‘Sorry you lost the money’: Couple loses thousands of euro of wedding savings in Revolut ‘ordeal’

W

WizardDr

Registered User
Messages
1,575
I had a bit of a nightmare with Revolut before; a fraudulent transaction happened on my account and took weeks to sort out. My OH works in credit card fraud in one of the Irish banks and was able to structure messages for me. Took a lot of persistence but did get sorted. They wouldn't admit it was fraud but it was.
When you think of the people ringing Joe Duffy and whinging that they had given their card details with a scam but still got their money back from the Irish Banks.
I only use Revolut for PIN money, - splitting restaurant bills and teachers gift at xmas etc.
 
I think when things go wrong Revolut is very slow to react, and will not speak to the customer. I think Conor had another one last year where he has screen shots of the interactions with the chat bot.

This all seems to revolve around a spam text that one of the couple responded to with their actual address. How this allowed the scammer access to their Revolut account was not explained. There was a lot of mention of a one time code but how the scammer got this is also not explored.

I am not sure if the thrust of the article was poor communication with Revolut or I got scammed in a very unusual way.

All the banks seem to be saying these days is, if you have a scammer access to your account then the money lost is all on you. I know many years ago I got my credit cards frozen in the US when the bank did not know I was there. A phone call sorted it out so I was only stressed for about 45 mins, but that was the bank highlighting that they were keeping an eye out for abnormal spending patterns. It does not seem to be something that Revolut do.
 
Revolut is so handy, but I would not hold any singificant funds in a Rev account precisely because of all the horror stories about what happens if things go wrong. Not being able to call into a branch (maybe very old school) or at least to speak to someone just raises anxiety levels massively. Reading that article almost gives me palpitations.
 
Gordon Gekko said:
The article was bizarre and unbalanced in my view. It danced around the salient issue. The implication seems to be that the ‘victims’ in some way disclosed their details. If that’s the case, it’s their fault.
Click to expand...
The scammer some how added their Revolut card to an Apple pay wallet. How does adding a card to Apple pay work? For Google wallet, you need the card details including the CSV. After that you need to verify the card by either logging into the banking app (in this case Revolut) or by using a code sent to the phone number your bank has for you.

Getting the card details i can probably forgive, maybe the scammer had physical access to the card at some stage, it got leaked in a data breach or something like that. But how were they able to add the card after that? The scammer either needs access to their Revolut account on the phone or the scammer needs to get the code sent to the person's phone. Either way requires the person to disclose some details. I assume Apple works the same and you can't just add a card once you know the card details.
 
Gordon Gekko said:
The article was bizarre and unbalanced in my view. It danced around the salient issue. The implication seems to be that the ‘victims’ in some way disclosed their details. If that’s the case, it’s their fault.
Click to expand...
Is it bizarre or just a back and forth of he said she said without either party being able to back up their side of the story?

IANAL but it seems odd to me that Revolut can claim their terms and conditions were broken and that's all there is to it. Would that stand up? Surely they are the party that have a history of what happened.
 
Like most of you, I am confused by the article. There are two issues here - firstly is how the money was accessed from the Revolut account and secondly how easy or not it is to deal with Revolut once a 'bad' transaction occurs. I am guessing that they are not great to deal with in times like this, but despite having used them for many years, I have never had an issue with them or experienced any 'bad' transaction thankfully.

Revolut (like most of the fintechs - N26/Monese etc) support lots of security features traditional banks dont readily offer. This includes the ability to have have vaults/pockets etc that isolate funds from the main account. If someone is saving for something in particular, surely the funds are best placed to be moved into a pocket for safer keeping (both security and bad spending habits). Also Revolut gives you much more control on what type of transactions are permitted on a card at a point in time, including self-managed spending limits, ability to turn on/off online payments, location-based security, swipe payments, ATM withdrawals, contactless payments (and allowing you set your own limit on this). So from a security perspective, I would say the likes of Revolut put much more control into peoples hands via the app than traditional banks. However, this means that people also need to understand this and know what settings are best suited for them and be willing to dynamically change them as required [e.g. when abroad on holidays etc].
I remember having swipe payments disabled on my card and having a payment rejected somewhere - I simply checked the app to see the cause of the rejection, unlocking it and processing the transaction again !

>>So all that the couple was able to establish was that the transactions appeared to have been carried out in person by someone who had access to their Apple Pay details.

