Revolut Ltd · DRN-5830629

The complaint Miss R is unhappy Revolut Ltd won’t reimburse money she lost to a scam. What happened On 5 September 2025 I issued my provisional decision on this complaint. I wanted to give both parties a chance to provide any further evidence or arguments before I issued my final decision. That provisional decision forms part of this final decision and is reproduced below. What happened I’ve summarised the events below: - Miss R fell victim to a ‘safe account’ scam. - Miss R said that she’d previously received and responded to a text message about a missed parcel delivery. - On 26 February 2024, she received a call from someone claiming to be another bank – H. - They asked her a set of security questions and claimed that someone in another part of the country was using her card. - The caller claimed to be working with all of her banks to understand why she’d been the victim of fraud. - She subsequently received a call from someone claiming to represent Revolut. - Under instruction from the fraudster, she moved money from her account at H to her Revolut account. - She then received a call from someone claiming to represent another bank – S. Again she was told that money should be moved to Revolut. - Miss R says that she then started to see transactions leave her Revolut account, which she was assured were her funds being redistributed to her new account. - Revolut says that each card payment was confirmed by Miss R in her Revolut app through two-factor authentication. Miss R denies this. - Revolut also claims that Miss R shared a code with the fraudsters that allowed them to set up Apple Pay on their device. Miss R accepts that she provided a code to the fraudsters. - Miss R says she became suspicious when she could see that payments were being made to a merchant in another country. The caller claimed this was to ‘divert’ the fraudster but soon after they hung up. - Miss R reported the matter to Revolut but it declined her claim. It said that Miss R was responsible for the payments because she agreed to them – either by confirming them in the app or passing on the code which allowed the fraudster to make payments using Apple Pay.

-- 1 of 6 --

- Miss R referred the matter to our service but one of our investigators didn’t uphold her complaint. They concluded that Miss R authorised all of the payments in dispute and that there was no reason for Revolut to consider them to be suspicious. - Miss R disagreed. She said that she was sure that she hadn’t authorised the payments and it felt like someone else had taken control of her device. She also felt that her circumstances had not been taken into account and Revolut should have done more to protect her account from fraud. A table of the payments is set out below: Payment number Time (all payments took place on 26/2/24) Description Amount Method of payment Completed/declined 1 20:31 Z – Prepaid card operator £970 Card payment Completed 2 20:44 W – Money remitter £2,950 Card payment Completed 3 21:23 W – Money remitter £2,000 Card payment Completed 4 21:27 G – Merchant £52.25 Apple Pay Completed 21:35 G – Merchant £67.95 Apple Pay Declined 5 21:36 G – Merchant £67.94 Apple Pay Completed 6 21:40 G – Merchant £23.16 Apple Pay Completed As no agreement could be reached, the case was passed to me for a decision. What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position in law is that an account holder will normally only be responsible for payments they’ve authorised. Where a payment is authorised, that will often be because the account holder has made the payment themselves. But there are other circumstances where a payment should fairly be considered authorised, such as where the account holder has given permission for someone else to make a payment on their behalf or they’ve told their payment service provider they want a payment to go ahead. Here there’s a dispute about authorisation, so that’s the first question I’ve considered. There’s no suggestion Miss R made these payments herself. For payments 1-4 the fraudsters appear to have entered her card details into the websites of Z and R. Miss R’s only role appears to have been to confirm the payments in the Revolut app. Payments 5 and 6 were carried out in person in another country, so Miss R can’t have made them.

-- 2 of 6 --

But Miss R fell victim to what is known as a safe account scam. The premise of this scam (generally, and in this specific case) is that money needs to be moved from accounts that are at risk to, generally, new accounts that aren’t (and aren’t yet under the account holder’s control). Miss R appears to have accepted that broad premise and acknowledged the need to move her money. She accepts she moved money from both H and S to Revolut. And, her original testimony to Revolut was that “I received transaction notification to authorise transactions on revolut which I was told would be funnelled back into the new bank account.” This statement suggests both that she knew that her funds needed to be moved and that she received (and presumably responded to) the notifications which asked her to confirm the transactions as genuine. In addition, as our investigator noted, Miss R topped her Revolut account up between payments. It’s unlikely she could have done this without realising that payments were leaving her Revolut account, in line with the premise of the scam. I also understand that her card was blocked when the declined Apple Pay payment was attempted. The card was subsequently unblocked and there’s no evidence anybody else had access to Miss R’s app. So, again, it’s hard to understand why she would have taken this action if she wasn’t agreeing to the payments leaving her account. Overall, I think that Miss R gave permission for someone else to make the payments on her behalf and, in some instances, also told Revolut that she wanted them to take place. That means I think Revolut can fairly treat the payments as authorised. But, taking into account relevant law, regulators’ rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider it fair and reasonable that Revolut should: • have been monitoring accounts and any payments made or received to counter various risks, including preventing fraud and scams; • have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud. This is particularly so given the increase in sophisticated fraud and scams in recent years, which firms are generally more familiar with than the average customer; • have acted to avoid causing foreseeable harm to customers, for example by maintaining adequate systems to detect and prevent scams and by ensuring all aspects of its products, including the contractual terms, enabled it to do so; • in some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment; Should Revolut have recognised that Miss R was at risk of financial harm from fraud? I’ve reached a different conclusion to our investigator on this point. I consider that Revolut should have identified that there was heightened risk of financial harm from fraud by Payment 2. I consider Z (a now seemingly defunct prepaid card operator) and R (a money remittance provider) to be fairly high-risk merchants. It is my understanding that any payment to the latter is effectively a transfer to an overseas recipient. There was also a significant escalation in the value of the payments between payment 1 and 2 (which, in any case, was an unusually large sum for Miss R to pay) and they were close together in time (just 13 minutes apart).

