Revolut Ltd · DRN-6064184

The complaint Mr C complains that Revolut Ltd won’t reimburse money he lost when he fell victim to an investment scam. Mr C is professionally represented, however for ease, I’ll refer to Mr C throughout my decision. What happened The background to this complaint is well known to both parties and so I’ll only refer to some key events here. In 2023, Mr C fell victim to a crypto investment scam – with a crypto investment company that I’ll refer to as ‘X’. As part of the scam, Mr C moved funds from an account he held at another banking provider, which I will refer to as ‘H,’ under the guidance of X, and then moved the funds onto X via various crypto exchange providers in his own name. The disputed transactions with Revolut took place over a period of five months between 5 April 2023 and 30 August 2023 across 31 transactions. Mr C has also raised a complaint against H with our service, which has been addressed separately. Mr C said he realised he had been a victim of a scam when despite numerous requests to withdraw his funds, X kept informing him he needed to pay various commission fees before being allowed to make a withdrawal. Mr C raised the matter with Revolut but they didn’t agree to refund the disputed payments, so Mr C brought his complaint to our service. Our Investigator partially upheld Mr C’s complaint and said Revolut should provide a partial refund from the fifth payment Mr C made on 31 July 2023. In summary, he said: • Revolut should have intervened twice. Firstly, when Mr C attempted to make a payment of £3,000 to a crypto exchange provider on 4 May 2023, and then when Mr C made his fifth payment on the same day (31 July 2023) to another crypto exchange provider, taking his total for the day to £3,000, which also included a series of declined or reverted payments on the same day. • However, he didn’t feel even if Revolut had intervened on the payment Mr C made on 4 May 2023, and provided him with a tailored warning this would’ve result in Mr C not going ahead with the payment, due to a call he had been provided by H, where it was clear Mr C had misled H. • However, the Investigator did feel the information we’d been provided showed it was clear Mr C had concerns about the investment with X between 4 May 2023 and 31 July 2023, and in his opinion, if Revolut had provided Mr C with a better automated warning prior to the fifth payment he made on 31 July 2023, the scam would’ve been uncovered and Mr C’s loss prevented from this point. • Mr C should take some responsibility for his loss too. And so, it would be fair for Revolut to refund 50% of the payments from the fifth payment he made on 31 July 2023, along with 8% interest.

-- 1 of 5 --

• There wasn’t any prospect of recovery of the funds due to the time that had passed and Mr C had confirmed the funds had been moved onto X from the crypto exchange providers he sent the money to from his Revolut account. Revolut agreed with our Investigator’s recommendation. Mr C didn’t agree, and, in short he said: • He didn’t agree the scam wouldn’t have been uncovered if Revolut had intervened on the payment he made on 4 May 2023 as mentioned by the Investigator. • The phone call he had with H took place nearly a month before, and it was in relation to a payment from H to his Revolut account and not a known crypto merchant. • He tried to report the scam to Revolut on 19 July 2023, so Revolut were on explicit notice from this date and should have provided enhanced friction and scam specific warnings and provided human intervention on any further payments he made from this date which would have uncovered the scam. • He accepts the 50% reduction, but from the £3,000 payment he made on 4 May 2023, through to the end of the scam. • Alternatively, he would accept a 50% refund from all the payments he made from 19 July 2023 onwards, after he’d put Revolut on notice of a suspected scam, plus 8% simple interest of the revised amount from the date of each payment to settlement. Our Investigator considered Mr C’s additional points, but his position remained the same. The matter has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position at law is that an Electronic Money Institution (EMI) such as Revolut are expected to process payments and withdrawals that a customer authorises them to make, in accordance with the Payment Services Regulations (in this case the 2017 regulations) and the terms and conditions of the customer’s account. But, taking into account relevant law, regulators’ rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider it fair and reasonable that Revolut should: • have been monitoring accounts and any payments made or received to counter various risks, including preventing fraud and scams; • have had systems in place to look out for unusual transactions or other signs that might indicate that their customers were at risk of fraud. This is particularly so given the increase in sophisticated fraud and scams in recent years, which firms are generally more familiar with than the average customer; • in some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment; • have been mindful of – among other things – common scam scenarios, how fraudulent practices are evolving (including for example the common use of multistage fraud by scammers, including the use of payments to crypto accounts as a

