Revolut customers say the cryptocurrency company failed after being scammed

A man who had £165,000 stolen from his Revolut business account by fraudsters has told BBC Panorama that he believes the company’s security measures failed to prevent the theft.

He said the criminals tried to bypass the ID verification process to gain access to his account.

To date, Revolut still refuses to refund this amount.

The BBC found that Revolut was named in more fraud reports in the last financial year than any other major High Street bank.

The cryptocurrency firm – which has yet to be granted full banking status – said it takes the issue of fraud extremely seriously and has “robust controls” in place to meet its legal and regulatory obligations yours.

Revolut is one of a number of new digital-only financial institutions offering all their services online or through an app – there are no branches to visit.

The company has grown rapidly and attracted more than 45 million customers worldwide, including 9 million in the UK. Its revenues almost triple to £1.8 billion by 2023. Its accounts are opened quickly and offer competitive exchange rates in an easy-to-use app.

These are the features that attracted Jack – who runs an international business and needs to hold many different currencies – to Revolut.

Jack, who asked that we not use his last name, told us that he was also reassured by the security features Revolut promotes in its advertising.

In February, Jack was in a coworking space when he received a phone call from a scammer pretending to be from Revolut. He was informed that he was called because his account may have been compromised due to shared Wi-Fi use.

Jack was tricked into providing enough information to allow the scammers to put his Revolut account on their device. This meant they could see all of his previous transactions, including purchases made at online retailer Etsy that morning.

While Jack was still on the phone with the scammers, a text message from Revolut arrived, asking him to confirm exactly how much he had spent – £21.98 – by entering a security code contains six digits.

He said: “Yes, that’s me” and read the code to the scammers.

What Jack didn’t realize was that they had set up their own account – also known as Etsy – and by sharing the code that Revolut had sent him, he instead authorized a new payment on their fake accounts.

Two similar documents then authorized small payments to two other fake accounts, called “Revolut Fees” and “Revolut Fee Care”. Jack also approved these – meaning he was tricked into setting up three new payees.

This opened the floodgates and thousands of pounds started flying out.

As soon as Jack realized he was being scammed, he contacted Revolut – but there’s no dedicated helpline, just a deep chat function within the app.

“I texted them saying: ‘I’ve been scammed, please freeze my account’,” he told the BBC.

It took 23 minutes to get to the right department to freeze the account, during which time another £67,000 was taken.

Jack is now out of £165,000. He believes Revolut’s system failed him in many ways.

He believes criminals bypassed facial recognition software to gain access to his account on their device. If an account is set up on a new device, Revolut will ask for a selfie, which Jack says he doesn’t provide.

Jack says he asked Revolut to show him the image used to authorize the new device. Ultimately, they told him it wasn’t stored in their system, so there was no way to prove what the scammers did or which photo was used.

Panorama investigated this apparent vulnerability and discovered that it appears to have been fixed.

Jack also believes that the fact that 137 individual payments were made to three new payees within an hour should raise concerns with Revolut.

Most banks and financial institutions monitor customer accounts for unusual activity.

Nina Kerkez, a fraud expert, said: “If someone suddenly processes a large number of transactions and a series of payments into a new account, that is a red flag – and the banks It’s usually a good idea to start investigating some of that behavior.” at data analytics company LexisNexis Risk Solutions.

“[They should] Call their customers, send them messages, do some way to make sure those transactions are legitimate.”

Last year, the UK’s national reporting center for fraud and cybercrime, received almost 10,000 reports of fraud in which Revolut was named, according to a Freedom of Information (FOI) request made by the Global sending scene.

That’s 2,000 more than Barclays, one of the biggest banks in the UK, and double that of Monzo, a similarly sized competitor to Revolut.

Panorama spoke to eight former employees to try to understand Revolut’s work culture and two recurring problems – Revolut’s insatiable thirst for growth and its high-pressure environment.

One insider, who wished to remain anonymous, told us: “Protecting Revolut from being used for financial crime has always played a secondary role to the desire to launch new products and attract existing customers. to use the product more.”

Fraud is a problem for all banks, and scams continue to rake in hundreds of millions of dollars even as the technology to prevent them improves.

