A person who had £165,000 stolen from his Revolut enterprise account by fraudsters has informed BBC Panorama he believes the corporate’s safety measures failed to forestall the theft.
He says criminals managed to bypass the ID verification course of to realize entry to his account.
To date, Revolut has refused to refund this cash.
The BBC has discovered that Revolut was named in additional experiences of fraud within the final monetary yr than any of the key Excessive Avenue banks.
The e-money agency – which has not but been granted full standing as a financial institution – says it takes fraud extremely severely and that it has “sturdy controls” to fulfill its authorized and regulatory obligations.
Rise of recent kind of banks
Revolut is amongst numerous new digital-only monetary establishments that provide all their providers on-line or by an app – there aren’t any branches to go to.
The agency has grown quickly and amassed greater than 45 million clients worldwide, of which 9 million are within the UK. It virtually tripled its income to £1.8bn in 2023. Its accounts are fast to open and supply aggressive international trade charges in an easy-to-use app.
These had been the options that attracted Jack – who runs a global enterprise and wishes to carry a number of totally different currencies – to Revolut.
Jack, who requested us to not use his surname, informed us he was additionally reassured by the safety features Revolut promote of their promoting.
In February, Jack was in a co-working area when he acquired a cellphone name from a scammer pretending to be from Revolut. He was informed he was being known as as a result of his account might need been compromised by being on shared Wi-Fi.
Jack was tricked into handing over sufficient data to permit the scammers to place his Revolut account onto their gadget. This meant they might see all his earlier transactions, together with a purchase order on the on-line retailer Etsy that morning.
Whereas Jack was nonetheless on the cellphone to the scammers, a textual content message from Revolut arrived, asking him to substantiate the very same quantity he had spent – £21.98 – by typing in a six-digit safety code.
He stated, “Sure, that was me,” and browse out the code to the scammers.
What Jack didn’t realise was that that they had arrange their very own account – additionally known as Etsy – and by sharing the code Revolut had despatched him, he was authorising a brand new fee to their pretend account as an alternative.
Two comparable texts adopted to authorise funds of small quantities to 2 additional pretend accounts, known as “Revolut charges” and “Revolut charges care”. Jack additionally accepted these – which meant he had been tricked into organising three new payees.
This opened the floodgates and hundreds of kilos started to fly out.
As quickly as Jack realised he was being scammed, he contacted Revolut – however there was no devoted helpline, only a chat operate deep inside the app.
“I messaged them saying, ‘I’ve been scammed, please freeze my account,’” he informed the BBC.
It took 23 minutes to succeed in the best division that would freeze the account, throughout which era one other £67,000 had been taken.
Jack is now out of pocket by £165,000. He thinks Revolut’s programs failed him in a number of methods.
He believes criminals managed to bypass facial-recognition software program to realize entry to his account on their gadget. If an account is about up on a brand new gadget, Revolut asks for a selfie, which Jack says he didn’t present.
Jack says he requested Revolut to point out him the picture used to authorised the brand new gadget. They ultimately informed him that it wasn’t saved of their system, so there was no means of proving what the fraudsters had executed, or what picture was used.
Panorama investigated this obvious vulnerability and located that it appeared to have been fastened.
Jack additionally believes the truth that 137 particular person funds had been being made to 3 new payees within the area of an hour, ought to have raised issues with Revolut.
Most banks and monetary establishments monitor clients’ accounts for uncommon exercise.
“If any person is all of a sudden processing an unlimited quantity of transactions and a ton of funds to a brand new account, it’s one thing that may be a crimson flag – and banks ought to usually begin to examine a few of that behaviour,” says Nina Kerkez, a fraud specialist at knowledge analytics firm LexisNexis Threat Options.
“[They should] name their buyer, ship them a textual content message, interact indirectly to make sure these transactions are reputable.”
Revolut options in crime experiences
Final yr, the UK’s nationwide reporting centre for fraud and cyber-crime Motion Fraud, acquired virtually 10,000 experiences of fraud by which Revolut was named, in response to a Freedom of Data (FOI) request submitted by Panorama.
That’s 2,000 greater than Barclays, one of many largest banks within the UK, and double that of Monzo, a competitor of comparable dimension to Revolut.
Panorama spoke to eight former staff to attempt to perceive Revolut’s work tradition, and two points got here up repeatedly – Revolut’s insatiable urge for food for development, and a high-pressure atmosphere.
“Defending Revolut from getting used for monetary crime all the time performed second fiddle to the need to launch new merchandise and to get current clients to make use of merchandise extra,” an insider, who wished to stay nameless, informed us.
Fraud is an issue for all banks and scams proceed to internet tons of of thousands and thousands even whereas the expertise to defeat them improves.
