Revolut customers say the e-money company has failed after being defrauded

A man who had £165,000 stolen from his Revolut business account by fraudsters has told BBC Panorama he believes the company’s security measures failed to prevent the theft.

He says the criminals were able to bypass the ID verification process to gain access to his account.

So far, Revolut has refused to refund the money.

The BBC found that Revolut was named in more fraud reports in the last financial year than any of the big High Street banks.

The e-money company – which has not yet been granted full status as a bank – says it takes fraud seriously and has “strong control measures” to meet its legal and regulatory obligations.

Revolut is among a number of digital-only financial institutions that offer all of their services online or through an app – no branches to go to.

The company has grown rapidly and amassed over 45 million customers worldwide, nine million of which are in the UK. It is likely to triple its revenue to £1.8bn by 2023. Its accounts are quick to open and offer competitive foreign exchange rates in an easy-to-use app.

These are the features that attracted Jack – who runs an international business and needs to handle many different currencies – to Revolut.

Jack, who asked that we not use his last name, told us that he was also assured of the safety features that Revolut promotes in their advertising.

In February, Jack was at work when he received a call from a scammer pretending to be from Revolut. He was told he was being called because his account might be compromised due to being on shared Wi-Fi.

Jack was tricked into providing enough information to allow the scammers to install his Revolut account on their device. This meant they could see all of her previous transactions, including purchases from the online store Etsy that morning.

While Jack was still on the phone to the scammers, a text message arrived from Revolut, asking him to confirm the exact same amount he spent – £21.98 – by typing in a six-digit security code.

He said, “Yes, that was me,” and read the code to the scammers.

What Jack didn’t realize was that they had created their own account – also called Etsy – and by sharing the code Revolut sent him, he was authorizing a new payment to their fake account instead.

Two similar documents followed to authorize the payment of a small amount to two other fake accounts, called “Revolut Funds” and “Revolut Funds Maintenance”. Jack also approved this – meaning he had been tricked into setting up three paid people.

This opened the floodgates and thousands of pounds began to fly out.

As soon as Jack realized he was being scammed, he contacted Revolut – but there was no dedicated helpline, just a chat deep within the app.

“I sent them a message saying, ‘I’ve been scammed, please close my account,'” he told the BBC.

It took 23 minutes to get to the correct department to set up the account, during which time a further £67,000 was taken.

Jack is now £165,000 out of pocket. He thinks Revolut’s plans have failed him in many ways.

He believes the hackers were able to bypass facial recognition software to gain access to his account on their device. When the account is set up on the new device, Revolut asks for a selfie, which Jack says he didn’t provide.

Jack says he asked Revolut to show him the image used to certify the new device. They ended up telling him that it wasn’t saved in their system, so there was no way to prove what the scammers did, or which image was used.

Panorama investigated this apparent vulnerability and found that it appears to have been fixed.

Jack also believes that the fact that 137 people’s payments were being paid to three new people in an hour, should have raised concerns about Revolut.

Many banks and financial institutions monitor customer accounts for unusual activity.

“If someone is just processing a large number of transactions and a lot of payments on a new account, that’s a red flag – and banks should start investigating some of that behavior,” said Nina Kerkez, a fraud expert. at data analytics firm LexisNexis Risk Solutions.

“[They should] call their customer, send them a text message, get involved in some way to make sure the transaction is legitimate.”

Last year, the UK’s national fraud reporting agency and Cyber-crime Action Fraud, received almost 10,000 reports of fraud in which Revolut was named, according to a Freedom of Information (FOI) request filed by Panorama.

That’s more than 2,000 more than Barclays, one of the UK’s biggest banks, and double that of Monzo, a rival of similar size to Revolut.

Panorama spoke to eight former employees to try to understand Revolut’s work culture, and two stories came up over and over again – Revolut’s insatiable desire for growth, and a high-pressure environment.

“Protecting Revolut from being used for financial crimes always played a secondary role to the desire to introduce new products and get existing customers to use the products more,” an insider, who wished to remain anonymous, told us.

Fraud is a problem for all banks and scams continue to net hundreds of millions even as the technology to defeat them improves.

