Revolut customers say e-money firm flunked them after being fraudmed

A man who had £165,000 stolen from his Revolut business account by deceptionsters has telderly BBC Panorama he supposes the company’s security meacertains flunked to obstruct the theft.

He says criminals deal withd to bypass the ID verification process to get access to his account.

So far, Revolut has declined to refund this money.

The BBC has set up that Revolut was named in more increates of deception in the last financial year than any of the presentant High Street banks.

The e-money firm – which has not yet been granted filled status as a bank – says it gets deception incredibly solemnly and that it has “strong deal withs” to greet its lhorrible and regulatory obligations.

Revolut is among a number of novel digital-only financial institutions that recommend all their services online or thraw an app – there are no branches to go to.

The firm has grown rapidly and amassed more than 45 million customers worldwide, of which nine million are in the UK. It almost tripled its revenue to £1.8bn in 2023. Its accounts are rapid to uncover and recommend competitive foreign exalter rates in an straightforward-to-use app.

These were the features that drawed Jack – who runs an international business and necessitates to helderly multiple branch offent currencies – to Revolut.

Jack, who asked us not to use his surname, telderly us he was also repromised by the security features Revolut advertise in their advertising.

In February, Jack was in a co-laboring space when he getd a phone call from a fraudmer pretending to be from Revolut. He was telderly he was being called because his account might have been settled thraw being on splitd Wi-Fi.

Jack was tricked into handing over enough increateation to apexhibit the fraudmers to put his Revolut account onto their device. This unkindt they could see all his previous transactions, including a get at the online retailer Etsy that morning.

While Jack was still on the phone to the fraudmers, a text message from Revolut get tod, asking him to verify the exact same amount he had spent – £21.98 – by typing in a six-digit security code.

He shelp, “Yes, that was me,” and read out the code to the fraudmers.

What Jack didn’t genuineise was that they had set up their own account – also called Etsy – and by sharing the code Revolut had sent him, he was authorising a novel payment to their deceptive account instead.

Two analogous texts trailed to authoelevate payments of petite amounts to two further deceptive accounts, called “Revolut fees” and “Revolut fees join”. Jack also backd these – which unkindt he had been tricked into setting up three novel payees.

This uncovered the floodgates and thousands of pounds began to fly out.

As soon as Jack genuineised he was being fraudmed, he reach outed Revolut – but there was no promiseted helpline, fair a chat function meaningful wislender the app.

“I messaged them saying, ‘I’ve been fraudmed, plrelieve freeze my account,’” he telderly the BBC.

It took 23 minutes to accomplish the right department that could freeze the account, during which time another £67,000 had been getn.

Jack is now out of pocket by £165,000. He slenderks Revolut’s systems flunked him in disconnectal ways.

He supposes criminals deal withd to bypass facial-recognition gentleware to get access to his account on their device. If an account is set up on a novel device, Revolut asks for a selfie, which Jack says he did not provide.

Jack says he asked Revolut to show him the image used to authoelevated the novel device. They eventuassociate telderly him that it wasn’t stored in their system, so there was no way of proving what the deceptionsters had done, or what pboilingo was used.

Panorama spreadigated this apparent vulnerability and set up that it materializeed to have been repaired.

Jack also supposes the fact that 137 individual payments were being made to three novel payees in the space of an hour, should have liftd worrys with Revolut.

Most banks and financial institutions see customers’ accounts for rare activity.

“If somebody is suddenly processing a huge amount of transactions and a ton of payments to a novel account, it is someslenderg that is a red flag – and banks should typicassociate commence to spreadigate some of that behaviour,” says Nina Kerkez, a deception one-of-a-kindist at data analytics company LexisNexis Risk Solutions.

“[They should] call their customer, send them a text message, comprise in some way to promise those transactions are legitimate.”

Last year, the UK’s national increateing centre for deception and cyber-crime Action Fraud, getd almost 10,000 increates of deception in which Revolut was named, according to a Freedom of Increateation (FOI) ask surrenderted by Panorama.

That is 2,000 more than Barclays, one of the hugegest banks in the UK, and double that of Monzo, a competitor of analogous size to Revolut.

Panorama spoke to eight createer participateees to try to comprehend Revolut’s labor culture, and two rehires came up aget and aget – Revolut’s insatiable appetite for growth, and a high-prescertain environment.

“Protecting Revolut from being used for financial crime always joined second fiddle to the desire to begin novel products and to get existing customers to use products more,” an insider, who wanted to remain anonymous, telderly us.