To protect customers, financial companies perform additional checks, but sometimes these security steps can hinder a smooth customer experience.

Revolut says it has a “high performance culture” with “an expectation of delivering strong customer outcomes” and that all new product launches involve a risk assessment and governance approval process comprehensive.

It also said it had “invested heavily” in its financial crime team, which now makes up more than a third of its total global workforce.

Britain’s newest bank: How safe is your money?

Reporter Catrin Nye investigates the stories of Revolut customers who say fraudsters took tens of thousands of pounds from their accounts and Revolut failed to protect them.

See more BBC iPlayer or on BBC One on Monday 14 October at 20:00 (20:30 in Wales and Northern Ireland)

Revolut said it could not comment on Jack’s case because it is being reviewed by the Financial Ombudsman.

In 2023, the ombudsman received around 3,500 complaints about Revolut, more than any other bank or crypto company.

“[This] shows that Revolut really isn’t doing enough to act in this area,” said Rob Lilley-Jones, from consumer group Which?, said.

He said which one? It is not recommended to transact large amounts of money with the company.

“They have a history of not refunding people who fall victim to fraud or find themselves in this extremely difficult situation, [and] Money was taken from accounts even after fraudulent activity was reported.”

Revolut says that each case of potential fraud is carefully investigated so that the full situation can be assessed and the most informed decision can be made.

Earlier this month, new regulations were introduced requiring all banks and cryptocurrency institutions to reimburse victims of fraud.

The majority of scam victims will now have their money automatically refunded to the value of up to £85,000, with the refund split 50-50 between the sending and receiving companies.

This could be costly for Revolut.

Will Ayles from Refundee, a company specializing in fraud recovery, said: “We regularly hear from customers that they are asked to set up a Revolut account when they are about to fall victim to a scam. island”.

“It is safe to draw the conclusion from that that fraud victims are asked to set up Revolut accounts because fraudsters find it easier to transfer money through Revolut than any other bank.”

When someone is tricked into transferring money to a scammer, it’s called authorized push payment (APP) fraud. This is the most common type of financial scam in the UK.

Last year, figures from the Payment Systems Regulator showed that for every million pounds paid into a Revolut account, £756 was due to APP fraud.

This is more than 10 times the amount of Barclays and 4 times more than Monzo.

Revolut said it takes fraud extremely seriously and has methods in place to tackle it, including delaying payments, “to allow customers to stop, think and complete their checks.” additional investigation”.

It also said it recently announced “a new biometric recognition feature” and “an advanced AI fraud detection feature that helps protect customers from card scams.”

In July this year, the UK banking regulator granted Revolut a provisional banking license and it is now on track to become a full-fledged bank.

This means that if Revolut goes bust, customer deposits will be guaranteed up to £85,000 each.

Until then, it will continue to operate as an electronic money institution or cryptocurrency company.

However, becoming a bank means it will be able to extend credit to customers through credit cards, overdrafts and mortgages.

“This means customers are at greater risk if they become targeted by a fraudster,” said Rob Lilley-Jones.

Frances Coppola, a financial journalist and expert on banking risk and regulation, said: “I think there may be a political element to Revolut’s licensing, because it is taking on such a large scale to challenge Knowledge of High Street banks”.

“I think no government wants to have something of that scale playing fast and loose with the rules.” However, she added: “I suppose you could ask, given the number of complaints, whether Revolut should have a licence.”

The Ministry of Finance said the decision on whether to grant Revolut a banking license or not rests with independent regulators. They declined to comment on Panorama.

Revolut says it adheres to the same regulatory standards as any High Street bank and is sorry to hear of any instances where customers have been targeted by criminals.

It said it cut fraud by 20% last year but admitted “there is always more to do”.

• Customers can make complaints about any regulated company with Financial Inspection Servicecan resolve disputes and require companies to pay compensation
• Regulations on mandatory return requirements were issued on October 7, 2024
• They will cover most transfers up to £85,000 in the UK, excluding international transfers or transactions involving cryptocurrencies
• The new measures protect individuals, micro businesses – with fewer than 10 employees – and charities with an annual income of less than £1m
• BBC Action Line has more resources