UAE Cybercrime Law: What Counts as a Cyber Crime and How to Report It

Most people who fall foul of UAE cybercrime rules did not set out to break any law. A heated voice note, a screenshot forwarded to a group chat, an unverified rumour reshared in thirty seconds — conduct that feels trivial on a phone can sit squarely inside a criminal statute. The reverse is also true: victims of online fraud and account hacking often do not realise how developed the UAE's reporting machinery is, or how quickly a complaint can be filed.

Direct answer. Cyber crime in the UAE is governed by one federal statute: Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, which took effect on 2 January 2022 and replaced the earlier cybercrime law, Federal Decree-Law No. 5 of 2012 (see the UAE Government portal's cyber safety page). It criminalises hacking, online fraud, invasion of privacy, online insults and defamation, spreading false information, and a long list of other conduct carried out through networks, websites or any information technology means. Victims can report through official channels including the eCrime website run by Dubai Police, the Ministry of Interior's eCrimes platform, Abu Dhabi Police's Aman service, and the federal Public Prosecution's My Safe Society app.

Which law governs cyber crime in the UAE

One federal law covers the whole country, and it is broader than the word "hacking" suggests.

The controlling instrument is Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes. It is federal, so the same offences apply in Dubai, Abu Dhabi, Sharjah and every other emirate. The official text is published on the UAE Legislation portal. The law's own closing provisions repealed the previous regime, Federal Decree-Law No. 5 of 2012 on Combating Cybercrimes — so anything you read that cites the 2012 law as current is out of date.

Two features of the law matter before any detail:

• It attaches to the means, not the device. An offence can be committed through a website, an email, a messaging app, a social media account, or any "information technology means" — the phone in your hand qualifies.
• It protects both the state and private persons. Attacks on government systems and data sit at the aggravated end; insults, privacy breaches and fraud between individuals fill most of the day-to-day caseload.

What counts as a cybercrime under the law

The offence list is long, and several entries surprise newcomers because the underlying conduct feels social rather than criminal.

According to the UAE Government portal, the law lists offences and penalties for hacking, attacking or tampering with government information systems and data, and for disseminating false information or information that harms the interests and security of the UAE. The portal's list of other cyber offences includes:

• creating or modifying robots to distribute false data
• falsifying electronic documents
• invading the privacy of others
• tampering with medical data, bank accounts and confidential codes
• eBegging
• publishing data that does not comply with media content standards
• creating illegal content and refraining from removing it
• transferring, possessing and using illegal funds
• raising funds without a licence
• blackmail and extortion
• insulting and slandering others
• conducting statistical surveys without a licence
• promoting demonstrations without a licence
• offending a foreign country or religion
• promoting firearms and explosives
• advertising information which misleads consumers

Read that list slowly. Photographing someone without consent and sharing it, reposting a rumour about a company, or threatening to publish someone's private chats unless they pay — all of it maps onto entries above.

Online fraud, hacking and account takeovers

For victims, the most common encounters with the law are phishing links, impersonation accounts, and unauthorised access to email or banking apps.

The law criminalises unauthorised access to websites, systems and accounts, and treats tampering with bank accounts and confidential codes as its own offence category. Practical points if you are on the receiving end:

• Preserve evidence before anything else — screenshots with visible usernames, URLs, transaction records and timestamps. Deleted chats weaken a complaint.
• Do not engage the fraudster further or send "test" payments to verify anything.
• Notify your bank immediately if money moved; the criminal complaint and the bank's own recall process run in parallel.
• File the report through an official channel (covered below) rather than a third-party "recovery agent" — recovery-service offers are themselves a common second-round scam.

Insults, defamation and privacy online

This is where residents most often become accused rather than victims, and the threshold is lower than most expect.

Insulting and slandering others through information technology means is an offence on the government portal's list, and so is invading the privacy of others. In practice that reaches conduct like posting an abusive comment, sharing a private conversation, or circulating someone's photo without consent — including inside what feels like a closed group chat. How a real dispute of this kind unfolds, from screenshot to police station, is walked through in our case study on a WhatsApp defamation case in Dubai.

Three habits keep ordinary users out of trouble:

• Do not put in writing, in any chat, what you would not say in front of a police officer — forwarding can be as risky as authoring.
• Do not record or photograph people without consent, and do not share recordings made by others.
• If you have a genuine grievance against a person or business, route it to the authority that regulates them rather than to a public post.