Fraud is a problem for all banks and frauds persist to net hundreds of millions even while the technology to loss them betters.

In order to protect customers, financial companies do extra verifys but sometimes these security steps can get in the way of a dainty customer experience.

Revolut says it has a “high carry outance culture” with an “foreseeation to deinhabitr excellent customer outcomes” and that all novel product begines comprise comprehensive danger assessment and ruleance approval processes.

It also says it has “spreaded heavily” in its financial crime obstruction team, which now creates up more than a third of its total global laborforce.

Britain’s Newest Bank: How Safe Is Your Money?

Reporter Catrin Nye spreadigates the stories of Revolut customers who say fraudmers took tens of thousands of pounds from their accounts, and that Revolut flunked to protect them.

Watch on BBC iPlayer or on BBC One on Monday 14 October at 20:00 (20:30 in Wales and Northern Ireland)

Revolut says it cannot comment on Jack’s case as it is being watched at by the Financial Ombudsman Service.

In 2023 the ombudsman getd about 3,500 grumblets about Revolut, more than any other bank or e-money firm.

“[This] shows that actuassociate Revolut aren’t doing enough to act in this area,” says Rob Lilley-Jones, from devourr group Which?

He says that Which? does not recommend banking big sums of money with the firm.

“They have a track enroll of not reimbursing people who descend victim to deception or discover themselves in this incredibly difficult situation, [and] of money being getn from accounts even after fraud activity has been increateed.”

Revolut says that each potential deception case is joinfilledy spreadigated so it can assess the filled circumstances and create the most increateed decision.

Earlier this month novel rules came in to create all banks and electronic money institutions reimburse victims of deception.

The presentantity of fraud victims will now be reimbursed their money automaticassociate up to the cherish of £85,000, with refunds split 50-50 between sending and receiving firms.

This could show costly for Revolut.

“We hear from customers reliablely that they’re telderly to set up Revolut accounts when they are becoming the victim of a fraud,” says Will Ayles from Refundee, a company one-of-a-kindising in deception recovery.

“It might be protected to draw the conclusion from that, that deception victims are telderly to set up Revolut accounts because deceptionsters discover it easier to transfer money thraw Revolut than any other bank.”

When someone is tricked into transferring money to a deceptionster it is comprehendn as an authoelevated push payment (APP) deception. It’s the most standard type of financial fraud in the UK.

Last year, figures from the Payment Systems Regulator show that for every million pounds phelp into Revolut accounts, £756 was from APP deception.

That is more than 10 times the amount for Barclays and four times more than Monzo.

Revolut says it gets deception incredibly solemnly, and has approaches to tackle it, including postponeing payments, “to apexhibit customers to stop, slenderk and end compriseitional verifys”.

It also says it has recently declared “a novel biometric identification feature” and “an carry ond AI-fraud recognizeion feature that protects customers agetst card frauds”.

In July this year, the UK banking regulator granted Revolut a provisional banking licence, and it is now on its way to becoming a filledy-fledged bank.

This unkinds that if Revolut were to go bust, customers’ deposits would be promised up to £85,000 per person.

Until then, it will persist to function as an electronic money institution or e-money firm.

However, becoming a bank unkinds it will be able to prolong recognize to customers via recognize cards, overwrites and mortgages.

“This unkinds the sgets are higher for their customers if they’re aimed by a fraudmer,” says Rob Lilley-Jones.

“I slenderk there might be a political element to Revolut’s licensing, because it’s becoming of a size to contest High Street banks,” says Frances Coppola, a financial journaenumerate and expert on banking dangers and regulations.

“I slenderk no rulement would want to have someslenderg of that size joining speedy and slack with the rules.” However, she comprises: “I suppose you could ask, given there are so many grumblets, whether Revolut should have a licence.”

The Treasury says the decision on whether to grant Revolut a banking license lies with the self-reliant regulators. They deteriorated to comment to Panorama.

Revolut says that it adheres by the same regulatory standards as any High Street bank, and it is sorry to hear of any instance where customers have been aimed by criminals.

It says it cut deception by 20% last year but accomprehendledges “there is always more to do”.

• Customers can grumble about any regupostponecessitated firm to the Financial Ombudsman Service, which can end disputes and order firms to pay compensation
• Mandatory Reimbursement Requirement regulations were brawt in on 7 October 2024
• They will cover the huge presentantity of UK money transfers up to £85,000, with the exception of international transfers or those involving cryptocurrencies
• The novel meacertains protect individuals, microgo inpelevates – with scanter than 10 participateees – and charities with an annual income of less than £1m
• BBC Action Line has more resources