In order to protect customers, financial companies perform additional checks but sometimes these security measures can interfere with a smooth customer experience.

Revolut says it has a “culture of high performance” that is “expected to deliver positive customer outcomes” and that all new product launches involve thorough risk assessment and governance approval processes.

It also says it has “invested heavily” in its financial crime prevention team, which now makes up more than a third of its global workforce.

New Bank Of Britain: How Safe Is Your Money?

Journalist Catrin Nye investigates the stories of Revolut customers who say fraudsters took tens of thousands of pounds from their accounts, and that Revolut failed to protect them.

Watch regularly BBC iPlayer or on BBC One on Monday 14 October at 20:00 (20:30 in Wales and Northern Ireland)

Revolut says it cannot comment on Jack’s case as it is being investigated by the Financial Ombudsman Service.

In 2023 the ombudsman received about 3,500 complaints about Revolut, more than any other bank or e-money company.

“[This] it shows that Revolut is not really doing enough to emulate this area,” said Rob Lilley-Jones, from consumer group Which?

Where is it? It is not advisable to bank large sums of money with the firm.

“They have a history of not reimbursing people who are victims of fraud or who find themselves in this incredibly difficult situation, [and] money taken from accounts even after the fraud is reported.”

Revolut says that each potential fraud case is thoroughly investigated in order to assess the full circumstances and make the most informed decision.

At the beginning of this month, new rules were introduced to make all banks and electronic financial institutions reimburse victims of fraud.

Most victims of the scam will now have their money automatically refunded up to a value of £85,000, with the refund split 50-50 between the sending or receiving firms.

This can be very expensive for Revolut.

“We hear from customers all the time that they are told to open Revolut accounts when they fall victim to a scam,” said Will Ayles of Refundee, a fraud detection company.

“It may be safe to conclude that fraud victims are being told to open Revolut accounts because fraudsters find it easier to transfer money through Revolut than any other bank.”

When someone is tricked into transferring money to a fraudster it is known as authorized push payment (APP) fraud. It is the most common type of financial scam in the UK.

Last year, figures from the Payment Systems Regulator show that for every £1 million paid into Revolut accounts, £756 came from APP fraud.

That’s 10 times more than Barclays and four times more than Monzo.

Revolut says it takes fraud incredibly seriously, and has ways to deal with it, including delaying payments, “to allow customers to stop, think and fill out more checks”.

It also says it recently announced a “new biometric identification feature” and an “advanced AI-scam detection feature that protects customers from card fraud”.

In July this year, the UK banking regulator granted Revolut a provisional banking licence, and it is now on its way to becoming a full-fledged bank.

This means that if Revolut were to work hard, customer deposits would be guaranteed up to £85,000 per person.

Until then, it will continue to operate as an electronic money institution or e-money company.

However, being a bank means that it will be able to extend credit to customers through credit cards, loans and mortgages.

“This means that the profit is huge for their customers if they are targeted by a fraudster,” said Rob Lilley-Jones.

“I think there may be a political component to the licensing of Revolut, because it is becoming big enough to challenge the banks,” said Frances Coppola, a financial journalist and expert on banking risks and regulations.

“I don’t think any government would want to have something of that size playing fast and loose by the rules.” However, he adds: “I think you can ask, since there are so many complaints, whether Revolut should have a license.”

The Ministry of Finance says the decision on whether to grant Revolut a banking license rests with independent regulators. They declined to comment to Panorama.

Revolut says it adheres to the same regulatory standards as any High Street bank, and is sad to hear of any instances where customers have been targeted by criminals.

It says it has reduced fraud by 20% in the past year but admits there is “more to be done”.

• Customers can complain about any regulated company Financial Ombudsman Servicecan resolve disputes and order firms to pay compensation
• The Mandatory Reimbursement Regulations were introduced on 7 October 2024
• They will cover most UK money transfers up to £85,000, excluding international transfers or those involving cryptocurrencies.
• The new measures protect individuals, small businesses – with fewer than 10 employees – and charities with an annual turnover of less than £1m
• BBC Action Line has more resources