From the article this appears to be how the funds were believed to be accessed. The person must have put the Revolut card on Apple Pay. My understanding on Apple Pay is you can make payment with the physical device (iPhone or Apple Watch) but you have to enter the devices security codes. Online payments are also possible - but limited to Apple devices and require use of touch id to work directly, or if no touch id needs to be connected to the iPhone via bluetooth. [I only use Apple Pay with my physical devices and never online]
https://support.apple.com/en-gb/102626

In summary, I think there is more to this story than is reported here. I think the card details were compromised in some way to support the payments - either physical skimming of the card magnetic strip [with PIN also likely compromised] or virtually where all details, including ccv were compromised. However, with 2FA/MFA on the Revolut app, I find it surprised if these were fully online transactions, but rather Point of Sale transactions which do not require authorisation via the app. But POS transactions need to use either PIN or ccv details.
I don't know if Revolut supports the signature option for authorising payments, but my understanding is the physical card is required for signature payments also (so we are back to card skimming) !!
 
Revolut is never going to explain exactly what happened. Banks aren't in the business of advertising any potential weaknesses in the system, even if it's the customer's fault. It makes it look like Revolut is hiding something, but they aren't. Well, they are but for good reason.
 
someCitizen said:
Surely they are the party that have a history of what happened.
Click to expand...
I just reviewed some of my transactions on Revolut. There is no distinction on the transaction list on the app between an online transactions, a POS transactions or Apple Pay transactions. It also does not tell me how the transaction was authorised [PIN, MFA on app etc]. Revolut will obviously have this detail available to them internally, and should be shared with the complaints. Only then would it be possible to understand their role in the situation and what responsible resides with them.

A caveat here if the payment was made via ApplePay - this information would need to come from Apple Pay itself, rather than from Revolut, as I dont think Revolut would be able to distinguish between the source of Apple Pay authorised transactions (device type and authorisation method - Passcode/FaceId/TouchId etc). But Revolut should be able to confirm the payment was made via ApplePay in the first instance.

I do wonder if the party added the card to Apple Pay on an unsecured wifi network (eg airport wifi) adding another dimension to this story !
 
gnf_ireland said:
Like most of you, I am confused by the article. There are two issues here - firstly is how the money was accessed from the Revolut account and secondly how easy or not it is to deal with Revolut once a 'bad' transaction occurs. I am guessing that they are not great to deal with in times like this, but despite having used them for many years, I have never had an issue with them or experienced any 'bad' transaction thankfully.

Revolut (like most of the fintechs - N26/Monese etc) support lots of security features traditional banks dont readily offer. This includes the ability to have have vaults/pockets etc that isolate funds from the main account. If someone is saving for something in particular, surely the funds are best placed to be moved into a pocket for safer keeping (both security and bad spending habits). Also Revolut gives you much more control on what type of transactions are permitted on a card at a point in time, including self-managed spending limits, ability to turn on/off online payments, location-based security, swipe payments, ATM withdrawals, contactless payments (and allowing you set your own limit on this). So from a security perspective, I would say the likes of Revolut put much more control into peoples hands via the app than traditional banks. However, this means that people also need to understand this and know what settings are best suited for them and be willing to dynamically change them as required [e.g. when abroad on holidays etc].
I remember having swipe payments disabled on my card and having a payment rejected somewhere - I simply checked the app to see the cause of the rejection, unlocking it and processing the transaction again !

>>So all that the couple was able to establish was that the transactions appeared to have been carried out in person by someone who had access to their Apple Pay details.

From the article this appears to be how the funds were believed to be accessed. The person must have put the Revolut card on Apple Pay. My understanding on Apple Pay is you can make payment with the physical device (iPhone or Apple Watch) but you have to enter the devices security codes. Online payments are also possible - but limited to Apple devices and require use of touch id to work directly, or if no touch id needs to be connected to the iPhone via bluetooth. [I only use Apple Pay with my physical devices and never online]
https://support.apple.com/en-gb/102626

In summary, I think there is more to this story than is reported here. I think the card details were compromised in some way to support the payments - either physical skimming of the card magnetic strip [with PIN also likely compromised] or virtually where all details, including ccv were compromised. However, with 2FA/MFA on the Revolut app, I find it surprised if these were fully online transactions, but rather Point of Sale transactions which do not require authorisation via the app. But POS transactions need to use either PIN or ccv details.
I don't know if Revolut supports the signature option for authorising payments, but my understanding is the physical card is required for signature payments also (so we are back to card skimming) !!
Click to expand...
I don't think a lot of people appreciate the security steps and measures they should take to keep their money safe online.

Spy ware could also be a factor here. We still have people saving pin numbers as contacts in phones and other security credentials.

I also find this tendancy of people to keep large amounts in current accounts a bit troubling especially when debit cards etc. are attached to these accounts.

The article doesn't say much outside of detailing the back and forth. I'd imagine the next step for these people is to contact the financial regulator or ombudsman.
 
murphaph1 said:
Revolut is never going to explain exactly what happened. Banks aren't in the business of advertising any potential weaknesses in the system, even if it's the customer's fault. It makes it look like Revolut is hiding something, but they aren't. Well, they are but for good reason.
Click to expand...

