Revolut Ltd · DRN-5237433

The complaint Ms M complains that Revolut Ltd (‘Revolut’) won’t refund the money she lost to an investment scam. She’s represented by a firm of solicitors. For simplicity, I’ll refer to Ms M throughout this decision. What happened The background is known to both parties, so I won’t repeat all the details. In summary, Ms M came across an online advert for a company (I’ll call ‘T’) that was offering crypto-investment opportunities and was seemingly endorsed by well-known public figures. She registered her interest and was called by an ‘agent’. She later discovered she’d connected with a scammer. She says she was offered different sets of ‘investment packages’ and that believing she was dealing with a professional individual who’d be acting on her behalf, she made payments for ‘investment’ as instructed. As part of the process, she was told to download remote access software and ‘helped’ with opening her own accounts with genuine crypto-exchanges. She realised she’d been scammed when she was repeatedly told she needed to pay money in ‘taxes/fees’ for her to access her funds. By that time, over £20,600 had been sent from her Revolut account to crypto-exchanges (‘P’ and ‘C’) for the purchase of the cryptocurrency that was then lost to the scam. Some of the money came from savings and some was borrowed. I’ve listed below the payments I’ve considered as part of this complaint. Date Method Payee Amount 1 02-May-23 Card payment P - Ms M £1,000 2 04-May-23 Card payment P - Ms M £2,900 3 23-Jun-23 Card payment P - Ms M £4,998 4 11-Aug-23 Card payment C - Ms M £7,000 5 15-Aug-23 Card payment C - Ms M £4,800 A complaint was made to Revolut and later referred to our Service. Our Investigator upheld it. In brief, she thought that Revolut ought to have intervened on Payment 3 (as above) and that, if it had, Ms M wouldn’t have lost more money. She also thought that Ms M contributed to her losses such that the refund Revolut needs to pay can be reduced by 50%. Ms M accepted that outcome. Revolut didn’t. In summary, it has said that the payments were self-to-self to accounts in Ms M’s name. There was no fraudulent activity on its platform. It shouldn’t be responsible for Ms M’s loss where it’s only an intermediate link in a chain of transactions. It’s not rational to hold it liable for all, most, or 50% of Ms M’s loss. And the role of other businesses (interventions/warnings they may have provided) should be considered. As the matter couldn’t be resolved informally, it’s been passed to me to decide.

-- 1 of 4 --

What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position at law is that a firm (like Revolut) is expected to process payments and withdrawals that a customer authorises it to make, in accordance with the Payment Services Regulations (the 2017 regulations) and the terms and conditions of the customer’s account. But that’s not the end of the matter. Our Service has issued many decisions setting out the relevant considerations we take into account when deciding what’s fair and reasonable in these types of cases. In summary, taking into account relevant law, regulators’ rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider it fair and reasonable that Revolut should:  have been monitoring accounts and any payments made or received to counter various risks, including preventing fraud and scams;  have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which firms are generally more familiar with than the average customer;  in some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment (as in practice Revolut sometimes does); and  have been mindful of (among other things) common scam scenarios, how the fraudulent practices are evolving (including for example the common use of multi-stage fraud by scammers and the use of payments to cryptocurrency accounts as a step to defraud) and the different risks these can present to consumers when deciding if to intervene. Should Revolut have recognised that Ms M was at risk of financial harm from fraud? It’s not in dispute Ms M was scammed, nor that she authorised the card payments to her accounts with legitimate cryptocurrency platforms (from where her funds were sent and lost to the scam). I’m also aware cryptocurrency platforms generally stipulate that the card used to purchase cryptocurrency on their platform must be held in the name of the account holder, as must the account used to receive cash payments from the exchange. Revolut would likely have been aware of this fact too. So, it could have reasonably assumed that most of the disputed payments would be credited to a cryptocurrency wallet held in Ms M’s name. But, by the time of these payments, firms like Revolut had been aware of the risk of multi- stage scams involving cryptocurrency for some time. Scams involving cryptocurrency have increased over time. The FCA and Action Fraud published warnings about cryptocurrency scams in mid-2018 and figures published by the latter show that losses suffered to crypto- currency scams have continued to increase since. They reached record levels in 2022. During that time, cryptocurrency was typically allowed to be purchased through many high street banks with few restrictions. By the end of 2022, however, many high street banks had taken steps either to limit their customer’s ability to buy cryptocurrency using their accounts or increase friction on crypto-related payments owing to the elevated risk associated with such transactions. This left a smaller number of payment service providers (like Revolut), that allowed customers to use their accounts to buy cryptocurrency with few restrictions. These restrictions, and the reasons for them, would have been well known in the industry. I recognise that, as a result of actions of other payment service providers, many customers