So as to shield clients, monetary firms do additional checks however typically these safety steps can get in the best way of a easy buyer expertise.
Revolut says it has a “excessive efficiency tradition” with an “expectation to ship good buyer outcomes” and that each one new product launches contain complete threat evaluation and governance approval processes.
It additionally says it has “invested closely” in its monetary crime prevention staff, which now makes up greater than a 3rd of its whole world workforce.
Britain’s Newest Bank: How Safe Is Your Money?
Reporter Catrin Nye investigates the tales of Revolut clients who say scammers took tens of hundreds of kilos from their accounts, and that Revolut failed to guard them.
Watch on BBC iPlayer or on BBC One on Monday 14 October at 20:00 (20:30 in Wales and Northern Eire)
No refunds
Revolut says it can not touch upon Jack’s case as it’s being checked out by the Monetary Ombudsman Service.
In 2023 the ombudsman acquired about 3,500 complaints about Revolut, greater than every other financial institution or e-money agency.
“[This] reveals that truly Revolut aren’t doing sufficient to behave on this space,” says Rob Lilley-Jones, from client group Which?
He says that Which? doesn’t suggest banking giant sums of cash with the agency.
“They’ve a monitor file of not reimbursing individuals who fall sufferer to fraud or discover themselves on this extremely tough scenario, [and] of cash being taken from accounts even after rip-off exercise has been reported.”
Revolut says that every potential fraud case is rigorously investigated so it will possibly consider the total circumstances and take advantage of knowledgeable choice.
Earlier this month new guidelines got here in to make all banks and digital cash establishments reimburse victims of fraud.
The vast majority of rip-off victims will now be reimbursed their cash routinely as much as the worth of £85,000, with refunds cut up 50-50 between sending and receiving companies.
This might show expensive for Revolut.
“We hear from clients constantly that they are informed to arrange Revolut accounts when they’re changing into the sufferer of a rip-off,” says Will Ayles from Refundee, an organization specialising in fraud restoration.
“It is perhaps secure to attract the conclusion from that, that fraud victims are informed to arrange Revolut accounts as a result of fraudsters discover it simpler to maneuver cash by Revolut than every other financial institution.”
When somebody is tricked into transferring cash to a fraudster it is named an authorised push fee (APP) fraud. It is the most typical kind of monetary rip-off within the UK.
Final yr, figures from the Fee Techniques Regulator present that for each million kilos paid into Revolut accounts, £756 was from APP fraud.
That’s greater than 10 instances the quantity for Barclays and 4 instances greater than Monzo.
Revolut says it takes fraud extremely severely, and has approaches to sort out it, together with delaying funds, “to permit clients to cease, assume and full further checks”.
It additionally says it has lately introduced “a brand new biometric identification function” and “a complicated AI-scam detection function that protects clients towards card scams”.
The UK’s latest financial institution?
In July this yr, the UK banking regulator granted Revolut a provisional banking licence, and it’s now on its method to changing into a fully-fledged financial institution.
Which means that if Revolut had been to go bust, clients’ deposits could be assured as much as £85,000 per individual.
Till then, it would proceed to function as an digital cash establishment or e-money agency.
Nevertheless, changing into a financial institution means it will likely be capable of prolong credit score to clients by way of bank cards, overdrafts and mortgages.
“This implies the stakes are greater for his or her clients in the event that they’re focused by a scammer,” says Rob Lilley-Jones.
“I believe there is perhaps a political component to Revolut’s licensing, as a result of it is changing into of a dimension to problem Excessive Avenue banks,” says Frances Coppola, a monetary journalist and skilled on banking dangers and rules.
“I believe no authorities would wish to have one thing of that dimension taking part in quick and unfastened with the foundations.” Nevertheless, she provides: “I suppose you can query, given there are such a lot of complaints, whether or not Revolut ought to have a licence.”
The Treasury says the choice on whether or not to grant Revolut a banking license lies with the unbiased regulators. They declined to remark to Panorama.
Revolut says that it abides by the identical regulatory requirements as any Excessive Avenue financial institution, and it’s sorry to listen to of any occasion the place clients have been focused by criminals.
It says it lower fraud by 20% final yr however acknowledges “there’s all the time extra to do”.
How you can complain in case you are a sufferer of fraud
- Prospects can complain about any regulated agency to the Financial Ombudsman Service, which might settle disputes and order companies to pay compensation
- Necessary Reimbursement Requirement rules had been introduced in on 7 October 2024
- They’ll cowl the overwhelming majority of UK cash transfers as much as £85,000, aside from worldwide transfers or these involving cryptocurrencies
- The brand new measures shield people, microenterprises – with fewer than 10 staff – and charities with an annual earnings of lower than £1m
- BBC Action Line has more resources