Rumours, false information and content offences

The "rumours" half of the law's title is not decorative — spreading false information is a standalone offence category.

The law targets disseminating false information and information that harms the interests and security of the UAE, publishing data that does not comply with media content standards, and creating illegal content and refraining from removing it. The practical rule is verification before amplification: resharing an unverified claim is publication, and "I only forwarded it" is not a defence the statute writes in. During fast-moving news events, official accounts — government media offices, police forces, the relevant ministry — are the safe source to quote.

Cyber crime in Dubai: how reporting actually works

The duties are federal, but the counter you report at depends on where you are — and Dubai runs the best-known channel.

The UAE Government portal lists the official channels for reporting cybercrimes online:

• the eCrime website, run by Dubai Police — the primary route for a cyber crime in Dubai
• the eCrimes platform launched by the UAE's Ministry of Interior, available through the MoI UAE app
• the Aman service, run by Abu Dhabi Police
• the My Safe Society app, launched by the UAE's federal Public Prosecution
• any police station, or 999 for urgent help

A well-prepared report states what happened in date order, attaches the evidence you preserved, and identifies the account, number or website involved. After filing, the matter can be referred to the Public Prosecution, which decides whether charges follow. If the other side is abroad, the report is still worth filing — platforms and banks act on police reports even when a prosecution is impractical.

Penalties: how the law punishes cyber offences

The law attaches fines, imprisonment or both to each offence article, and the severity scales with the target and the intent.

Offences against government systems, critical infrastructure and financial institutions sit at the aggravated end; interpersonal offences such as insults and privacy breaches carry lighter — but still criminal — penalties. Beyond fines and imprisonment, courts can order confiscation of devices and deletion of the offending content, and a conviction leaves a criminal record with the visa and employment consequences that follow; for non-citizens, whether deportation accompanies a conviction is decided under the law by the court in the specific case. The exact fine bands and imprisonment thresholds are set article by article by Federal Decree-Law No. 34 of 2021 and can change; confirm the current figures for your specific scenario with the Public Prosecution or a licensed UAE lawyer. Treat any specific number you read on an unofficial website as unverified until a lawyer confirms it against the statute.

What is NOT a cybercrime: bounced cheques and ordinary debt

Not every dispute with a digital paper trail belongs under this law, and the most common confusion involves cheques.

A bounced cheque is a banking and commercial-law matter, not a cybercrime — and for the typical insufficient-funds bounce it is generally no longer a criminal matter at all, as our answer on whether a bounced cheque is still a crime in the UAE explains. Likewise, an unpaid invoice argued over by email is a civil debt claim, not an offence under the cybercrime law, and a contractual dispute does not become criminal because the contract was signed electronically. Where the cybercrime law does enter a money dispute is deception: a forged electronic document, an impersonated account used to redirect a payment, or a phishing page — those are offences in their own right.

If you are accused of a cybercrime in the UAE

Treat a cybercrime allegation as a criminal matter from the first phone call, because that is what it is.

Depending on the article charged, a case may proceed as a misdemeanour or as a more serious offence, and the early stage — the police statement, the device handover, the signed acknowledgment in Arabic — shapes everything after it. Do not delete content after learning of a complaint; that can compound the problem rather than cure it. Do not contact the complainant to negotiate directly. Read our guide to arrest rights and criminal defence in the UAE before your first interview, and get a lawyer involved before you sign anything you cannot read.

What to do now

Match your next step to which side of the complaint you are on.

If you are a victim:

1. Preserve evidence — screenshots, URLs, usernames, transaction records, timestamps.
2. If money moved, call your bank now, then file the report.
3. Report through the official channel for your emirate — eCrime for a cyber crime in Dubai, Aman in Abu Dhabi, the Ministry of Interior's eCrimes platform, or the My Safe Society app.
4. Keep the report reference number; the bank, the platform and any later lawyer will all ask for it.

If you are accused, stop posting, preserve everything, and get representation before your first statement. In either position, you can find and compare verified UAE criminal lawyers on LEXAI and contact one directly — LEXAI lists and verifies lawyers; you engage and pay the lawyer directly, off-platform, on terms you agree with them. You can also use our AI legal assistant to understand the process in plain language before you make the call.

This article is general information about UAE cybercrime law. It is not legal advice on your situation.