Are fintechs safe?

Fintech is great when used prudently and I’ve used (Transfer)Wise for cash transfer, including large amounts for property purchase, and also just as debit card in non Euro or Sterling areas. All was fine.

But I wouldn’t dream of using a fintech as my main bank or leaving large sums of cash with them. I want a door to bang on if something goes wrong, not a “Really sorry you lost the money” email from some pimply youth on minimum wage in a call center.

This is only the most recent article I’ve read on Revolut’s indifference to fraud. For what it’s worth, my wife and I have closed our Revolut accounts.

‘Sorry you lost the money’: Couple loses thousands of euro of wedding savings in Revolut ‘ordeal’

Pricewatch: The transactions were in increasing amounts from $50 to $2,000 before Revolut ‘finally froze the card at $2,500′

|1600x0

While trying to find someone in Revolut to talk to, the couple independently contacted the travel agency in Cambodia where the money appeared to have gone. Photograph: iStock

When Becca and Lucas woke up on the first morning of their sun holiday shortly before Christmas their spirits were high.

Within minutes they were in the depths of despair after realising that virtually their entire wedding fund had been drained from their Revolut account as they slept.

Days of frustrating and confusing communications with the fintech followed along with their own attempts to retrieve their money from a merchant on the other side of the world.

At no point during the process were the distressed couple able to actually talk to a human being working for the company where they had stored their savings.

Becca was prompted to contact Pricewatch after reading other articles we had written about Revolut customers who had fallen victim to scams.

“This morning my partner and I woke up on the first day of our holiday and noticed nine transactions in US dollars amounting to $7648 (€6,989) which emptied our account leaving only €400,” her mail started.

She said the transactions were in increasing amounts from $50 to $2000 before Revolut “finally froze the card at the $2500. This all happened while we were asleep. The amounts all went to an unknown account.”

That account was in the name of a travel agency in Cambodia, she continued.

“We disputed the amounts with Revolut thinking this would be an easy fix. Unfortunately, we were wrong and they refused a chargeback saying that ‘the team was unable to find any traces of fraudulent activity associated with these charges’. I am so gobsmacked by what has happened. We can’t even get anyone on the phone,” she wrote.

The money, she continued, was in her partner’s account and was earmarked for their wedding next October.

She said the first transaction was recorded at 1.32am on the day in question with the 10th and last attempted transaction just five minutes later.

She says they had spent hours on the day after they realised what had happened sending messages to the company and not getting anywhere. “No one will speak to us on the phone. They keep saying they are busy but our case is their highest priority. They are saying that the transaction was in person. We can easily prove we are on the other side of the world but they won’t listen.”

After her first mail to us, the couple were able to establish what they thought was the start of the problem.

[ Anatomy of a Revolut scam: Peter watched helplessly as thousands drained from his account ]

They were waiting for a 24-hour delivery some days earlier and it had already been delayed once. “I received a message saying they needed my delivery details to be [updated]. I entered my phone number, address, and name. No other details. So dumb I know,” she said.

“Obviously we now realise that it was our fault in sharing the delivery details but even with this I would expect someone to talk to us on the phone. It also doesn’t explain how [the criminals] used Apple Pay or got the bank details,” she writes.

While trying to find someone in Revolut to talk to the couple independently contacted the travel agency in Cambodia where the money appeared to have gone.

In a message, the agency told them it had “spoken with our bank and these funds have not yet arrived to our account. If they do clear we will return the money. Our bank is aware of what has happened and will liaise with the local police.”

The couple was also told that the “transactions were made with a phone app by a guy in our office who purchased four expensive flights (now cancelled) and some luxury items for his lady friend, which we hope to recover.”

The agency then sent what it said was proof that it was trying to get the money back but at the time of writing the couple had no joy.

So all that the couple was able to establish was that the transactions appeared to have been carried out in person by someone who had access to their Apple Pay details.

“I would certainly not be keeping large amounts of money with Revolut,” Becca added. “[It is] refusing to help still and have concluded our case closed.”

We contacted the company and received a statement. This is what it said:

“Revolut takes the protection of its customers extremely seriously and is fully aware of the industry-wide risk of customers being coerced by organised criminals. We are very sorry to hear of [our reader’s] case or any instance where our customers are targeted by ruthless and highly sophisticated criminals. We urge customers to be vigilant.”

It then outlined steps people might take to keep themselves safe.

[ A €10,000 Revolut scam: He had an Irish accent and said his name was Andrew ]

The statement warned people not to “provide your personal financial details, one-time passwords (OTPs) and full PIN, password or passcode to anyone else.”

It urged people to “beware of scam texts and spoof phone calls. Revolut will never phone you with regards to your account security without first confirming via our secure in-app chat. If in doubt, contact Revolut directly using our in-app chat.”

