Revolut prospects say e-money agency failed them after being scammed

A person who had £165,000 stolen from his Revolut enterprise account by fraudsters has instructed BBC Panorama he believes the corporate’s safety measures failed to stop the theft.

He says criminals managed to bypass the ID verification course of to realize entry to his account.

Thus far, Revolut has refused to refund this cash.

The BBC has discovered that Revolut was named in additional reviews of fraud within the final monetary 12 months than any of the main Excessive Avenue banks.

The e-money agency – which has not but been granted full standing as a financial institution – says it takes fraud extremely significantly and that it has “robust controls” to satisfy its authorized and regulatory obligations.

Revolut is amongst a variety of new digital-only monetary establishments that provide all their providers on-line or by means of an app – there are not any branches to go to.

The agency has grown quickly and amassed greater than 45 million prospects worldwide, of which 9 million are within the UK. It nearly tripled its income to £1.8bn in 2023. Its accounts are fast to open and supply aggressive overseas trade charges in an easy-to-use app.

These had been the options that attracted Jack – who runs a world enterprise and desires to carry a number of completely different currencies – to Revolut.

Jack, who requested us to not use his surname, instructed us he was additionally reassured by the safety features Revolut promote of their promoting.

In February, Jack was in a co-working area when he acquired a cellphone name from a scammer pretending to be from Revolut. He was instructed he was being referred to as as a result of his account may need been compromised by means of being on shared Wi-Fi.

Jack was tricked into handing over sufficient data to permit the scammers to place his Revolut account onto their machine. This meant they might see all his earlier transactions, together with a purchase order on the on-line retailer Etsy that morning.

Whereas Jack was nonetheless on the cellphone to the scammers, a textual content message from Revolut arrived, asking him to substantiate the very same quantity he had spent – £21.98 – by typing in a six-digit safety code.

He stated, “Yes, that was me,” and browse out the code to the scammers.

What Jack didn’t realise was that they’d arrange their very own account – additionally referred to as Etsy – and by sharing the code Revolut had despatched him, he was authorising a brand new cost to their faux account as a substitute.

Two comparable texts adopted to authorise funds of small quantities to 2 additional faux accounts, referred to as “Revolut fees” and “Revolut fees care”. Jack additionally authorised these – which meant he had been tricked into organising three new payees.

This opened the floodgates and 1000’s of kilos started to fly out.

As quickly as Jack realised he was being scammed, he contacted Revolut – however there was no devoted helpline, only a chat operate deep inside the app.

“I messaged them saying, ‘I’ve been scammed, please freeze my account,’” he told the BBC.

It took 23 minutes to reach the right department that could freeze the account, during which time another £67,000 had been taken.

Jack is now out of pocket by £165,000. He thinks Revolut’s systems failed him in several ways.

He believes criminals managed to bypass facial-recognition software to gain access to his account on their device. If an account is set up on a new device, Revolut asks for a selfie, which Jack says he did not provide.

Jack says he asked Revolut to show him the image used to authorised the new device. They eventually told him that it wasn’t stored in their system, so there was no way of proving what the fraudsters had done, or what photo was used.

Panorama investigated this apparent vulnerability and found that it appeared to have been fixed.

Jack also believes the fact that 137 individual payments were being made to three new payees in the space of an hour, should have raised concerns with Revolut.

Most banks and financial institutions monitor customers’ accounts for unusual activity.

“If somebody is suddenly processing a vast amount of transactions and a ton of payments to a new account, it is something that is a red flag – and banks should typically start to investigate some of that behaviour,” says Nina Kerkez, a fraud specialist at data analytics company LexisNexis Risk Solutions.

“[They should] call their customer, send them a text message, engage in some way to ensure those transactions are legitimate.”

Last year, the UK’s national reporting centre for fraud and cyber-crime Action Fraud, received almost 10,000 reports of fraud in which Revolut was named, according to a Freedom of Information (FOI) request submitted by Panorama.

That is 2,000 more than Barclays, one of the biggest banks in the UK, and double that of Monzo, a competitor of similar size to Revolut.

Panorama spoke to eight former employees to try to understand Revolut’s work culture, and two issues came up again and again – Revolut’s insatiable appetite for growth, and a high-pressure environment.

“Protecting Revolut from being used for financial crime always played second fiddle to the desire to launch new products and to get existing customers to use products more,” an insider, who wished to remain anonymous, told us.

