revolutsecurity.com Open in urlscan Pro
45.42.212.205  Public Scan

Form analysis
0 forms found in the DOM

Text Content

REVOLUT FRAUD IN FOREIGN COUNTRY

Eric Ridenour

May 16, 2022

eric.ridenour1@protonmail.com

In February 2022, my Revolut card was stolen while I was in Guatemala. I ended
up losing nearly $1,000 because of it but also had an interesting experience at
the restaurant where my card was used fraudulently.

Hopefully this article might help others and allow Revolut to resolve some
obvious issues with their fraud detection.

For anyone not familiar, Revolut is relatively new to the banking industry. They
have attempted to distinguish themselves from traditional banks with their
emphasis on stopping fraud and have claimed that their fraud detection is seven
times better than big banks.

Considering the fact that Revolut couldn't even do a remedial job of protecting
my money, I find that claim not remotely credible.


TEXTS FROM REVOLUT

While sitting in a cafe in Guatemala City, I received a text from Revolut
stating that a transaction on my card was declined due to "insufficient funds".
I was shocked to see this, because I wasn't using my card and hadn’t yet
realized it had been stolen. After clicking on the first text message, another
"insufficient funds" message immediately appeared. It was then immediately
followed by three more texts indicating successful withdraws. In total, I
received 5 texts from Revolut.


FRAUDULENT TRANSACTIONS

It turns out that someone had used my card at a restaurant named "El Rinconcito
de la 12" in Guatemala City and had successfully withdrawn over $900 (7,000
Guatemala Quetzals).

The thieves had initially tried two unsuccessful transactions of $5,300 (40,000
Quetzals) and $2,650 (20,000 Quetzals). Fortunately, these failed due to
insufficient funds in my account. Their last three attempts of $400 (3,000
Quetzals), $400 (3,000 Quetzals) and $133 (1,000 Quetzals) were successful.

Below are the three fraudulent transactions that got through Revolut's
anti-fraud system. (Revolut doesn't support Guatemalan Quetzals, so they pulled
Mexican Pesos from my Revolut account. The "Q3000" indicates Guatemalan
Quetzals, while "M$8003.13" are Mexican Pesos. Eight thousand Mexican Pesos is
approximately $400 US).


CHARGE-BACK ATTEMPT WITH REVOLUT

I immediately filled out Revolut's "charge-back" form, in an attempt to get my
money back. They rejected my claim a few days later.


THINGS REVOLUT COULD HAVE DONE DIFFERENTLY

1. Freeze card after one transaction attempt over the credit limit.My card has a
maximum daily limit of $1,000. The fact that there were multiple, attempted
transactions over that limit is a clear indication that the person using the
card is not familiar with it. Once that limit was breached, the card should have
been immediately frozen. Even Wells Fargo's security was able to lock my card on
the first attempt during a previous incident six years ago.

2. Utilize past consumer spending habits. At the time of this fraud, I had owned
my Revolut card for 10 months and my largest transaction to-date was $143. A
transaction attempt of $5,300 should have definitely raised some red flags at
Revolut. It's 36 times greater than any previous transaction.

3. Consider location and type of business.This transaction took place at a
small, inexpensive restaurant in Guatemala City (see below). The most expensive
item on their menu is under $10. At a Louis Vuitton store, a transaction of
$5,300 might not raise any eyebrows, but an attempted $5,300 transaction at a
cheap restaurant in a third world country certainly should. Even the two $400
transactions that Revolut allowed are extraordinarily high at a restaurant in a
third world country.

There were enough obvious red flags on these transactions for Revolut's
anti-fraud system to have stopped them.


THINGS I COULD HAVE DONE DIFFERENTLY

1. Freeze my card while not in use. When I realized my card had been stolen, my
first thought was how stupid I had been for not having frozen my card,
especially since I hadn’t used it in a long time.

2. Notice text messages immediately. It was unfortunate that I hadn't noticed
the initial text from Revolut until about 5 minutes after it had been sent. If I
had immediately noticed the first text, I could have frozen my card and none of
the other transactions would have worked.


VISITING THE RESTAURANT

The next day, I visited the restaurant where the fraud took place and took this
picture. I returned after the restaurant opened and spoke with the owner about
the fraud.

"El Rinconcito" was a small place with six tables. I walked over to a woman
standing behind a counter and explained that my card had recently been stolen
and someone had spent 7,000 Quetzals on my card at this restaurant. Her eyes got
as big as saucers and she said nothing. I'm sure that this waitress had nothing
to do with the fraud and was probably embarrassed to hear me say this. Seven
thousand Quetzals is an enormous amount of money in Guatemala; more than an
average month's salary.[1] I had spoken loud enough that I'm sure a few diners
in the restaurant could hear me.

Soon after I finished speaking, the owner walked over and explained that my card
was used by a group of five people; a man and four young adults. They had stayed
for a couple hours and had run up a large bill by drinking. I found this
explanation not even remotely credible. I then asked why his restaurant
attempted a transaction of $5,300 on my card (40,000 Quetzals). He ignored the
question. When I asked again, he simply stated that his wife ran the transaction
and she was gone for the day. I asked a few more questions and then decided to
leave.

I assume that the five drinkers and the restaurant came to some agreement to
drain as much money from my account as possible and split whatever funds they
could get.

I'm sorry that Revolut's weak anti-fraud software was able to obliged them.



[1] https://wagecentre.com/salary/north-america/guatemala