Partially upheld: unauthorised transactions / scam / impersonation fraud complaint against Revolut Ltd

Decision detail

Summary

Ms M was scammed by someone impersonating her bank and lost over £13,000 through four payments from her Revolut account. The scammer obtained an OTP from Ms M and used it to set up ApplePay on their device, then made payments while Ms M was being guided by the scammer on what to do. The ombudsman found Payment 1 (£4,990) unauthorised and ordered it refunded with interest, but found Payments 2, 3, and 4 (totalling £8,078.92) authorised because Ms M confirmed them in-app, despite being deceived. Revolut took proportionate fraud prevention measures including verification checks, spending limits, card freezes, and warning screens, and was not found to have missed an opportunity to prevent the losses.

The Ombudsman's reasoning

Under the Payment Services Regulations 2017, a payment is authorised when a customer makes it themselves or tells their payment service provider they want it to proceed. Payment 1 was unauthorised because Ms M did not share the OTP knowing it would result in a payment and Revolut did not intervene. Payments 2 and 3 were authorised because Revolut clearly asked Ms M in-app if she recognised the payment attempts and she confirmed she did and unfroze her card, which constituted consent despite her being deceived by the scammer. Payment 4 was authorised because Ms M approved it directly in-app using 3DS with clear confirmation screens. Revolut took proportionate fraud prevention steps including verification checks, spending limits, card freezes, and warning screens about impersonation scams. While Ms M was a victim of a convincing scam, Revolut was entitled to rely on her in-app confirmations as authorisation and did not miss a clear opportunity to prevent the losses.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website