Revolut - Ultracheap FX (prepaid Mastercard)

RoYoBo

Mr.S wrote: »

Spotted this on Twitter today:

https://twitter.com/paddy_don88/status/1169926796260847616

He doesn't say how they got access to his phone (how is that possible?) but the lax password reset process and the ability to make unlimited ATM Withdrawls on Revolut's end is a bit worrying.

This guy is probably snookered though as he didn't report the cards quick enough to his bank(s). Who on earth waits 45mins to cancel cards after losing your wallet? It should be the first thing you do :eek:

Eeeek, that is worrying alright. Though how thieves obtained both his phone and wallet at the same time is a bit of a personal security issue. Seems to me that 45 minutes is a very short period of time to hack the phone's pin, obtain access to a forgotten Revolut pin, transfer money from another stolen Revolut card and get so much money as a result! Very savvy thieves!

I think Revolut may have to address this by creating a bigger time lapse for forgotten pin numbers to be accessed going forward. I can understand that it would take more time to report a theft if one's phone is also stolen while out and about. Something we'll all have to address to avoid similar problems.

Creamy Goodness

RoYoBo wrote: »

Eeeek, that is worrying alright. Though how thieves obtained both his phone and wallet at the same time is a bit of a personal security issue.

Possibly had one of those wallet cases where people place their debit/credit/leap cards into their phone case. would take less than a second to swipe. even if wallet was in another pocket it would take two scumbags 5 seconds to overpower you in a state of shock.

RoYoBo

Worth taking a note of this number 0044 20 3322 8352 to block a stolen Revolut card if you no longer have your phone. I had to look it up there now as I always thought I'd be able to freeze it from the phone app until now.

https://www.revolut.com/help/card-issues/my-card-has-been-lost-or-stolen

Lucas Hood

Mr.S wrote: »

Spotted this on Twitter today:

https://twitter.com/paddy_don88/status/1169926796260847616

He doesn't say how they got access to his phone (how is that possible?) but the lax password reset process and the ability to make unlimited ATM Withdrawls on Revolut's end is a bit worrying.

This guy is probably snookered though as he didn't report the cards quick enough to his bank(s). Who on earth waits 45mins to cancel cards after losing your wallet? It should be the first thing you do :eek:

This might be easier to follow.
https://threadreaderapp.com/thread/1169926796260847616.html?refreshed=yes

RoYoBo

Quote: You’ll need to talk to your bank. Contact the Police in the UK and we might be able to look into it! I clarified I live in Ireland and had reported it to the authorities here, the response “that doesn’t matter we are a UK company so you need to report it to the UK police”.

Very poor response from Revolut to this man! Not at all impressed :mad:

gwalk

That's if it actually happened

Probably blew a load gambling and this is his cover story

Franz Von Peppercorn II

gwalk wrote: »

That's if it actually happened

Probably blew a load gambling and this is his cover story

Yeh. That’s likely.

Franz Von Peppercorn II

The lack of a daily credit limit is a bit odd. Of course this guy didn’t protect his phone for some reason. Which is insane if your phone is your credit card.

gwalk

Franz Von Peppercorn II wrote: »

gwalk wrote: »

That's if it actually happened

Probably blew a load gambling and this is his cover story

Yeh. That’s likely.

Do you believe every story you read on twitter? 😂

igCorcaigh

RoYoBo wrote: »

Worth taking a note of this number 0044 20 3322 8352 to block a stolen Revolut card if you no longer have your phone. I had to look it up there now as I always thought I'd be able to freeze it from the phone app until now.

https://www.revolut.com/help/card-issues/my-card-has-been-lost-or-stolen

They really need a Web interface for basic functionality like this.

Maybe someone could download the app on a friends phone? I don't know.

TimeToShine

Mr.S wrote: »

Spotted this on Twitter today:

https://twitter.com/paddy_don88/status/1169926796260847616

He doesn't say how they got access to his phone (how is that possible?) but the lax password reset process and the ability to make unlimited ATM Withdrawls on Revolut's end is a bit worrying.

This guy is probably snookered though as he didn't report the cards quick enough to his bank(s). Who on earth waits 45mins to cancel cards after losing your wallet? It should be the first thing you do :eek:

If thieves can obtain your phone, wallet and see you enter your passcode in one foul swoop then you are barely ready for the real world never mind FinTech.

The two-factor authentication on Revolut is plenty, you need to a) enter your phone passcode and b) enter your Revolut passcode - if both are the same then this is your fault.

-=al=-

He didn't have his phone to call :pac:

Pretty crap but there's already plenty of measures of security in place to avoid such hassle with phones and the app itself. As for the fast top ups and atm withdrawals, surely that should have been flagged though. That's suspicious activity 101.

How did they get into the app without the passcode? Was it a general reset email of which his email app was still logged in, I suspect?

Franz Von Peppercorn II

gwalk wrote: »

Do you believe every story you read on twitter? 😂

No. I believe this story I read on Twitter, though.

Franz Von Peppercorn II

-=al=- wrote: »

He didn't have his phone to call :pac:

Pretty crap but there's already plenty of measures of security in place to avoid such hassle with phones and the app itself. As for the fast top ups and atm withdrawals, surely that should have been flagged though. That's suspicious activity 101.

How did they get into the app without the passcode? Was it a general reset email of which his email app was still logged in, I suspect?

He’s clearly a muppet when it comes to phone security. Nevertheless probably telling the truth.

gwalk

Franz Von Peppercorn II wrote: »

gwalk wrote: »

Do you believe every story you read on twitter? 😂

No. I believe this story I read on Twitter, though.

Good for you hun xx

Yggr of Asgard

There is clearly more to this story than the person is sharing on Twitter.

