UAE National Cyber-Fraud Strategy: What Businesses Should Review Now

The UAE Ministry of Interior is developing a national strategy to combat cyber fraud, bringing together police, prosecutors, financial regulators, telecommunications authorities and other government bodies.

At a workshop in Abu Dhabi, participants reviewed emerging fraud methods, prevention measures, early-detection capabilities and ways to improve the national response to cyber-enabled financial crime.

The Ministry also presented a Cyber Fraud Risk Assessment Guide, a draft national strategy and the proposed role of the Cyber Fraud Control Centre in supporting prevention, detection and response.

For UAE businesses, the announcement is a reminder that cyber fraud is not only an IT issue.

A successful incident can involve compromised email accounts, impersonated executives, altered payment instructions, weak approval procedures, stolen credentials and insufficient employee awareness.

Technology may create the point of entry, but failures in process and verification often determine whether money is transferred or sensitive data is exposed.

Why the national strategy matters to businesses

The Ministry’s work focuses on creating a more coordinated and proactive framework for addressing cyber fraud across the UAE.

The workshop included representatives from federal and local prosecution offices, the Central Bank of the UAE, the Telecommunications and Digital Government Regulatory Authority, police leadership and other government bodies. Participants discussed prevention, legislation, future capabilities, artificial intelligence and improved coordination between relevant organisations.

This approach reflects the nature of modern cyber fraud.

A single incident may involve:

• A compromised company email account;
• A fraudulent invoice or payment request;
• An impersonated executive or supplier;
• A domestic or overseas recipient account;
• Stolen employee or customer information;
• A malicious website or application;
• Multiple financial and communications platforms.

No single control can address every stage.

Businesses need digital security, secure payment procedures, trained employees and a rehearsed response plan.

The cyber-fraud threats facing UAE businesses

Cyber fraud may begin with a technical compromise, but it often succeeds through social engineering.

Common scenarios include:

Business email compromise

A criminal gains access to an employee, supplier or executive email account and uses it to request a transfer or change payment details.

The message may appear within a genuine email chain, making it more convincing than a basic phishing message.

Supplier and invoice impersonation

Fraudsters imitate a known supplier and send replacement bank details shortly before an expected payment.

The invoice, email signature and company branding may appear genuine.

Executive impersonation

An employee receives an urgent request apparently sent by a senior executive instructing them to transfer funds, disclose information or purchase valuable items.

Artificial intelligence can make these requests more persuasive through cloned voices, synthetic images or convincing written messages.

Credential theft

Employees may be directed to a false login page designed to collect email, banking or cloud-service credentials.

Once access is obtained, criminals may review genuine correspondence before choosing the most credible opportunity to intervene.

Remote-access fraud

A caller pretending to represent a bank, regulator, technology provider or government body may persuade an employee to install software or provide access to a device.

The attacker may then view confidential information, approve transactions or obtain security codes.

Payment controls should not rely on email alone

A well-written email should never be treated as sufficient authority for a substantial or unusual payment.

Before changing bank details or authorising a high-value transfer, businesses should:

1. Confirm the request through an independently verified telephone number.
2. Check that the recipient name matches the contracting entity.
3. Use dual approval for substantial or unusual payments.
4. Question sudden urgency or confidentiality.
5. Verify any change to bank or cryptocurrency-wallet details.
6. Avoid approving payments solely through messaging applications.
7. Record the checks completed before authorisation.
8. Escalate exceptions to a senior decision-maker.

The confirmation process should not use contact details supplied only in the suspicious message.

Instead, staff should refer to an existing contract, verified supplier record or independently sourced contact channel.

Employees remain a critical line of defence

Technical controls are essential, but employees will still receive fraudulent calls, messages and emails.

Training should help staff recognise:

• Unexpected payment requests;
• Changes to supplier details;
• Requests for passwords or one-time codes;
• Links to unfamiliar login pages;
• Pressure to bypass normal procedures;
• Messages demanding secrecy;
• Requests to install remote-access software;
• Unusual communications from senior executives.

Training should be practical and relevant to each employee’s responsibilities.

Finance teams need detailed payment-verification procedures. Executive assistants may need guidance on impersonation. Human-resources teams should understand the risks associated with personal data and fraudulent employment communications.

A once-a-year presentation is unlikely to be enough where threats change quickly.

Businesses should reinforce training through simulated exercises, updated examples and clear reporting routes.

What an effective response plan should include

A cyber-fraud response plan should identify who makes decisions when an incident is suspected.

