UAE Bank Ordered to Refund Customer Over Unproven Digital Payment Authorisation

The UAE's banking and insurance disputes settlement unit, Sanadak, has required a local bank to refund an amount deducted from a customer's account through a digital payment service, Emirates 24|7 reported. The ombudsman ruled that the financial institution failed to provide evidence showing that the account holder's mobile phone was linked to the payment service or that he had authorised its use.

According to a disclosure from Sanadak, the customer—identified as B.H.—submitted a complaint against an operating bank in the country, alleging that his account had been hacked. The customer stated that he did not receive any transaction notifications from the bank on his mobile phone regarding the debit.

Following an investigation and communication with the customer, Sanadak determined that the deduction took place via a digital payment service. However, the bank could not furnish proof of authorisation or demonstrate that the customer consented to link his phone to the service. Consequently, Sanadak classified the transaction as unauthorised and mandated a full refund under UAE financial consumer protection and anti-fraud regulations.

Sanadak did not disclose the bank's identity, the refunded sum, or the specific digital payment platform involved. The disclosure also did not indicate whether a one-time password (OTP) was generated or how many transactions occurred.

The ruling reflects the Consumer Protection Standards issued by the Central Bank of the UAE, which place the burden of proof on financial institutions in electronic transactions. Under these standards, a transaction is deemed authorised only if the institution demonstrates that adequate and secure verification controls were applied, unless preliminary evidence raises reasonable doubt that the consumer initiated the transfer.