In addition some elements do only make sense if the had lax or even disabled security functions plus what ever funding source he had clearly does not have fraud protection.

In addition the answer from Revolut seems kind of strange, I mean sure one rep might have answered that way but once the card was reported as stolen obligations of Revolut kick in.

So I hope the person will be successful in recouping some of the money but I still think there is more to the situation than the person is letting us know.

Yggr of Asgard

Also there is a limit for ATM withdrawal of 3000£ in 24 hours so the 6000€ in 45 minutes in 100 transactions is suspect not only because it’s over the limit but where can you find and ATM in which you can do 100 transactions in a row without suspicions arising.

I am relatively sure that the MasterCard or Visa network would become suspicious of this very quickly.

RoYoBo

As I understand it, his phone was hacked and then the thieves were able to obtain his Revolut pin by simply accessing a reset via the app. You can click the 'Forgot' option and it leads you through the process. Since they already had his phone, his Revolut card and his wallet with his top-up bank card, this would appear to be simple enough.

The total of €6k seems to have been obtained by filtering through another stolen Revolut card, so perhaps daily limits didn't come into play per se? Who knows if this is the entire story, but I'd be worried if Revolut doesn't address the issue in a better manner than what appears to be the case.

My phone's pin code is different to my Revolut, but I don't know now how secure anything is if the phone itself can be hacked relatively easily and Revolut will enable the retrieval of that pin so easily and quickly via the app?

RoYoBo

Found this for resetting Revolut pin:

https://twitter.com/revolutapp/status/917732588504207360?lang=en

Is it really that simple? All you need is your phone to enter a code that's sent to the phone :eek:

delly

RoYoBo wrote: »

Found this for resetting Revolut pin:

https://twitter.com/revolutapp/status/917732588504207360?lang=en

Is it really that simple? All you need is your phone to enter a code that's sent to the phone :eek:

I was about to have the same reaction, but they do say that there is a security question that goes along with that.

RoYoBo

delly wrote: »

I was about to have the same reaction, but they do say that there is a security question that goes along with that.

Which is the last 4 digits of your top-up card, according to their comment/reply. That was how the guy who got his wallet stolen was caught, it appears, as the card was in his wallet along with the Revolut card. I imagine most people keep their cards together, whether in a wallet or a handbag, and the phone is usually/often in there too!

Not sure how we're going to overcome that going forward unless Revolut ups their security ...

-=al=-

Was it an android phone?

Surely there’s another level of security than basically just texting a new pin code from the phone

The multiple top ups and withdrawals should have been flagged even before they could have been sent to another Revolut account but still mucho suspiciouso about this issue

Edit: the last 4 digits of the card... I guess having the ability to unlock the phone via the code or hack, then access to the sim to make a new unlock code + the extra additional security question, along with the wallet that was stolen containing the card with the last 4 digits is pretty unfortunate. 4 levels of security there breached before the funds were diverted elsewhere to maximise the cash.

Enough levels of security imo but a pretty crap thing to happen

The high horse brigade

Revolut have nothing to answer here tbh. They cannot be held responsible for phone security

The high horse brigade

The bottom line is none of this would have happened if he had proper security on his phone. As usual the user is the weakest link.

The high horse brigade

Mr.S wrote: »

Assuming someone saw him put in this code / pattern and then stole his wallet / phone, or asked for it by force when they robbed him - can't really be blamed for that can he? That is where Revolut's security comes in, referring to it as minimal would be understating :pac:

For perspective I have 2 other banking apps on my phone:

AIB - Enter a PAC (or FaceID) to access. Only way to reset is to contact AIB by phone and they issue a new one via post. Simple, effective and unless you're part of a tiger kidnapping, no one will access it.

Foreign Bank - Enter a PAC (or FaceID) to access, and then Auth'd via another app that is only signed on that phone, with another PAC. Reset is either via a back-up code which is given when you sign up, or reset via post.

I guess the lesson is don't carry your top-up card(s) in your wallet and your safe with Revolut?

It's not much different to PayPal or other apps where the 2 factor authentication app is on the phone itself. It needs to be taken for granted that if anyone gets access to your phone they'll have access to all apps

Ben Done

The high horse brigade wrote: »

It's not much different to PayPal or other apps where the 2 factor authentication app is on the phone itself. It needs to be taken for granted that if anyone gets access to your phone they'll have access to all apps

Would there be any benefit to using an app like App Lock to require a pin to launch the app I wonder?

The high horse brigade

Mr.S wrote: »

PayPal will at least prompt you for passwords if you're sending money to a new account or address.

Yes a password which is easily saved in the browser, this isn't a security

Franz Von Peppercorn II

The high horse brigade wrote: »

The bottom line is none of this would have happened if he had proper security on his phone. As usual the user is the weakest link.

The security question could have been a bit better.

The J Stands for Jay

Mr.S wrote: »

Anyone had luck with using Revolut to receive claims from VHI? The online portal doesn’t accept non IE IBANS.

Bit annoying as everything is automated and the first step to processing a claim is putting in your bank details...

A few years ago, they sent me a cheque out of the blue. They'd overcharged me a few years earlier when I was still a customer and just sent a cheque to the last address they had for me (which I was about a week away from moving out of). I had to argue with them about it, but eventually they agreed to pay it to my N26 account. They told me their customer system couldn't pay to bank accounts of former customers and never to non Irish accounts, but as a once off they would get their accounts department to make the payment to me.

TL;DR In 2016, their systems couldn't pay to a non-Irish bank account.

The J Stands for Jay

Mr.S wrote: »

Ugh, great.

Maybe they've got their **** together since then...