In a recent case of identity fraud, a businessman had £165,000 stolen from his Revolut account after criminals bypassed the company’s identity verification process. Fraudsters were able to break into his account by exploiting vulnerabilities within Revolut’s facial recognition software. This incident raises critical concerns about the effectiveness of biometric verification systems within the financial sector and highlights the increasing sophistication of digital fraud tactics.
The banking sector has become a prime target for identity theft and synthetic identity fraud. Research by Synectics Solutions, which operates the UK’s largest syndicated risk intelligence database, revealed that 45% of all adverse contributions in the finance sector in 2023 were linked to stolen identities and identity fraud. Using a falsified or stolen identity, fraudsters can drain funds from accounts, make fraudulent purchases, or take out loans.
Nearly £1.2 billion was stolen from customers in 2023, and the criminals who commit these crimes destroy lives and damage our society.
UK Finance’s 2024 report recently highlighted that almost £1.2 billion was stolen from customers in 2023. ID theft increased, with losses up 53 per cent to £79.1 million. When criminals fail to socially engineer victims into making authorized payments, they use stolen personal information and card details to either take over existing accounts or apply for new credit cards. Ben Donaldson, Managing Director of Economic Crime at UK Finance, stated, “Nearly £1.2 billion was stolen from customers in 2023, and the criminals who commit these crimes destroy lives and damage our society. The money stolen funds serious organised crime and victims often suffer emotional damage as fraud is a pernicious and manipulative crime.”
This form of identity fraud can and should be prevented by the financial services industry, with a strong case for implementing the most sophisticated fraud detection solutions in the market. Facial recognition software must leverage active liveness detection, coupled with an AI-powered document check, to avoid these costly cases of identity fraud.
What Happened?
Jack, a British businessman, has recently become a fraud victim, losing £165,000 due to identity fraud carried out on Revolut’s banking platform. In February of this year, Jack received a phone call from a scammer while he was in a co-working space. The caller pretended that they were from Revolut, alerting Jack that his account might have been compromised.
The caller then requested that Jack hand over sensitive data, which the scammers used to unlock the Revolut account on their device. This gave them an overview of his previous transactions, including the purchase at Etsy, an e-commerce platform. Jack was still on the phone with the fraudsters, and he received a text message that claimed to be from Revolut. The message requested that he confirm how much he had spent on the Etsy purchase by typing in a six-digit number, which he read out loud to the fraudsters. They then set up their own account, which they also called Etsy, using the six-digit number to authorize a new payment to their fake account instead.
Two additional texts arrived, prompting authorization of small payments to two more fraudulent accounts named “Revolut Fees” and “Revolut Fees Care.” Jack unknowingly approved these transactions as well, effectively setting up three new payees. This triggered a major breach, and it wasn’t long before thousands of pounds were being drained from the account.
Banking Giants Struggling with Identity Fraud
Revolut is certainly not the only banking giant to have identity fraud intercepting its platform, with the UK’s national reporting center for fraud and cyber-crime Action Fraud receiving thousands of reported cases from other major UK banks, such as Barclays, HSBC, Lloyds, Monzo, and Starling.
Data shows that from 2023 to 2024, HSBC had 5,467 fraud reports, while Revolut had 9,793, Lloyds had 7,395, and Barclays had 7,874. The fact that most major banks have been affected proves the startling sophistication of modern-day fraudulent practices, underlining the need for re-prioritisation amongst financial institutions. Investing in adequate infrastructure for fraud detection will end up helping organizations swerve serious fraudulent attacks, which could save them an insurmountable amount in the long run.
Identity Fraud Reimbursements on the Horizon
A critical concern for banks in the UK is the FCA’s new reimbursement rule, which requires banks to reimburse fraud victims up to £85,000. This could prove very costly in future fraud cases, re-enforcing the need for banks to ensure their KYC, IDV, and AML infrastructure provides a strong defence against fraudsters.
Revolut currently holds a provisional banking license in the UK and is on its way to becoming a fully-fledged bank. This means that in future incidents, Revolut will be subject to these reimbursement standards. Until then, it continues to act as an electronic money institution, which is not subject to these rules.
Most people are unaware of the amount of fraud, especially APP fraud, currently ongoing within platforms such as Revolut. Figures from the PSR last year showed that for every million pounds paid into Revolut accounts, £756 were from APP fraud.
62% of Revolut fraud victims in 2023 were defrauded by unauthorised fraud.
Fraudulent attacks on banks can be divided into authorized fraud and unauthorized fraud. Identity theft and account break-ins falls under the latter category, as fraudsters are able to hack into accounts by assuming the identity of a customer. Considering that, according to Revolut’s report, most victims experienced unauthorized fraud, biometric identity verification that leverages active liveness detection must be deeply embedded within daily actions on the platform. This is especially true when it comes to new login attempts.
Implementing Robust KYC with ComplyCube
ComplyCube’s liveness detection technology prevents fraudulent attempts by validating identity biometrics and government-issued documentation to prevent fraud. Banks such as Revolut would largely benefit from their advanced AI-powered fraud detection tools, cutting costs and onboarding time due to the speed of checks. Key solutions that they would benefit from include:
Biometric Verification with Active Liveness Detection: ComplyCube’s state-of-the-art biometric liveness detection, certified to ISO 30107-3 and PAD Level 2 standards, verifies that the individual presenting the identity document matches the submitted details. Their Identity Verification (IDV) system leverages both biometric and behavioral analysis to provide strong security against fraudulent or synthetic identities.
Comprehensive Document Verification: Using AI-driven technology paired with expert reviews, ComplyCube thoroughly verifies identity documents. This ensures that documents are authentic, unaltered, and valid. Covering a wide range of document types—passports, driver’s licenses, national IDs, residence permits, visa stamps, and travel documents—ComplyCube offers extensive protection against identity fraud.
For more information on how to protect your business from fraud, contact ComplyCube’s compliance experts.
