The Guardian recommends business owners move their banking away from Revolut

[Ozzy]

Just in case anyone missed this article, and considering the number of posts on here from people asking questions about business banking, I thought it would be prudent to share this;

I’m a victim of scammers. But Revolut says ‘no’ to a refund

The company seems to hold me entirely responsible for the fact £40,000 was stolen

www.theguardian.com

The point that Revolut doesn't have a UK banking licence is one thing, and perhaps not a major concern as many digital current account providers in the UK do not, but that they have not opted into the CRM code should act as a word of caution. The Guardian recommends leaving Revolut and switching to a different provider.

 

[Ozzy]

Quickly knocked together a little guide with some things business owners should keep in mind, but do share any other pieces of advice and tips here;

A Guide to Bank Fraud Protection for Small Business Owners

I was sad to see a piece from a small business owner who had been a victim of fraud published in The Guardian today, resulting in their Revolut business account being emptied and losing all the money they had. What stood out to me was that the...

www.ukbusinessforums.co.uk

 

[Paul Kelly ICHYB]

Whilst I have every sympathy for the losing £40k, it was reduced by the line 'As part of a “security check”, they sent two verification codes, which I read back to them.'.

Now, we can all fall foul of these things, but that would get my spidey senses tingling fast!

I have recently opened a Revolut account, 9 months after applying for it and being turned down (brand new business in their risk category). They must have been desperate for growth as they called me back and said 'you didn't complete the setup process!' I only wanted the account because its merchant rates are better than Stripe!

 

[Ozzy]

Whilst I have every sympathy for the losing £40k, it was reduced by the line 'As part of a “security check”, they sent two verification codes, which I read back to them.'.

Indeed, to the educated, that seems so apparent to many. I do wonder about the 'granny' test though, something we use, could my granny understand it and if she could then it's clear enough.
I do read it as though they did prime him up, although the call from the accountant seems odd. I know my accountant personally, so for me I can never imagine my accountant making such a call.

 

[Paul Kelly ICHYB]

True.

Common sense also enters into it, though.

 

[DontAsk]

What worries me is that the fraudsters already had the login details for the account. Were did they come from? Or is Revolut's login process just enter account number (or some easily available data) and a one-time code (that the account owner read back)? Do they have an easily spoofed "lost password" procedure? Maybe the first access code was for this, and the second for a new payee.

Santander is more secure, requiring two, secret to me, details to login. If I want to change login details I have to 'phone them, which then requires a telephone PIN, again secret to me. There's no on-line "lost password" feature that I am aware of. Then you need the one-time text to make payments, setup a payee, etc.

 

[japancool]

Maybe they called the accountant after failing to get through to the account holder, and the accountant was just relaying what he thought was important information. Although how they got the accountant's info, I don't know, it seems odd to say the least.

 

[Frank the Insurance guy]

Although how they got the accountant's info, I don't know, it seems odd to say the least.

Can they not get your accountants details from the Accounts on Companies House?

 

[David Griffiths]

Can they not get your accountants details from the Accounts on Companies House?

Sometimes it's possible but most of the accounts that I see on the Companies House site do not show the accountants detals. None of the accounts that I've filed for clients do.

No doubt someone will now come along and state that they've looked at N companies who all show the accoutants' detals!

 

[Ozzy]

No doubt someone will now come along and state that they've looked at N companies who all show the accoutants' detals!

Our accountant puts their details on our accounts, I always thought of it as a bit cheeky free marketing; perhaps we should charge them for marketing.

 

[Paul Kelly ICHYB]

Our accountant puts their details on our accounts

Same here.

But that would mean a bit of work for the fraudster to find out, which indicates that they are getting a bit more sophisticated!

If this is the issue.

 

[Ozzy]

But that would mean a bit of work for the fraudster to find out, which indicates that they are getting a bit more sophisticated!

They are. We have had fraudsters registered variations of our domain name (mis spelled, or using an i instead if an l, etc) and then send emails appearing to be from me to buy Amazon cards, pay an urgent invoice, etc.

 

[David Griffiths]

Our accountant puts their details on our accounts, I always thought of it as a bit cheeky free marketing; perhaps we should charge them for marketing.

At least it shows that they are happy to be associated with your business! I've had a few in the past where that might not necessaarily apply - not from them doing anything criminal (that's a rapid transition to the door) but for being generally useless and late with filings.

 

[N-UPS]

We use revolut, for better % on business deposits, and to do our own international payments and FX

They have been OK.
They should offer second tier management for accounts with over a certain amount in them, so their learning process does not impact on the account holding business.

I trust them with approx 1/4 of reserves, and wont go higher at the moment.

 

[N-UPS]

"When they called back, I answered, believing I was talking to Revolut’s anti-fraud staff, not least because the person had full access to my account details and was able to quote past transactions, even verification codes sent to confirm them."

I think they got these details from the SMS messages you get to confirm/deny transfers you are making.

I would be ***'''##* with my accountant for their part in this.

log on username can be a phone number (or email)
they asked for a password reset link, and also intercepted that possibly by phone, possibly by email

then they just needed the codes sent to the customer. Hmm possibly not by sms, these might be codes from the phone app that the scammer could not get.


Here is an idea, banks, rather than putting this all on customers (click 5 times to confirm, ask stupid questions that annoy most people), they should time delay any "suspicious" transactions for X hours, or call you about them before releasing.

They should also be able to claw back transfers when its fraud. Unless the fraudster has hundreds of days to withdraw from cash machines, its still an electronic amount on a bank's books somewhere.

 

[CharBriars]

I want to highlight some security concerns regarding Revolut accounts. Users can log in with either their email or phone number and receive password reset codes through both methods. It's also easy to change contact information and address without much verification. There are minimal security measures for transferring money out of the account, and while a selfie may be required for transactions, it can be easily removed. Additionally, personal accounts lack online banking features and have limited security. I worry that business accounts may have similar issues. When it comes to fraudulent transactions, getting a refund is difficult as there is no phone support, and claims are often refused despite providing evidence. Finally, there's a risk of having your account blocked without access to your funds. Please be cautious.

 

[japancool]

Revolut customers say e-money firm failed them after being scammed

Revolut was named in more complaints about fraud last year than any of the UK’s biggest banks or e-money services.

www.bbc.co.uk