The statement concluded by saying “Revolut, and other financial services companies, work hard and invest heavily to protect and support customers, but it is also vital that criminals are stopped at the source, from using convincing-looking text messages, otherwise they will only step up their efforts to trick people into handing over their money.

“Banks and financial service providers should be the last line of defence against fraud, not the only line of defence.”

Separately the company suggested that the couple’s one time password must have been compromised and pointed to its T&C’s which say that it “won’t refund any money if you’ve acted fraudulently, or you intentionally or carelessly failed to keep your security details or Revolut Card safe. For example, we wouldn’t make a refund if you gave someone your Revolut Card PIN and they made a payment using your card without you knowing about it.”

When the full Revolut statement was shared with our reader she stressed that no card details or codes had been shared with a third party and only delivery address, name and email: “Their response to this was that then we must have made the payments as the payment method is secure. Not eligible for a refund. We then said that we weren’t aware of any codes or card details shared but that it must have happened somehow.

“Their response to this was that we were not eligible for a refund because we must have shared the code or card details. So no matter what we tried to say their answer was always ‘no’ I want to add that during this whole ordeal, Revolut has been by far the worst part. We can try and move past the money but Revolut [has] made it so much worse. We have had five ‘scheduled phone calls’ been told that the phone support are busy but they will get back to us. We waited in the apartment for days trying to sort this [out]. It felt like the whole time they were trying to trick us into saying the wrong thing and to just put the blame on it. No one ever called.”

[ Sinister Revolut scam sees reader’s account drained of thousands ]

We went back to Revolut with some follow-up questions. We asked why this couple who have been the victim of a crime on the Revolut platform not been able to speak to anyone in Revolut and why no- one in the company has spoken to them.

This is what Revolut came back with.

“We offer support via our in-app chat because it’s the most secure method to communicate with customers. Speaking to us via chat means that our customers can be certain they are connected with a member of our team, rather than a caller who could be a scammer.

“We know that the most important thing for our customers is to resolve issues quickly. Our chat system enables us to provide secure and direct communication and to resolve matters efficiently for customers.

“We apologise to [our reader] for the level of customer service he has received. We have issued a goodwill payment to the customer in recognition of the fact that the support he has received has fallen below our usual high standard of care.’”

The goodwill payment was for €150. Our readers told us they did not want it.

We also asked if Revolut was blaming its customer for being the victim of a crime?

It said “our understanding is that the customer provided details that allowed a third party to add a card into an Apple Pay wallet which carried out the disputed transactions. Our view is that the customer could have done more to protect those sensitive details. Customers are explicitly told never to share one-time passwords (OTPs) with anyone else.”

She said that “as per Revolut’s T&C’s - ‘We won’t refund any money if you’ve acted fraudulently, or you intentionally or carelessly failed to keep your security details or Revolut Card safe (unless you told us about this before the payment was taken from your account). For example, we wouldn’t make a refund if you gave someone your Revolut Card PIN and they made a payment using your card without you knowing about it.”

But we will give the last word to the victims of this crime.

“I don’t know how we can prove a one-time password was never shared but it didn’t happen,” Becca says. “Perhaps if Lucas hands over his device to someone and for them to look through it? Or if I can track someone down who has received the same scam text message and to open it while filming to look at how the scam works. If other people also swear they didn’t share a code or card details then surely they have to look into it. She stresses that “Lucas didn’t act fraudulently, intentionally or carelessly. We have sent them a message rejecting the goodwill amount and asked for them to take it back. She also notes that the most recent message from Revolut said simply “Really sorry you lost the money”.

On the subject of fintechs, I’ve been happily using Wise for years. But this weekend I opted out of their cashback service because I really cannot be bothered toting up all the umpteen tiny amounts and reporting them in my French tax return.

I can certainly understand that many traditional banks will feel very threatened by companies such as Revolut so should up their game to compete with features customers find attractive - but this also leads to a constant supply of negative press in their direction.

As far as I am aware Revolut now offer a certain level of protection.

The service I received when my card was hacked was stunning - all resolved in 20 mins with refunds made, old card cancelled and new card on its way. I now use virtual card for online payments so that if I suspect any problem I can instantly cancel it and get another without having to wait 5 days for a physical card to arrive in post.

Totally agree! I only use Wise for currency exchange, which it does extremely well. I do have a euro a/c in which I keep the princely sum of 20€. When I need to send a euro transaction I just move the money into my a/c from my Credit Agricole a/c and it goes straight out again.

2 Likes

Exactly.

I suppose the original article illustrates the need for compulsory financial education in the school curriculum and the general ignorance about what a company like Revolut actually is.

I get the impression that there is more to this than we’re being told in the reporting.

It shouldn’t  be possible to compromise a Revolut (or any other) account with just name, address and email - though that combination is certainly very useful to scammers, add in a date of birth and I’ll bet it is pretty easy to fill out social security numbers and mother’s maiden name.

