Do you like having money? Stop using Revolut.

UPDATE: Revolut has refunded me, I will update the post with more details soon.

MORE UPDATE: I had filed an official complaint with them, expecting it not to go anywhere, and I just received a reply to that. I don’t know if this post had anything to do with it, I’d like to believe that it didn’t and they were going to rule in my favor anyway, but who knows. They told me that ruling against me was a mistake and that they are taking measures both to not repeat the mistake and to improve the UI with my suggestions. They also offered me one year of premium as a gesture of good will.

Unfortunately, I don’t think I will keep using them, because it has been an extremely stressful four days. The timing was doubly unfortunate because it fell on my birthday, and stressing over theft is not how I wanted to spend the day. I would like to hope that they will improve and that my experience doesn’t befall anyone else, because they’re very convenient otherwise.

Thank you all for your support and comments, I have certainly learnt a lot during this process.

ORIGINAL POST:

So I’m extremely careful about my financial security, yet I just had over a thousand Euros stolen and Revolut is siding with the thief.

In case you don’t know, Revolut is one of a new generation of banks that are app-only: You open an account with them by downloading the app to your phone and ordering a card from that, they have no physical branches. I’ve been using them since 2016, and I referred many of my friends to use them as well.

I also use them as my main debit card, because I (mistakenly) thought that the immediate notifications and safety limits would keep me safer in case of fraudulent transactions. Instead, they made me less safe. Here’s how:

I use a virtual card on Revolut so I can revoke it if there’s fraud. I also set limits on all my cards, which sometimes causes recurring bill payments to fail because they bump up against the limit. I am extremely careful not to share my cards or let people see them, especially the virtual ones.

Six days ago, on the 18th, I saw a familiar (and super helpful) notification from the Revolut app:

Thank you, Revolut, for telling me exactly the merchant and charge.

“You have reached your monthly spending limit”, with no information at all as to transaction, merchant or amount. It didn’t even mention which card this transaction was on, just no trace.

Thinking it was a recurring bill payment that’s getting declined, I started looking into my cards, disabling and re-enabling limits. I half-thought this was a Revolut bug, because I couldn’t see a declined transaction in the transactions list anyway. In retrospect, I think their UI hadn’t updated, so the declined transaction wasn’t there, baffling me, and fraud didn’t even enter my mind since I’m extremely careful with my cards.

To clarify, removing the limit is a thing I routinely do, because I intentionally set the limit low to avoid large charges. In retrospect, all that did was train me to remove the limit without thinking, so it was a bad decision, but I don’t think that should mean that the theft is my fault.

While doing this, I see the charge come through, a charge for 945.81 GBP on a travel site. I initially thought I had booked a trip on some site from work and they were using my details, or something similar, since I thought it was almost impossible for anyone to have stolen my card details.

Reporting fraud immediately to no avail

I look at the transaction, verify that I’ve never been to the site making it, click the “I don’t recognize this transaction” at the bottom and begin talking to Revolut. Meanwhile, I completely cancel the virtual card this transaction was made on and call the merchant for a refund. The merchant tells me that they can’t do anything about the charge due to “data protection laws” and that I should contact my bank for a chargeback.

Revolut tell me that the charge is currently pending and I need to wait a few days for it to go through and then file a chargeback. I ask for information about where the card has been used, since you can’t get a list of payments through the app itself. The support person doesn’t seem able to get that list either, so they kind of look around manually and find a payment. They can’t even give a list of all my data under the GDPR so I can see myself, which seems illegal.

In the end, I went through the list myself, and these are all the vendors that ever saw my card:

Revolut telling me to wait seven days for the fraudulent charge to "take".
  • Aegean Web
  • Cineplexx Entertainment
  • Cosmote
  • Gensace.de
  • Shopify
  • Lime
  • Litmus Email Platform
  • Papaki.gr
  • Steamgames.com
  • Taxibeat
  • Transavia.com
  • Uber
  • Virgin Trains
  • www.hetzner.de
  • www.tch.gr

So either one of those vendors leaked the card or was compromised, or Revolut themselves were.

Besides that, I would think that if someone contacts the payment processor and says “this pending transaction is fraud, I didn’t do it, please revert it before the merchant gets the money”, you would want to revert it as soon as possible. Revolut wanted me to do the exact opposite, wait for the merchant to get my money and then politely ask for it back, which seems crazy to me. I guess they have their reasons.

I contact Revolut a few more times about it in the next few days, they tell me again to wait and then file a chargeback, which still sounds odd, but I wait. Two days later, the charge goes through, and I file for a chargeback. On the 22nd, I receive a response from Revolut.

“You made this transaction yourself”

The person who contacted me from the chargeback team told me that I made this transaction myself and am lying about it. I don’t really understand the rationale, why would I not just go to the site and get a refund there right after the charge was made? Regardless, that’s the official position from Revolut.

Meanwhile, the fraudulent transactions keep happening, long after I canceled my card and told Revolut it wasn’t me. However, this wasn’t proof enough for Revolut, who apparently still think I’m the one making the transactions, knowing that they will be declined because I canceled my card.

The fraudulent transactions keep piling up, apparently I keep making them.

They seem to think that I stole money from myself and now I’m trying Revolut to take it from me and give it to me. They also seem to think I’m in India while I’m trying to book tickets for myself, even though they can see my location from my IP.

The Revolut representative telling me that I stole my own money.

The representative told me that I “ignored the notification about suspicious activity”, when no such notification ever appeared. The only notification I ever got was “You have reached your monthly limit”, which I routinely get because of the aforementioned low limits I set for “security”. The only “ignoring” I ever did is to contact them immediately when I saw a charge I didn’t recognize.

The aftermath

I don’t really understand why Revolut won’t refund me. Even if the notification showed the full transaction details and the user allows it to happen, shouldn’t they get the money back by notifying the processor right away? I wasn’t negligent in allowing my card to get stolen, I was just confused by crappy UX and mistakenly changed something which allowed the charge to happen.

This tells me two things:

  1. You can never rely on banks to give you your money back, since they want their fraud statistics to remain low, even if that means refusing you your money.
  2. Never use any kind of security, as disabling it at any point gives the bank an excuse to deny you your rights. If I wasn’t using a limit at all, they would have given me my money back.

I have filed a complaint with the EU Ombudsman and the UK police, to maybe get the payment refunded on the merchant, but I don’t have much hope.

And that’s the story of how I’m 1057 Euros short, for thinking that Revolut had my back if a fraudulent transaction occurred. A costly mistake, for sure, but maybe you can learn from it.

Revolut doesn’t have your back. They don’t give a damn about you. They only care that they get you out of their hair as soon as possible, hopefully without giving you any of your money back.

I don’t know what to do to keep myself safe any more, and I sure as hell don’t know what to do to keep my parents safe. If I couldn’t prevent someone from stealing my money, my dad doesn’t even stand a chance, and it’s clear that the bank is not on my side.

If you have any ideas, please comment below. You can also Tweet or toot at me, or email me directly.