Hacker News Reader

Comment by Dayshine | Hacker News Reader

It feels like the "unique" part that makes this something novel about this is that they claim you authorized fraud when you raised your limit, accidentally letting a transaction you couldn't see through.

So the scenario is roughly (numbers made up):

1. You set a £500 monthly card limit

2. Your card is stolen and somebody charges £1000

3. You get a notification saying you have hit your limit

4. The failed, fraudulent, transaction is not listed

5. You increase your monthly limit to £1500

6. The fraudulent transaction goes through

7. You can now see the transaction

8. You cancel your card and report the fraud

9. You're told by raising the limit you authorized the fraudulent transaction that you couldn't see before you raised the limit

That's insane...

View on HN

> you authorized the fraudulent transaction

I don’t know European banking law. But in the U.S., this isn’t Revolut’s call to make [1]. They can issue the chargeback and then cancel your account, if they think you’re being screwy. But they can’t deny the chargeback unilaterally.

OP should reach out to their national financial services regulator.

[1] https://www.federalreserve.gov/boarddocs/supmanual/cch/efta.... Liability of Consumers for Unauthorized Transfers—12 CFR 1005.6

Unfortunately chargebacks aren't as simple in the EU, in addition to country-specific rules that make them hard to use in some countries.

In France any transaction involving you PIN code is really hard to contest (so if you get your card copied by a skimmer it's tough).

Same with online transactions using 3-D secure (2-factor, usually involving a confirmation code sent by SMS).

For other online transactions however, you just have to ask your bank and they're chargeback the merchant.

This sounds like the same fallacy the UK had with chip transactions. The magical fallacy that they're infallible and totally secure, thus all fraudulent transactions are automatically your fault.

It’s interesting that there was quite the criticism of the US “mag stripe” cards when Europe was chip and pin. I recall many Europeans claiming that their system was far more secure and “better.” However, chip and pin puts liability on the customer for fraudulent transactions, while in the US, the liability is on the merchant.

They seem to be orthogonal, if we still just had magstripes then it would be super easy to clone your card and make transactions using it because there's no second factor needed. At least the criminals now have to be organised.

The response to the fraudulent transaction would surely be the same as that's either the bank's call or/legislative.

This is not really true.

The merchant takes liability on some transaction types. In the UK, any credit card transaction that is flagged by the customer, regardless of chip and pin, is immediately refunded and investigated.

However - as card cloning of chip and pin cards is still effectively at zero, it's very unlikely that fraudulent chip and pin transactions ever take place without, say, the card being stolen as well.

I've got nothing to contribute, except that pretty much every time I ask a PM for clarification on a concern I have at work and they say "oh, that can't happen/never happens" it happens about 30 seconds later. Or it happened 30 seconds ago, which is why I was asking.

Chip and Pin has been out in the wild for what ... 17 years in the UK where I am? And round a lot of the world. So far it has resisted cloning admirably.

I'm not saying Card-present fraud can't ever happen with EMV cards, or that customer liability is the right thing to have, but this technology really does seem to have held up well to attack. Possibly because there are just easier ways to defraud people...

They are a lot more secure. Magstripe fraud is rampant, an accepted fact of life. Breaches of chip cards are extremely rare and not a fact of life.

Or can you back up this insinuation that smartcard chips that digitally sign transactions are no more secure than magstripes anyone can duplicate?

No one claimed they're as bad as magstripes, only that they are not 100% perfectly secure.

Nobody claimed they where 100% secure, at any point in this thread, during the development of the technology or during the rollout.

Then we're all agreed, and I have no idea what repolfx is so indignant about.

But if chip cards are much, much more secure than before and chip breaches are negligable (which they are), then why is the default presumption of fraud being the user's fault unfair? Users can and do write their PINs down, give them to other people and engage in other unsafe practices. That's by far the most common way chip cards are breached: social engineering.

I think there's a limit to how much liability system vendors should be expected to take. Insisting on all-corporate liability all the time, even for cases that are basically unsolvable like users deliberately giving away credentials, just socialises the cost of careless behaviour on all card users. Why bother upgrading security at all, in that case?

You can duplicate chip & pin EMV cards too. They are prone to fraud just like mag stripe cards.

https://www.consumerismcommentary.com/chip-credit-cards-frau...

I wonder if full "phone only" cards (like the Apple Card but no physical card at all) will become available as an opt-in service at banks at one point, it seems plausible in maybe 10-20 years as Apple/Google pay become more widespread.