-- 2 of 5 --

step to defraud consumers) and the different risks these can present to consumers, when deciding whether to intervene. Should Revolut have recognised that Mr C was at risk of financial harm from fraud and, if so, what type of warning should’ve been provided? It isn’t in dispute that Mr C authorised the payments he made to X (from where crypto was subsequently transferred to the scammer). But whilst I’ve considered the circumstances which led Mr C to make the payments using his Revolut account and the process by which that money ultimately fell into the hands of X, I am mindful that, at that time, Revolut had much less information available to them upon which to discern whether any of the payments presented an increased risk that Mr C might be the victim of a scam. When considering this, I’ve also kept in mind that EMIs process high volumes of transactions each day. And that there is a balance for Revolut to find between allowing customers to be able to use their account and questioning transactions to confirm they’re legitimate – as it wouldn’t be practical for Revolut to carry out additional checks before processing every payment. Mr C’s Revolut account was opened for the purpose of the scam. So, there wasn’t any prior usage available to Revolut for them to determine whether this activity was out of character for Mr C. But I don’t think this prevented Revolut from assessing whether the activity was suspicious or if it potentially carried a known fraud risk. Here, the payments were being made to well-known crypto providers. And there are known fraud risks associated with crypto as scams like this have unfortunately become more prevalent in recent years. I must however consider, at the time of these payments, what was known to Revolut and what would’ve been reasonably expected from them. When doing so, I’m also mindful that a significant majority of crypto purchases made using a Revolut account will be legitimate and not related to any kind of fraud. That said, the FCA and Action Fraud published warnings about crypto scams in mid-2018 and figures published by the latter show that losses suffered to crypto scams have continued to increase since. And so, Revolut should’ve been aware of the potential risk’s crypto presented when these payments were made. Because of this, I think it would’ve been reasonable for Revolut to suspect Mr C was at risk of financial harm when he made the £3,000 payment on 4 May 2023. And so, I think Revolut should have warned Mr C before processing this payment. I’ve considered what type of warning would’ve been proportionate in this situation. And at that time, I think it would’ve been reasonable for Revolut to provide a written warning that was specific to what I consider to be the main cryptocurrency scam risk at the time – cryptocurrency investment scams. However, at the time Mr C made his fifth payment on 31 July 2023, taking into consideration evolving good industry practise, as well as the Financial Conduct Authority’s (FCA) Consumer Duty, in my opinion, Revolut should have asked Mr C a series of questions about the payment in an attempt to narrow down the specific scam risk. And once the risk had been identified, Revolut should have provided a warning which covered off the key features of the scam risk identified. As Revolut knew or ought to have known that the payment was going to a cryptocurrency provider, it ought to have factored this into the questions it asked, which at the time, Mr C was falling victim to an investment scam. I’ve also given careful thought about Mr C’s point that Revolut should have provided human intervention when he had tried to report the scam to Revolut on 19 July 2023. However, as Mr C wasn’t forthcoming with the information Revolut had requested about the payments