Assuming that is all the unfortunate victim gave away it will have had to be linked to other data - but that’s not going to be hard, AIUI one can buy data sets containing all sorts of harvested details to match with and Revolut themselves suffered a breech and exposed account details for some 50,000 customers in 2022, and also had $20,000,000 stolen due to software vulnerabilities, so for them to take the attitude “our systems are secure it must have been you” is a bit rich.

I think they need advice from a good firm of lawyers/cybersecurity experts.

1 Like

Are you supposed to declare cashback payments on your tax return? That’s new to me.

As to what Revolut really is, how I understand it, it’s a fintech for UK customers, but for French residents it’s a bank registered in Lithuania and thus subject to European banking regulations.

I don’t think there’s all that much difference in practice between fintechs like Revolut and traditional banks - nowadays customer service and the way they deal with fraud is usually awful whoever it is!

You often can’t get a regular bank on the phone either - have a look at Natwest’s website for example there is not a single phone number listed on their home page or on their “customer support” page - they want you to use their “Digital Assistant” (aka a bot) or send them a message. Only when you get to the “report fraud” page is there a phone number (right at the bottom).

Of course if they have physical branches you can go in and ask someone which you can’t do with the fintechs, but those are not always easily accessible as more and more get closed, and a branch staff member is unlikely to be much help sorting out a fraud issue - they’ll kick the question upstairs.

The one difference with traditional banks is there is some kind of statutory protection for your money if they go bust, so they are a better place to keep larger sums of money.

Yes I use Wise for its convenience and low currency exchange costs but I don’t keep more than a few hundred pounds/euros/dollars in there at any one time.

I’m not 100% sure whether we have to declare cashback payments but the tax inspectors in and around Strasbourg seem to be out for blood at the minute so I’m taking no chances.

I’ve seen examples. You just buy the spreadsheet!

I once went to a conference of (mainly) lawyers, tax advisers and accountants. We were asked for a show of hands as to how many used a fintech at all (about 60-70% did so). And how many would have their salary etc solely dealt with in a fintech bank (only 3 hands went up out of about 400 attendees).

I’m now closer to one of those 3 hands. We don’t have a massive amount invested with a fintech (Nalo) but it’s in an Assurance Vie, in France, and is definitely subject to the same EU /French depositor protections as an AV with a bricks and mortar bank. Investing above the protection limits (@70€k per individual) in future might make me pause, before probably continuing! I understand there hasn’t been call on the AV deposit protection fund since the early 90s (not that the past is of course any guide to the future etc etc).

Yes, I’d be a quite comfortable investing, but not too much, with a guaranteed Fintech. I’d be less happy to have my current account and associated credit/debit cards with one. I’ve no problem with the Wise debit card because if the cash ain’t there, no bad guys can nick it. Even on a long trip I can just top it up as we go and limit any exposure. But if they got access to my current account debit card :scream:

Mind you we’ve just been switched from HSBC to CCF (we were switched the other way twenty years ago) so maybe everything has gone up in smoke :face_with_peeking_eye:

1 Like

John, have you managed to transfer any money to your CCF account i tried and the iban number was for a bank that no longer exists, contacted CCf and they said yes we know we are working on it?

No Frankie. I haven’t worked up the motivation or energy to check what’s been going on? I use an Irish bank account for day to day cash and our primary credit cards (no charges :slightly_smiling_face:) and the HSBC/CCF only for French expenses, taxes, etc. Now that you’ve prompted me I will have a look over the next few days and see what’s happened. I’ll report back if anything isn’t working.

I remember many moons ago we had a project to install a core banking system for a medium sized bank. I hope the CCF cutover has gone better than that did :face_with_hand_over_mouth:

John its all gone well so far all DD done and its fine i just cannot replenish the account, as i said the iban is a defunct bank in the Caribbean ,

That’s good know Frankie. The dodgy IBAN is s bit of a mystery. I’ll do a test transfer of €10 before I trust the one they’ll have given me.

Just sorted out my new CCF online account. They say the old IBAN should stay for 6 months in parallel with the new one. I have a new IBAN but haven’t tried it yet. A few things still don’t seem to work, such as the online banking app (Android) which just says ‘technical error. Not available’ if you try to log in. I’ll wait a bit until I try the new IBAN, won’t need it for a few months.

1 Like

cashback=rebate not earnings so a little surprised. It’s basically a form of discount and not earnings.

It could well be that the fisc share your view. But right now I’d prefer to err on the side of caution.
Is it like a discount, ie based on the purchases you make?
I assumed it was based on the balance in the account, making it more like interest.

I can’t see why a fisc would regard cashback as being anything other than a net reduction in your spending/expenses - and certainly not taxable (or reportable) income.