The plan should cover:

• Who can suspend a payment;
• Who contacts the bank or payment provider;
• Who secures compromised accounts;
• Who preserves email and system records;
• Who assesses legal and regulatory obligations;
• Who communicates with staff, clients and suppliers;
• Who coordinates with external cyber specialists;
• Who reports the incident to the relevant authority.

The first hours may be critical.

Uncertainty over responsibility can result in continued account access, further fraudulent payments and the loss of important evidence.

The UAE Government provides official cybercrime-reporting channels, including Ministry of Interior services and police platforms. UAE cybercrime legislation also addresses electronic fraud, unauthorised access, misuse of data and other technology-enabled offences.

Evidence should be preserved before systems are altered

When a suspected incident occurs, the immediate instinct may be to delete the message, reset every account or shut systems down.

Some security measures may be urgent, but the evidence should also be protected.

Relevant material may include:

• Full emails and headers;
• Login and access records;
• Payment instructions;
• Invoices and contracts;
• Telephone numbers and call logs;
• Messaging histories;
• Bank-account or wallet details;
• Website addresses;
• Screenshots of fraudulent pages;
• Device and network logs;
• A chronology of the incident.

Preserving the available records may help establish how access was obtained, what information was viewed and whether other accounts or transactions were affected.

Cyber security should be proactive rather than reactive

A business should not wait for a fraudulent payment or data breach before reviewing its exposure.

A proportionate cyber-security programme may include:

• Vulnerability assessments;
• Penetration testing;
• Email and identity-security reviews;
• Multi-factor authentication;
• Access-control reviews;
• Cyber-threat monitoring;
• Employee training;
• Incident-response planning;
• Regular testing of backup and recovery procedures.

Conflict Advisory Group’s Cyber Security Services support UAE organisations with vulnerability assessment, penetration testing, threat monitoring, staff awareness and incident-response preparation.

Cyber security cannot remove every risk, but it can reduce exposure, improve detection and help a business respond more effectively when suspicious activity occurs.

Why cyber fraud requires a wider business-risk response

A cyber incident rarely remains confined to the IT department.

It may affect:

• Financial controls;
• Customer and employee data;
• Operational continuity;
• Regulatory obligations;
• Supplier relationships;
• Executive security;
• Business reputation;
• Legal and insurance considerations.

This is particularly important for businesses operating across several countries, using multiple payment platforms or relying on a diverse supplier network.

The response may require coordination between technology, finance, legal, human resources, senior management and external advisers.

Conflict Advisory Group’s Conflict Pro programme provides an integrated framework for organisations that require continuing support across cyber security, internal fraud prevention, workforce risk, physical security and wider business resilience.

The objective is to reduce the gaps that can appear when individual risks are managed separately.

Questions UAE businesses should ask now

The development of the national strategy provides an opportunity for organisations to test their own readiness.

Senior management should ask:

1. Can a single employee authorise a substantial payment?
2. How are changes to supplier bank details verified?
3. Would staff recognise a cloned voice or executive-impersonation attempt?
4. Are multi-factor authentication and access controls applied consistently?
5. Who leads the response to a suspected cyber-fraud incident?
6. Can email, payment and system records be preserved quickly?
7. When was the incident-response plan last tested?
8. Are cyber, financial, operational and reputational risks managed together?

Unclear answers indicate areas that should be reviewed before an incident exposes them.

Building business resilience alongside the national response

The UAE’s proposed strategy emphasises prevention, early detection, coordinated response and the use of modern technology to address evolving forms of cyber fraud.

Businesses should apply the same principles internally.

Strong technical controls should be supported by:

• Clear payment procedures;
• Independent verification;
• Regular staff training;
• Defined reporting routes;
• Evidence-preservation processes;
• Senior management oversight;
• A tested response plan.

Cyber fraud cannot always be prevented. However, an organisation that detects unusual activity quickly and responds through an established process is better placed to limit financial, operational and reputational damage.

How Conflict Advisory Group can assist

Conflict Advisory Group supports UAE organisations seeking to strengthen their cyber resilience and wider business-risk framework.

Depending on the organisation’s requirements, support may include:

• Cyber-risk and vulnerability assessments;
• Penetration testing;
• Threat monitoring;
• Employee cyber-awareness training;
• Incident-response planning;
• Payment-control reviews;
• Internal fraud-risk assessments;
• Integrated business-protection programmes.

No provider can guarantee that every cyberattack or fraud attempt will be prevented.

The objective is to reduce avoidable exposure, improve readiness and ensure that the organisation can respond in a controlled and effective manner.

If your organisation is reviewing its cyber-fraud exposure, payment controls or incident-response readiness, contact Conflict Advisory Group in confidence to discuss the appropriate next steps.