-- 2 of 4 --

who wish to purchase cryptocurrency for legitimate purposes will be more likely to use the services of a firm (like Revolut). I’m also mindful a significant majority of crypto-purchases made using a Revolut account will be legitimate and not related to any kind of fraud (as Revolut has told us). However, our Service has also seen numerous examples of customers being directed by fraudsters to use Revolut accounts to facilitate the movement of a victim’s money from their high street bank to a cryptocurrency provider – a fact Revolut is aware of. I’m satisfied, taking into account all the above, that at the time of these payments Revolut ought, fairly and reasonably, to have recognised its customers could be at an increased risk of fraud when using its services to buy cryptocurrency, notwithstanding that a payment would often be made to a cryptocurrency wallet in the customer’s name. And, considering all the above, and in light of the increase in multi-stage fraud (particularly involving crypto- currency), I don’t think the fact the disputed payments here were going to an account in Ms M’s name should have led Revolut to think there wasn’t a risk of fraud. In terms of triggers, I’m mindful that the account was newly opened so Revolut had limited information on which to assess a risk. But, like the investigator, I still think there was enough about Payment 3 for it to have been concerned Ms M was at a heightened risk of financial harm from fraud – considering, for example, that the payment was of significant value, it marked an increase in spending, and given the elevated scam risks associated with the type of payee. In my view, it’s fair and reasonable here to conclude a proportionate response to the payment risk presented would have been for Revolut to have given Ms M a written warning – covering the key aspects of cryptocurrency scams more commonly affecting many customers at the time. That is, a warning about cryptocurrency investment scams. Would such a warning have prevented Ms M’s further losses? There were several key aspects of common cryptocurrency investment scams surrounding the circumstances of Ms M’s payments. She had, for example, found the opportunity through an online advert that was seemingly endorsed by celebrities; she had been contacted by an ‘account manager’ who was ‘investing’ on her behalf; she had been told to download remote access; and she was apparently being offered quick and unrealistic returns. On balance, I think a written warning highlighting, in clear and understandable terms, the key aspects of cryptocurrency investment scams would have likely been enough to give her the perspective she needed at the time. I’ve not seen sufficient evidence to suggest she wouldn’t have paid attention to such a warning or that the scammer’s spell was such that she would have continued with payments in any event. In reaching this view I’d note that, following our enquiries, there’s nothing to suggest Ms M was given or moved past relevant warnings from the other firm in the payment chain. Is it fair and reasonable to hold Revolut responsible for Ms M’s losses? I’ve taken into account that Ms M remained in control of her money after making the payments from Revolut. It wasn’t lost until she took further steps. But I’m satisfied Revolut should have recognised Ms M was at risk of financial harm from fraud and it should have provided a relevant warning before processing Payment 3. If it had, it’s unlikely she would have lost more money. And I think Revolut can fairly be held responsible for those further losses in such circumstances. While I’ve considered all the facts of the case and I accept it’s possible other firms might have missed an opportunity to prevent the scam, Ms M hasn’t referred a complaint about another firm to us. I can’t compel her to. And I don’t think it’d be fair to reduce her refund simply because she’s only complained about one firm when, as I’ve found here, that firm could have stopped her losses. As before, I think a proportionate intervention from Revolut

-- 3 of 4 --

would have likely been enough to stop the scam. I’ve seen nothing to show Ms M would have moved past relevant warnings closely matching what her situation looked like. Should Ms M bear any responsibility for her losses? As noted above, the Investigator upheld Ms M’s complaint and concluded that the refund payable by Revolut can be reduced by 50% to account for her contributory negligence. Ms M accepted that outcome. And I don’t disagree with that being a fair and reasonable position. I note, for example, that despite the amounts she paid for ‘investment’, Ms M has told us she was asked to pay significant amounts in ‘tax’ to withdraw ‘profits’ which she’d been led to believe had reached £46,000. These kinds of quick returns should have signalled something wasn’t quite right and I think she could have acted more cautiously in the circumstances. If she’d carried out checks into what she was being told and asked to do (as would reasonably be expected here), it’s likely this too would have prevented some of her further losses. Recovery In terms of recovery, it’s unlikely a chargeback claim based on goods or services not received would have succeeded, given there’s no dispute that the merchants (P and C) provided the cryptocurrency as intended before it was sent on and lost to the scam. Putting things right For the reasons I’ve given, I uphold this complaint and direct Revolut Ltd to: - Refund the disputed payments from (and including) Payment 3, minus 50% for contributory negligence. - Pay 8% simple interest per year on this amount from date of payment to date of settlement. My final decision For the reasons I’ve given, I uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Ms M to accept or reject my decision before 28 November 2025. Thomas Cardia Ombudsman

-- 4 of 4 --