serious cases criminal liability — even though they were the ones deceived.
- Only give biometric data — fingerprints, face or eye scans — at an official government facility: an ICP-authorised typing centre, an Amer or Tasheel service centre, or a bank branch handling your own application. Never to an individual working out of a car, a shop, or a private office.
- Verify any visa or immigration service provider’s trade licence before paying them or handing over documents. A genuine typing centre or PRO service operates from a registered, licensed office.
- Never hand over your original passport or Emirates ID to anyone who isn’t a verified employer, PRO, or government counter. A photocopy is enough for almost every legitimate request.
- If you’re unsure whether a request for your biometric data is genuine, contact your own consulate or ICP directly before you comply, not after.
The UAE Pass OTP Scam
In this pattern, fraudsters call pretending to be police, the Ministry of Interior, or a bank.
They use pressure and urgency — sometimes shouting — to get victims to share a UAE Pass OTP, Emirates ID details, or bank card information.
The pretext is usually “identity verification” or a “system update.”
Sharing the OTP hands the scammer live access to the victim’s UAE Pass account, which can then drain linked accounts or steal further data.
The UAE’s Ministry of Human Resources has stated plainly: official authorities will never send OTP requests by text or phone call.
Any call or message that does, however official it sounds, is fraud.
- Hang up and call the organisation back on its official published number if anyone claiming to be police, a bank, or a government department asks you for an OTP over the phone.
- Never read out or forward a one-time passcode to anyone — a caller already knowing your name or Emirates ID number doesn’t make the call genuine.
- Turn on two-factor authentication for UAE Pass and your banking apps, and change any password you may have shared, even by accident.
- If you already shared an OTP, or your UAE Pass logged you out unexpectedly, reinstall the app and contact your bank immediately to flag suspicious transactions.
A real case study in how a small tech scam escalates into serious financial fraud — the tech-support pop-up scam that led to gold bar fraud.
Fake ICP Calls, Websites, and Logos
ICP has separately warned the public that scammers are using its official name and logo on fake websites and in phone calls to appear legitimate.
The goal is the same as the other two patterns: extract personal information or verification codes.
ICP has stated its employees will never ask for your OTP or UAE Pass verification code over the phone.
Only use the official ICP smart app or icp.gov.ae for any Emirates ID or visa-related service.
What to Do If You Think Your Data Was Misused
If you suspect your biometric data or Emirates ID has already been used without your consent, act quickly.
- Contact your bank immediately to check for and freeze any unauthorised accounts, cards, or loans opened in your name.
- File a report with Dubai Police through its eCrime service, or your local emirate’s police, describing exactly what was requested and by whom.
- Contact ICP directly through its official app or website to flag potential misuse of your Emirates ID.
- If you’re a foreign national, alert your own embassy or consulate — several run dedicated fraud-reporting helplines, such as the Indian Consulate’s Pravasi Bharatiya Sahayata Kendra service in Dubai.
Frequently Asked Questions
Can someone steal my identity with just a face scan or fingerprint?
On its own, a face or fingerprint scan can’t unlock your Emirates ID or UAE Pass account the way a password can. The confirmed scam pattern uses it as one piece of a larger set — alongside your passport and Emirates ID details — collected together to impersonate you.
Will ICP or UAE Pass ever call me asking for my OTP?
No. Both ICP and TDRA, which runs UAE Pass, have stated publicly that their staff will never ask for an OTP or verification code by phone, text, or call, under any circumstance.
Where should I go to submit biometric data for an Emirates ID or visa?
Only at an official, government-approved location — an ICP-authorised typing centre, an Amer or Tasheel service centre, or a bank branch handling your application directly. Never to an individual agent outside an official facility.
What do I do if I already gave my biometric data to an unofficial agent?
Contact your bank to watch for unauthorised accounts or loans, report the incident to Dubai Police or ICP, and if you’re a foreign national, alert your embassy or consulate — several run dedicated fraud-reporting helplines.
How can I tell a real ICP website or call from a fake one?
Only use icp.gov.ae or the official ICP smart app for any service. Treat any unsolicited call, message, or link asking for personal or biometric information as fraudulent, even if it displays the ICP name or logo.
