On this page
What you need to know now
The 2019 warning remains useful security background. Access tax services through verified official channels and independently check unexpected refund requests.
The original article is preserved below as a historical record. Earlier deadlines, rates, offers and approval statements should not be used as current guidance.
- Do not disclose a PIN or sign-in secret.
- Distinguish the business refund route from the tourist operator.
- Verify a request before sending bank or identity evidence.
Verify the request independently
An unexpected message about a refund, overdue tax or account suspension should be checked through an independently opened official service. Do not use the message’s own link or telephone number as the sole proof that it is genuine. Compare the request with the information in the relevant tax account and the service you actually used. A familiar logo, copied invoice or correct company name is not enough to establish the sender’s identity.
Separate useful evidence from sign-in secrets
A genuine application may need identity, invoice or bank-account evidence, but that does not make every request for sensitive information appropriate. Never disclose a password, banking PIN or one-time sign-in code in response to an unsolicited approach. If a document is needed, confirm the official submission route and the case it relates to. Keep a record of what was provided, by whom and for what purpose, especially when several employees handle tax correspondence.
Recognise different legitimate refund routes
Business VAT refunds and tourist refunds are different processes. The official tourist scheme involves the appointed operator, so the older statement that every refund is handled only through one FTA webpage should not be treated as a universal security test. Instead, establish which service applies and use its current official instructions. Fraud prevention depends on verifying the actual route and transaction, not simply accepting or rejecting a message because it mentions a third party.
Respond to a suspected incident
Preserve the message and relevant transaction details without forwarding credentials to other staff. Contact verified support or the organisation’s responsible security person and, where banking information was exposed, use the bank’s official contact route. Review account access and record any suspicious changes. For a business, agree a simple internal rule that changes to refund bank details receive an independent check. The historical warning remains useful when translated into these specific verification and record-keeping steps. Record trusted support channels centrally and review them independently when they change, rather than adopting contact details from the message being investigated.
YOUR NEXT STEPS
A practical way forward
- 01
Step 1
Open the official service independently.
- 02
Step 2
Check account notifications against the message.
- 03
Step 3
Raise suspicious requests through verified support.
CLEAR ANSWERS
Frequently asked questions
Does a promised refund prove a message is genuine?
No.
Are all refund types processed identically?
No. Tourist and business routes differ.
Read the original article First published 15 September 2019 · retained for context
This earlier article is preserved for context. Its rates, deadlines, approvals and announcements may have been superseded. Use the current guidance and official references on this page for your next step.
FTA Updates on Personal Data Scams: The authority noted that some recipients have been asked to provide personal data, including credit card numbers and PIN codes
In response to reports that some bank customers have been receiving emails from unidentified sources impersonating banks and financial institutions requesting personal data with the promise of helping them claim their Value Added Tax (VAT) refunds, the Federal Tax Authority reaffirmed that tax refunds are processed only through the authority’s official website.
In a press statement issued on Tuesday, the authority noted that some recipients have been asked to provide personal data, including names, credit card numbers, and PIN codes, claiming that providing the information will allow them to recover VAT.
“Refunding taxes for legally eligible applicants is a direct transaction between the registered business and the FTA, and does not call for any intermediaries,” the authority said.”
The process is completed via advanced electronic systems, available on the FTA’s official website, which include security features for financial transactions. It is done through official channels using the International Bank Account Number (IBAN), and via systems under the authority of – and electronically linked to – the UAE Central Bank.
“The authority added that all of these official systems involve dealing directly with the FTA using Tax Registration Numbers. “They stand out for their accuracy, confidentiality, and data security, in addition to being inaccessible via email or any other medium that may be prone to piracy and hacking,” the statement said.
The FTA went on to reiterate its warning to all registered businesses, calling on them to remain vigilant and maintain the confidentiality of their personal data.
It also said that all transactions – registration, submitting tax returns, refunding tax for eligible candidates, etc. – can be completed with a few simple steps via the e-Services portal, available 24/7 on the FTA website: www.tax.gov.ae.
VERIFY THE DETAIL
Official sources & further reading
Source checks support this general guide. Your treatment depends on the facts, tax period and applicable legislation.