If I had 2500 taken from my account and Revolut were saying it was my fault rather than theirs, the least I would expect is for them to prove this. This means a copy of the transaction details including the source of the transaction, type of transaction and how it was authorised. I dont have access to this data - they do, so if they want to state that its my fault, they need to share this information to prove its my fault.

I would expect the same with an Irish bank. If I had a transaction I claimed was fraudulent and they could see it was authorised by PIN, they need to share this to show it was an issue on my side rather than just say "you messed up mate, I am not refunding it"
 
gnf_ireland said:
If I had 2500 taken from my account and Revolut were saying it was my fault rather than theirs, the least I would expect is for them to prove this. This means a copy of the transaction details including the source of the transaction, type of transaction and how it was authorised. I dont have access to this data - they do, so if they want to state that its my fault, they need to share this information to prove its my fault.

I would expect the same with an Irish bank. If I had a transaction I claimed was fraudulent and they could see it was authorised by PIN, they need to share this to show it was an issue on my side rather than just say "you messed up mate, I am not refunding it"
Click to expand...
I tend to agree with all that but we are essentially only getting one side of the story because Revolut won't comment on these things in the media. No bank will. Revolut may actually have told the customer what happened but the customer doesn't want to hear it. It's really hard to know what really happened in this case.
 
murphaph1 said:
I tend to agree with all that but we are essentially only getting one side of the story because Revolut won't comment on these things in the media. No bank will. Revolut may actually have told the customer what happened but the customer doesn't want to hear it. It's really hard to know what really happened in this case.
Click to expand...
Sorry @murphaph1 absolutely. I don't in any way mean that Revolut needs to provide this data to the media - in fact they absolutely should not do so. But they should provide it to the customer on request to support the position they are taking around whether it was fraudulent or not, and where the potential responsibility resides . Whether the customer understand what they were told, believe the response given, accepted it or simply don't want to hear they messed up is a totally different matter.

And yes, it is very hard to comment on any particular case without having access to the raw transaction evidence. Everything else has levels of 'abstraction' and bias inherently built into it, including the customers version of events. As they say, there are three sides to every story - yours, mine and the truth :)
 
gnf_ireland said:
If I had 2500 taken from my account and Revolut were saying it was my fault rather than theirs, the least I would expect is for them to prove this. This means a copy of the transaction details including the source of the transaction, type of transaction and how it was authorised. I dont have access to this data - they do, so if they want to state that its my fault, they need to share this information to prove its my fault.
Click to expand...
Subject access Request would be a place to start.
 
time to plan said:
Subject access Request would be a place to start.
Click to expand...
what's wrong with the Joe Duffy route :) or maybe now its the Conor Pope one !

But back to the original question, I am sure Revolut can been challenging to deal with when something goes wrong - but I do think their may be bias in the article. Either way, I have no idea who is right or wrong and I do hope Conor Pope has seen the communication between Revolut and the customers before going to print and not relied on verbal explanation only.
 
Comes across as a sob story rather than giving the exact particulars on what happened. Think that is more up Conor's street anyway - he has ended up with egg on his face before when he didn't understand the detail
 
GAAmam said:
Comes across as a sob story rather than giving the exact particulars on what happened. Think that is more up Conor's street anyway - he has ended up with egg on his face before when he didn't understand the detail
Click to expand...

Agree with this completely.

What would be more useful (in general) would be to advise people on the available security features of something like Revolut or N26 or whatever, and ensure people know what options they have. Of course everyone makes mistakes, but no different from cash back in the day, if someone accesses your card and PIN number or has your phone, passcode and card details - they can spend a lot of money with very little comeback. Accesss to financial data should be kept as securely as possible, and phone access now falls into the same category. I am not sure everyone realises that.
 
People can be really lax with basic security.

I was sitting across from a woman today who had her ATM PIN taped on the inside of her phone cover in huge letters, right beside the little slits containing her bank cards. It literally said AIB PIN XXXX. I also noticed she had no security code/face ID on her phone, she just swiped to open. A disaster waiting to happen.

If I saw all this in 30 seconds while daydreaming on public transport you can bet that clever criminals are spotting these opportunities on a daily basis and taking advantage.
 
arbitron said:
People can be really lax with basic security.

I was sitting across from a woman today who had her ATM PIN taped on the inside of her phone cover in huge letters, right beside the little slits containing her bank cards. It literally said AIB PIN XXXX. I also noticed she had no security code/face ID on her phone, she just swiped to open. A disaster waiting to happen.

If I saw all this in 30 seconds while daydreaming on public transport you can bet that clever criminals are spotting these opportunities on a daily basis and taking advantage.
Click to expand...
seriously ? I know some people are not very tech savvy, but writing your ATM PIN beside your bank cards is rather special !
Whatever about Apple Pay or Google Pay or whatever, but bank cards and PIN's have been around for decades at this stage
 
You must log in or register to reply here.
Back
Top