111–120 of 139 posts
Even if the trigger was spoofed, how come there is no secure channel that the govt provides to receive the data? Was this one also compromised?
If people actually knew how much of a wild west this stuff is, a lot more would be cautious with their personal info.
Earlier quoted context omitted.
My understanding of the situation is that no government agency actually requested data at all, just that someone impersonated a government email address and this was enough for Revolut to reply with the requested data.
From the PR statement, it's unclear if a gov. agency was hacked or it was a phishing attempt, from my point of view. Both cases are still not enough, even for a greasy spoon.
Earlier quoted context omitted.
Most banks now require selfies, try shopping around. KYC requirements get tightened all the time.
I have accounts with 2 other banks. They never asked for a selfie.
Earlier quoted context omitted.
Revolut has a history of being both halfarsed and shady in 2018 they turned off basic money laundering detection in 2019 they used job applicants as free labour to get people to sign up. in 2023 they didn't freeze accounts they were supposed to when asked by the NCA (the uk's equivalent of the FBI, kinda) again in 2024 they came bottom in the league table for reported fraud(action fraud). They had 10k reports, ahead…
Only one of them is directly harmful to users (the job applicant scheme). Everything else is enabling their own users to break the law only if they want to , and I think that is a good public service. Of course it might hurt legit users by making other banks treat Revolut as suspicious but im not sure if thats enough to outweigh the positive. Data breaches and cancelation fees, on the other hand...
You do understand what push fraud is right? One person lost ~£160k, a large chunk of it waiting for a human to answer.
also, its not like there aren't alternatives.
Earlier quoted context omitted.
Not a bank until 2018 And they clearly figured that was easier than going through the UK where they had previously been licensed
No, they had a standard bank license, no different than any other bank operating in the country. Of course it was only valid in the EU not Britain. https://www.lb.lt/en/news/banking-licence-granted-to-revolut... edit: Comment no longer makes much sense after the one above was edited
Earlier quoted context omitted.
I was thinking about exactly that and then I found this comment. One spoofs an email domain and then is able to get trust from a "modern global fintech"? Absolutely ridiculous. Having worked for several global scale tech companies, I've seen first hand how security is at the absolutely bottom of the list. It does not translate to $$$ so it is uncared for. Revolut keeps pestering me with requests for interviews and I…
In the countries you are licensed in you are legally required to reply to law enforcement requests. In most places there is no official channel for this. It is literally stuff like LE@Fintech.com. Emails come from all over and random domains that appear official-ish. Most official domains do not have DKIM or SPIF setup, very easy to spoof. LE by and large do not take security seriously, they do not take data transfer…
Cybersecurity 101: Call back the bank at the official number and all that yada yada.
Earlier quoted context omitted.
Not a bank until 2018 And they clearly figured that was easier than going through the UK where they had previously been licensed
No, they had a standard bank license, no different than any other bank operating in the country. Of course it was only valid in the EU not Britain. https://www.lb.lt/en/news/banking-licence-granted-to-revolut... edit: Comment no longer makes much sense after the one above was edited
This is a reminder about what happens to people happily uploading their passport and selfies into the app. Do not do it if you do not want to end up in a Russian underground forums.
What else are you supposed to do? All bank require BYC and will ask you to control your identity. We shouldn’t blame customers for the fintech company mistakes
Earlier quoted context omitted.
What else are you supposed to do? All bank require BYC and will ask you to control your identity. We shouldn’t blame customers for the fintech company mistakes
Some banks, I assume, allow showing the documents in person and without a selfie.