Cybersecurity · UAE Residents · 2025 Guide
How to Spot Phishing Scams in UAE 2025 — Real Examples, Warning Signs & What to Do
Written By
Raina
Tech Editor, techhack.org
Last Updated
April 2026
Based on UAE 2025 threat data
Covers
SMS · Email · WhatsApp Scams
Real UAE examples · How to report
Phishing is the #1 cyber threat in the UAE — accounting for 55% of all recorded cyber incidents and 83% of all email-based attacks in 2025. Over 40,000 UAE residents lost money to online scams in a single recent year. The reason phishing works so well here is not because UAE residents are less careful — it is because scammers have learned to exploit the specific organisations UAE residents trust most: DEWA, Etisalat/e&, DHL, Aramex, UAE Pass, and Dubai Police.
This guide shows you exactly what UAE phishing messages look like, the specific warning signs to spot, and what to do if you receive or fall for one.
UAE Phishing — Fast Facts 2025:
- Most impersonated: DEWA, Etisalat/e&, DHL, Aramex, UAE Pass, Dubai Police
- Most common delivery: SMS (smishing) and WhatsApp — not just email
- Top hook: “Your parcel is held” / “Your account will be suspended” / “You have a fine”
- Free UAE checker: staysafe.csc.gov.ae — paste any suspicious URL instantly
- Report in Dubai: ecrime.police.gov.ae or Dubai Police app
- Only 4% of victims globally recover lost money — act within minutes if scammed
The Most Common UAE Phishing Scams in 2025
These are the exact scam types targeting UAE residents right now — with real examples of what the messages look like.
🚨 Scam Type 1 — Fake DEWA / Etisalat Bills
Example SMS received by UAE residents:
Warning signs: Urgency language (“24 hours”), unofficial domain (real DEWA URL is dewa.gov.ae), SMS from a random mobile number rather than official shortcode. DEWA and Etisalat never threaten immediate disconnection via SMS with a payment link.
🚨 Scam Type 2 — Fake DHL / Aramex Parcel Held
Warning signs: Real DHL URL is dhl.com. UAE customs fees are never collected via SMS payment links. The AED 15 amount is deliberately small to seem believable — but your card details are stolen, not AED 15.
🚨 Scam Type 3 — Fake Traffic Fine / Dubai Police
Warning signs: Real Dubai Police fines are checked at dubai.police.gov.ae — they are never sent with payment links via SMS. Always go directly to the official site to check any alleged fine.
🚨 Scam Type 4 — WhatsApp Impersonation
Warning signs: Any request for gift card codes is always a scam — 100% of the time. Call the real person on a different channel before acting on any urgent money request via WhatsApp, regardless of who the profile appears to be.
The 7 Universal Warning Signs of a UAE Phishing Message
⏰ 1. Extreme Urgency
“Act within 24 hours or your account will be closed.” Urgency is designed to stop you thinking clearly. Legitimate UAE organisations do not threaten immediate consequences over SMS.
🔗 2. Suspicious URL
dewa-uae.com, etisalat-pay.net — these look right but aren’t. Real UAE government and utility URLs end in .gov.ae or are well-known .com domains. Check any link at staysafe.csc.gov.ae before clicking.
📱 3. Unexpected Message
Were you expecting a parcel? Did you actually miss a payment? If the answer is no, treat any message claiming otherwise as suspicious until you verify it independently.
🔑 4. Asking for OTP or Password
No legitimate UAE bank, utility, or government entity ever asks for your OTP, password, or full Emirates ID via SMS, WhatsApp, or a website link. Ever. Full stop.
💳 5. Payment via Link
Legitimate UAE services take payments through their official apps or websites — never through a link sent by SMS. Any SMS with a payment link for a government or utility bill should be treated as a scam.
🎁 6. Gift Card Request
Any request to buy gift cards (iTunes, Google Play, Amazon) and share the codes is always a scam — regardless of who seems to be asking. 100% of the time.
🏆 7. Too Good to Be True
“You have won AED 50,000 in the Dubai Shopping Festival lottery.” You did not enter a lottery. There is no prize. This is a scam to collect your personal details or banking information.
What to Do if You Receive a Phishing Message in UAE
✅ Do This — In Order:
- Do not click any link — if you have not clicked yet, you are safe
- Check the URL at staysafe.csc.gov.ae before opening anything suspicious
- Verify independently — go directly to the official app or website (not via the link) to check if the claim is real
- If you clicked and entered details — call your bank immediately (number on the back of your card), change your passwords, and report to Dubai Police eCrime at ecrime.police.gov.ae
- Report the message — forward SMS scams to Dubai Police via the eCrime portal
- Warn your contacts — if a scam impersonates someone you know, tell them so they can warn their contacts too
If you have been scammed — act within minutes: Call your bank’s 24/7 fraud line immediately (number on the back of your card). Every minute matters — UAE banks can sometimes freeze transactions or recall funds if contacted fast enough. Then report to Dubai Police eCrime at ecrime.police.gov.ae. Only 4% of cybercrime victims globally recover money — speed is your only advantage.
Also read on techhack.org:
Frequently Asked Questions — Phishing Scams UAE
What are the most common phishing scams in UAE in 2025?
The most common UAE phishing scams impersonate DEWA, Etisalat/e&, DHL, Aramex, UAE Pass, and Dubai Police. They arrive via SMS or WhatsApp with urgent messages about unpaid bills, held parcels, traffic fines, or account suspensions — containing a fake payment link designed to steal your card details or OTP.
How do I check if a UAE website link is a scam?
Use the free UAE government tool at staysafe.csc.gov.ae — paste any suspicious URL and it instantly checks against known phishing databases. Also install the RZAM browser extension from the Dubai Electronic Security Centre, which blocks malicious sites automatically.
How do I report a phishing scam in UAE?
Report to the Dubai Police eCrime portal at ecrime.police.gov.ae (Dubai) or the MOI eCrime portal at moi.gov.ae (other emirates). If financial details were compromised, call your bank’s fraud line immediately — the number is on the back of your card.
Is it safe to click links in messages from DEWA or Etisalat?
Only if you initiated the communication and are expecting a message. If you receive an unsolicited SMS with a payment link claiming to be from DEWA or Etisalat, do not click it. Instead, open the official DEWA or Etisalat app directly or go to their official website (dewa.gov.ae or etisalat.ae) to check your account status.
The Golden Rule for UAE Phishing Protection
If you did not expect it — verify before you click. Always.
- Check suspicious URLs at staysafe.csc.gov.ae
- Install the RZAM browser extension — free, blocks phishing sites automatically
- Never share your OTP, Emirates ID, or banking details via SMS or a link
- Any request for gift card codes is always a scam — 100% of the time
- Report UAE phishing to ecrime.police.gov.ae
Last updated: April 2026 | Based on UAE Cybersecurity Council advisories, Acronis UAE Threat Report H2 2025, and Dubai Police cybercrime data.
About the Author
Raina
Tech Editor & Cybersecurity Writer · techhack.org
Raina is the tech-savvy mind behind TechHack.org — covering cybersecurity, AI tools, smart home tech, and digital trends across the UAE and beyond.