A man who had £165,000 stolen from his Revolut business account by fraudsters has told BBC Panorama he believes the company’s security measures failed to prevent the theft.
He says criminals managed to bypass the ID verification process to gain access to his account.
So far, Revolut has refused to refund this money.
The BBC has found that Revolut was named in more reports of fraud in the last financial year than any of the major High Street banks.
The e-money firm – which has not yet been granted full status as a bank – says it takes fraud incredibly seriously and that it has “robust controls” to meet its legal and regulatory obligations.
Rise of new type of banks
Revolut is among a number of new digital-only financial institutions that offer all their services online or through an app – there are no branches to go to.
The firm has grown rapidly and amassed more than 45 million customers worldwide, of which nine million are in the UK. It almost tripled its revenue to £1.8bn in 2023. Its accounts are quick to open and offer competitive foreign exchange rates in an easy-to-use app.
These were the features that attracted Jack – who runs an international business and needs to hold multiple different currencies – to Revolut.
Jack, who asked us not to use his surname, told us he was also reassured by the security features Revolut promote in their advertising.
In February, Jack was in a co-working space when he received a phone call from a scammer pretending to be from Revolut. He was told he was being called because his account might have been compromised through being on shared Wi-Fi.
Jack was tricked into handing over enough information to allow the scammers to put his Revolut account onto their device. This meant they could see all his previous transactions, including a purchase at the online retailer Etsy that morning.
While Jack was still on the phone to the scammers, a text message from Revolut arrived, asking him to confirm the exact same amount he had spent – £21.98 – by typing in a six-digit security code.
He said, “Yes, that was me,” and read out the code to the scammers.
What Jack didn’t realise was that they had set up their own account – also called Etsy – and by sharing the code Revolut had sent him, he was authorising a new payment to their fake account instead.
Two similar texts followed to authorise payments of small amounts to two further fake accounts, called “Revolut fees” and “Revolut fees care”. Jack also approved these – which meant he had been tricked into setting up three new payees.
This opened the floodgates and thousands of pounds began to fly out.
As soon as Jack realised he was being scammed, he contacted Revolut – but there was no dedicated helpline, just a chat function deep within the app.
“I messaged them saying, ‘I’ve been scammed, please freeze my account,’” he told the BBC.
It took 23 minutes to reach the right department that could freeze the account, during which time another £67,000 had been taken.
Jack is now out of pocket by £165,000. He thinks Revolut’s systems failed him in several ways.
He believes criminals managed to bypass facial-recognition software to gain access to his account on their device. If an account is set up on a new device, Revolut asks for a selfie, which Jack says he did not provide.