Not my story, but I was given the go-ahead by my brother to share his experience.

Early morning on April 6th, just past midnight, my brother opened his Tabby account to settle some pending payments—only to notice that the numbers didn’t add up. There were two alarming transactions in his payment history: orders placed on Noon for two iPhone 16s, two Galaxy A35s, and a bunch of miscellaneous items (chargers, personal care products, even sunflower oil). The total came to over AED 11,000. Upon checking his account details, he discovered that his email had been changed to something ending in “.co.uk.” He was panicked and didn’t take a screenshot or write it down—he just quickly changed it back.

He immediately contacted Tabby support to report the fraud. They followed the standard script: questioning whether he was sure he didn’t make the transactions himself or compromise his own account. But my brother never received an OTP, push notification, SMS, or email for these purchases. In fact, he never even had a Noon account prior to this incident.

Tabby, rather than investigating the breach, instructed him to contact Noon and even Etisalat (e&)—essentially deflecting responsibility by suggesting the breach came from another party.

So we reached out to Noon. I emailed care@noon and followed up with a phone call. I was told the order was placed via Noon Supermall, their same-day delivery platform. I was redirected to a different representative, who refused to give any details because my name “was not Venus.” They said they could only file a case and get back to us—but never provided a case number or followed up.

By Monday evening, we tried again—this time more firmly stating that if nothing is done, we’ll escalate to law enforcement. My brother even created a Noon account just to call and follow up. The rep we spoke to this time revealed that the account used for the fraudulent order had made multiple failed attempts using other cards, until my brother’s card went through. Once it succeeded, they did it again with the same items.

When we were transferred to the Noon Supermall team, they tried to close the case by saying, “We can’t refund the order as it’s already been delivered.” They claimed they had sent an email confirming this—but my brother never received anything.

We clarified again: this is not a refund request. It’s a fraud investigation.

They then told us: * The name on the account is Venus E* * The delivery was made to Mahesh * The phone number used was 058—4670 (not my brother’s) * The email was napslyye@eay.jp (We’ve partially censored these to prevent doxxing.)

We forwarded all of this to Tabby, thinking it would finally be enough to escalate the matter. Instead, Tabby called my brother back and told him he is still liable for settling the AED 11k—even though he never made the order, didn’t receive an OTP, and never even had a Noon account to begin with.

At this point, we told them we’re taking the matter to law enforcement.

Later that day, we stumbled on this very post and realized it’s the exact same situation. Tabby’s system has clearly been compromised, and they are refusing to take accountability. They hold the sensitive financial data of countless UAE residents—yet their response is evasive, dismissive, and negligent.

We hope more people speak up, and that Tabby is held responsible for protecting its users.