-- 3 of 6 --

I think Revolut should have been sufficiently concerned by Payment 2 that, despite any assurance it had that the payments were authorised, Miss R was at risk of financial harm from fraud. It should have taken appropriate and proportionate steps to warn her at this point. Given the risk associated with the payment, I think that, at the least, it should have asked her a series of questions about the payment in order to narrow down the scam risk and provide an appropriate warning based on her answers. It didn’t do that. And, while I don’t doubt that the fraudsters would have attempted to convince Miss R to continue, there’s no persuasive evidence that she would have either misled Revolut about the purpose of the payment, or the surrounding circumstances, or not responded positively to what ought to have been a fairly clear warning: anyone claiming to be it, or another payment service provider that is asking her to move money is a fraudster and she shouldn’t continue. Revolut have questioned whether the other financial firms involved might have warned Miss R. I think that’s unlikely. The payments from S were fairly modest in size and the payment from H, while larger, appears to have been one of many payments that were received from that account. In other words: the Revolut account was an established payee of that account. In addition, neither of the claim outcome letters that H or S issued mention any interactions between them and Miss R and she has not complained about either business to our service. So provisionally I think Revolut should reimburse Miss R from Payment 2. I’ve also thought about whether Miss R should bear any responsibility for her loss from that point. Having done so, I don’t think she should. It seems to me that Miss R was targeted by the fraudsters because she’d previously responded to a text message about a missed parcel delivery. Though I do note this text message was sent some time before the scam, her response to it would explain why the fraudsters knew personal information about her, including some card details. This knowledge and the spoofing of a number associated with H, appears to have been a powerful combination in persuading Miss R that the call was genuine. I think many people in her circumstances would have also found this persuasive evidence that they were dealing with the genuine payment service provider. I acknowledge that there were aspects of the scam that, in hindsight might reasonably have seemed a little unlikely – the unusual nature of the transactions that the fraudster was attempting (a fact that Miss R did ultimately pick up on), the suggestion that the various payment service providers all worked together and the disclosure of a code that allowed a third party to add her card to Apple Pay (and specifically advised that it should not be shared, even with Revolut). But Miss R’s actions must be seen in the context of a scam in which she was acting under the belief that her money was under threat, she was genuinely speaking to the various different payment service providers and there was no real counter-narrative from Revolut to warn her that she might be falling victim to a scam. In those circumstances, and taking into account that Miss R was manipulated into acting the way she did, I don’t think any deduction should be made to the amount Revolut reimburses. I’ve therefore provisionally concluded that Revolut should reimburse Miss R’s loss from and including payment 2 – a total of £5,161.30. As Miss R has been deprived of this money, I think Revolut should also pay 8% simple interest on that amount from the date of the payments to the date of settlement.

-- 4 of 6 --

Finally, I can’t see that Revolut would have been able to recover the payments that Miss R made. The chargeback scheme enables the reversal of card payments, but only in certain circumstances. I don’t think there would be a valid reason to chargeback the payments here. The way in which the payments were authenticated means that a chargeback on the grounds of fraud could not be raised. A chargeback on the grounds of services not having been provided is also unlikely to have succeeded because each merchant is very likely to have provided a service (a money transfer, in the case of the non-Apple Pay card payments) albeit to a third party. My provisional decision For the reasons I’ve explained, I intend to uphold in part this complaint and instruct Revolut Ltd to pay Miss R: - The outstanding loss from and including Payment 2 - £5,161.30, less any monies relating to those payments which have been recovered or returned. - 8% simple interest per year on that amount from the date of each payment to the date of settlement, less any tax lawfully deductible. Miss R accepted my provisional decision. Revolut did not. In summary it said: - Miss R ought to have taken further steps to verify that she was speaking to Revolut, particularly as she was called from an unknown number. - She ought to have questioned why payments were being made to Z and R when she confirmed them in the app, given how unusual these payments were. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’ve considered Revolut’s further submissions, but they don’t persuade me to reach a different outcome. I acknowledged in my provisional decision that the unusual nature of the transactions was something that Miss R might have questioned, or questioned earlier than she did. I also accept that it was only H’s number that was ‘spoofed’ and not that of Revolut. However, I weighed up those facts against the compelling aspects of the scam (including the number spoofing of H), as well as the fact Miss R was acting under pressure in the belief that her money was under threat. Ultimately I found, and continue to find, that Miss R did not act in a way that should fairly result in a reduction to the amount Revolut reimburses. Therefore, my final decision is unchanged from the provisional decision set out above. My final decision For the reasons I’ve explained, I uphold in part this complaint and instruct Revolut Ltd to pay Miss R: - The outstanding loss from and including Payment 2 - £5,161.30, less any monies relating to those payments which have been recovered or returned. - 8% simple interest per year on that amount from the date of each payment to the date of settlement, less any tax lawfully deductible.

-- 5 of 6 --

Under the rules of the Financial Ombudsman Service, I’m required to ask Miss R to accept or reject my decision before 20 October 2025. Rich Drury Ombudsman

-- 6 of 6 --