Revolut’s US payments flaw allowed thieves to steal $20M

GET FREE FINTECH UPDATES

we will send you one myFT Daily Digest Latest Email Rounding fintech News every morning.

A flaw in Revolut’s payment system in the US allowed criminals to steal more than $20 million in funds over several months last year before the company closed the loophole., According to several people with knowledge of the matter.

The incident, which has not yet been publicly disclosed, is likely to put further pressure on the highly valued fintech, which has suffered a number of senior departures and a due diligence from the BDO while awaiting a banking license in the UK.

The problem stems from differences between the European and US payment systems, which mean that when certain transactions are declined, Revolut will mistakenly refund accounts, handing them their money, according to three people with knowledge of the situation. Will give

Although Revolut recovered a portion of the roughly $23mn stolen by pursuing some of the money-takers, the net loss was nearly $20mn – the equivalent of nearly two-thirds of its annual net profit in 2021, those people said. .

The problem first appeared periodically in late 2021. Organized criminal groups took advantage of the flaw in early 2022, according to three people with knowledge of the situation, encouraging individuals to try to make expensive purchases that would later be declined. After this it will be cashed through ATM.

Two people familiar with the situation said the fraud affected Revolut’s own corporate funds rather than customer accounts.

The people told the Financial Times that Revolut’s systems failed to catch fraud on a large scale and the problem emerged when a partner bank in the US informed the fintech that it had less cash than expected.

Revolut’s US subsidiary then requested a multimillion-dollar cash injection from its parent company, after which the company eventually worked to close the defect around spring 2022.

Revolut declined to comment on the matter.

The piracy-related loss was not specifically disclosed in the delayed 2021 results.

The fintech is still awaiting its banking license in the UK, more than two years after first announcing its application, which is far longer than the typical turnaround time of less than a year.

The UK’s Financial Conduct Authority ordered an independent review of Revolut’s policies to prevent and detect financial crime in 2020.

Auditor BDO separately warned that Revolut’s revenue may have been “materially misstated” because it was unable to be satisfied about the “completeness and incidence” of around two-thirds of its reported revenue for 2021.

Revolut has also faced a number of high profile departures in recent months, including both James Radford, chief executive of its UK bank, and Mikko Salovara, chief financial officer.

Joel Kass, chief of staff for the UK unit and head of banking products, is also set to leave. Prior to joining Revolut, Kass spent three years at the Bank of England, including a year as Supervisor of New Banks.

Revolut said, “Joel Kass is leaving Revolut after three successful years.” “He is moving on to a senior opportunity outside the business and we wish him the best in his next steps.”

Two investors, venture capital firm Molten Ventures and asset manager Schroders, have also reduced valuation of their stake in Revolut to 40 per cent and 46 per cent, respectively.

Revolut’s external value was last pegged at $33bn in July 2021, when it became the UK’s most valuable private tech group ahead of Checkout.com’s $40bn valuation in January 2022.

Additional reporting by Stefania Palma in Washington DC