-- 3 of 5 --

when he tried to report the scam and continued to make the payments, as well as the payments not increasing in value, and the payments being spread over a period of five months, I don’t think Revolut would’ve had sufficient reason to consider there was a heightened risk of fraud at the time that warranted human intervention. If Revolut had provided the warnings I’ve described, would that have prevented the losses Mr C suffered? I’m not persuaded a written warning, of the type I’ve described at the time Mr C made the £3,000 payment on 4 May 2023, would’ve deterred him from making the payment. This is because, I’ve listened to the call Mr C had with H on 6 April 2023, and it is clear he provided them with misleading information about the purpose of the payment. Mr C was clearly asked why he was sending the money from H to Revolut, and he said it was for a new savings account he had found on a popular social media platform and he went ahead and opened it. Mr C didn’t mention to H he was sending the money to his Revolut account to invest his funds with X, which was what he done. So, I’m not persuaded any warning at this stage would have deterred Mr C from making the £3,000 payment on 4 May 2023. I do however consider that a better automated warning at the point Mr C attempted to make his fifth payment on 31 July 2023, would’ve likely exposed the scam. As Revolut has accepted our Investigator’s recommendation, I won’t cover this in detail. But I’ve no reason to consider Mr C wouldn’t have been open and honest with Revolut if questioned about the payment based on my review of the scam chat Mr C has provided between himself and X, where he had questioned the investment on several occasions and expressed doubts about what he was doing after the payment he made on 4 May 2023. And so, through appropriate questioning to establishing the surrounding circumstances of why Mr C was making the payment, I think Revolut would’ve identified common features of crypto investment scams and it would have been reasonable for Revolut to have warned Mr C against making any further payments to X. It follows that, had this happened, I think Mr C wouldn’t have gone ahead with the payment and his loss would’ve been prevented from this point. Should Mr C bear any responsibility for his loss? This doesn’t appear to be an issue of dispute, as both parties seemingly accept that they should bear some responsibility for Mr C’s loss. Nevertheless, I’ve given it consideration and I agree that it would be fair for Mr C’s compensation to be reduced for his contribution to the loss. This is because, Mr C initially misled H about his reason for sending money from H to Revolut, so he made it difficult for H to identify if he was falling victim to a scam. Mr C also continue to make payments even after attempting to make Revolut aware of a possible scam involving the payments he had made to the crypto exchange provider. And as he didn’t provide Revolut with the information they’d requested to carry out an investigation, Mr C didn’t give them an opportunity to identify if he was falling victim to a scam, even though he had doubts about the investment. With this in mind, I think it would’ve been reasonable to have expected Mr C to have taken additional steps to protect himself before proceeding – such as explaining the correct reasons to H when asked about the payments he was making from H to Revolut, and providing the information Revolut requested to allow them to carry out an investigation when he expressed concerns that he might be falling victim to a scam before going ahead with any further payments. If Mr C had done this, then I think it’s most likely he would’ve become aware that X was operating a scam. I therefore think Mr C could’ve prevented his losses.

-- 4 of 5 --

So, on balance, I think it would be fair to reduce the amount Revolut pays Mr C, from the fifth payment on 31 July 2023 onwards, because of his role in what happened. Weighing the fault that I’ve found on both sides, I think a fair deduction is 50%. Could Revolut have done anything to recover Mr C’s money? The only option of recovery for the debit card payments was via chargebacks. But given the payments were made to legitimate crypto providers, I don’t consider that a chargeback would have had any prospect of success given there’s no dispute the crypto providers provided the crypto to Mr C that he paid for. In respect of the money transferred to X, there wouldn’t have been any funds left to recover (as it had already been forwarded on as part of the scam). But even if there were funds remaining, Mr C would’ve had access to them and could’ve withdrawn them himself. Putting things right I think it is fair that Revolut refund Mr C from the fifth payment on 31 July 2023 onwards, less 50% for contributory negligence. This totals £1,295. Revolut should also pay 8% simple interest on the payments to compensate Mr C for his loss of the use of money that he might otherwise have used. My final decision My final decision is that I uphold this complaint in part. I direct Revolut Ltd to pay Mr C: • £1,295 – that being 50% from the fifth payment on 31 July 2023 onwards. • 8% simple interest, per year, from the date of each payment to the date of settlement less any tax lawfully deductible. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr C to accept or reject my decision before 15 April 2026. Israr Ahmed Ombudsman

-- 5 of 5 --