Fraud is a problem for all banks and scams continue to net hundreds of millions even while the technology to defeat them improves.

In order to protect customers, financial companies do extra checks but sometimes these security steps can get in the way of a smooth customer experience.

Revolut says it has a “high performance culture” with an “expectation to deliver good customer outcomes” and that all new product launches involve comprehensive risk assessment and governance approval processes.

It also says it has “invested heavily” in its financial crime prevention team, which now makes up more than a third of its total global workforce.

Britain’s Newest Bank: How Safe Is Your Money?

Reporter Catrin Nye investigates the tales of Revolut prospects who say scammers took tens of 1000’s of kilos from their accounts, and that Revolut failed to guard them.

Watch on BBC iPlayer or on BBC One on Monday 14 October at 20:00 (20:30 in Wales and Northern Eire)

Revolut says it cannot comment on Jack’s case as it is being looked at by the Financial Ombudsman Service.

In 2023 the ombudsman received about 3,500 complaints about Revolut, more than any other bank or e-money firm.

“[This] shows that actually Revolut aren’t doing enough to act in this area,” says Rob Lilley-Jones, from consumer group Which?

He says that Which? does not recommend banking large sums of money with the firm.

“They have a track record of not reimbursing people who fall victim to fraud or find themselves in this incredibly difficult situation, [and] of money being taken from accounts even after scam activity has been reported.”

Revolut says that each potential fraud case is carefully investigated so it can evaluate the full circumstances and make the most informed decision.

Earlier this month new rules came in to make all banks and electronic money institutions reimburse victims of fraud.

The majority of scam victims will now be reimbursed their money automatically up to the value of £85,000, with refunds split 50-50 between sending and receiving firms.

This could prove costly for Revolut.

“We hear from customers consistently that they’re told to set up Revolut accounts when they are becoming the victim of a scam,” says Will Ayles from Refundee, a company specialising in fraud recovery.

“It might be safe to draw the conclusion from that, that fraud victims are told to set up Revolut accounts because fraudsters find it easier to move money through Revolut than any other bank.”

When someone is tricked into transferring money to a fraudster it is known as an authorised push payment (APP) fraud. It’s the most common type of financial scam in the UK.

Last year, figures from the Payment Systems Regulator show that for every million pounds paid into Revolut accounts, £756 was from APP fraud.

That is more than 10 times the amount for Barclays and four times more than Monzo.

Revolut says it takes fraud incredibly seriously, and has approaches to tackle it, including delaying payments, “to allow customers to stop, think and complete additional checks”.

It also says it has recently announced “a new biometric identification feature” and “an advanced AI-scam detection feature that protects customers against card scams”.

In July this year, the UK banking regulator granted Revolut a provisional banking licence, and it is now on its way to becoming a fully-fledged bank.

This means that if Revolut were to go bust, customers’ deposits would be guaranteed up to £85,000 per person.

Until then, it will continue to operate as an electronic money institution or e-money firm.

However, becoming a bank means it will be able to extend credit to customers via credit cards, overdrafts and mortgages.

“This means the stakes are higher for their customers if they’re targeted by a scammer,” says Rob Lilley-Jones.

“I think there might be a political element to Revolut’s licensing, because it’s becoming of a size to challenge High Street banks,” says Frances Coppola, a financial journalist and expert on banking risks and regulations.

“I think no government would want to have something of that size playing fast and loose with the rules.” However, she adds: “I suppose you could question, given there are so many complaints, whether Revolut should have a licence.”

The Treasury says the decision on whether to grant Revolut a banking license lies with the independent regulators. They declined to comment to Panorama.

Revolut says that it abides by the same regulatory standards as any High Street bank, and it is sorry to hear of any instance where customers have been targeted by criminals.

It says it cut fraud by 20% last year but acknowledges “there is always more to do”.

• Customers can complain about any regulated firm to the Financial Ombudsman Service, which can settle disputes and order firms to pay compensation
• Mandatory Reimbursement Requirement regulations were brought in on 7 October 2024
• They will cover the vast majority of UK money transfers up to £85,000, with the exception of international transfers or those involving cryptocurrencies
• The new measures protect individuals, microenterprises – with fewer than 10 employees – and charities with an annual income of less than £1m
• BBC Motion Line has extra sources