Only when badly designed.

They're theoretically secure (ie. with cryptography), even if practically many can be encouraged to leak their secrets...

There is theory, and then there is what is actually out there.

The fact that something that is actually insecure doesn't have fraud protection is the wrong thing.

In the UK, the law is 100% on your side for credit cards. Just raise a consumer credit act claim, and unless the bank can show serious failings on your part, you'll have the money back.

"proving" that there hasn't been a security breach somewhere in their infrastructure is impossible, so you'll pretty much always win.

Depends on the bank. I had HSBC in France repeatedly deny that they could not and would not perform a charge back forna specific online transaction without a police report.

I ended calling VISA, who conference called my bank branch, explained that they were legally required to perform the charge back. The bank capitulated on the phone, the VISA guy hung up, and the bank said: VISA's opinion aside, we refuse to perform a chargeback.

France...

And what happened when you called VISA again and told them that the bank went back on agreeing to the chargeback?

They generally are for credit cards. Debit cards often have less protection but for credit cards, Visa and Mastercard will allow chargebacks similarly to the US.

It's even more insane because I set the limit to 200ish, so bill payments routinely give me that error message, so I didn't really think anything of it.

Also, apparently the declined transaction shows up, but it takes a while. It didn't show up on my list even though I got the notification, so I thought it just doesn't show and I went to the limits to raise them.

> Also, apparently the declined transaction shows up, but it takes a while.

I have had multiple times when the most recent transaction showed up only after restarting the Revolut app.

Yeah, same. Sometimes I needed to force-close, sometimes it wouldn't even show my balance, etc. It doesn't do this too often, but often enough.

If you set it to 200, why did you then increase it by 1000- which is a) an insane increase and b) the perfect amount for the transaction to go through?

Even if he'd removed the limit entirely, that doesn't show intent to allow that specific transaction through.

What if he was removing it to make a completely different payment?

It seems like terrible UX to not allow/require individual approve/reject on transactions that triggered the limit.

> It seems like terrible UX to not allow/require individual approve/reject on transactions that triggered the limit.

This would have been a massive improvement, agreed. Maybe they have to make a call within a few seconds and can't ask your permission first, though, so maybe that's not possible.

Still, the notification could have shown "Your transaction to MERCHANT for AMOUNT on CARD was declined because of your limit". That would have avoided this whole disaster.

It is possible. Some other banks do it exactly this way. If the transaction amount is large enough, they ask you to authenticate on their app and confirm the transaction.

I suspect that by wanting to move fast they put less emphasis on the features that are more time-consuming to implement.

I guess they built the transaction limit assuming that your merchant would tell you the transaction was declined, but neglected to address the case where you weren't the person hitting the transaction limit with your card.

but this happens, I don’t know why the author said it doesn’t. i get notifcations with the merchant and the amount (that can also be seen in the app). maybe there was a temporary glitch?

Do you get the amount and merchant in the notification that you reached the limit? Mine doesn't (check the screenshot).

hmm, you are right. I checked and the only notifications that I'm getting with the amount and merchant is when the card is blocked (I always keep it blocked and unblock it when I need to do purchases). I had the impression that's everywhere.

I didn't increase it, because I didn't know the transaction amount. I just set it to "off", which was the default. I also did this on a few of my cards, since I didn't know which card was hitting the limit.

It didn’t even mention which card this transaction was on, just no trace. Thinking it was a recurring bill payment that’s getting declined, I started looking into my cards, disabling and re-enabling limits.

I am guessing that you are the author of this blog post. For a long term user, you seem to have made a lot of assumptions and mistakes. You also seem to have a few cards on your account. I can't tell if you froze ALL of your cards, either immediately upon discovering the fraudulent event or before raising/disabling limits and then 'deal' with the rogue virtual card afterwards.

Revolut is a pre-paid card. You can't expect expect the same level of protection or consumer rights, which are provided by a Credit Card or a bank registered in your jurisdiction.

Regardless, you should post this in the Revolut community for more visibility and probably get an actual resolution, before jumping on the GDPR angle ─ which will fail to provide with you enough details, as most financial institutions will redact any information on fraudulent transactions ─ stating in some vague language that it is an on-going fraud/crime investigation, hence they are not allowed to discuss it etc.

Good luck.

https://community.revolut.com/

> For a long term user, you seem to have made a lot of assumptions and mistakes.

What were they?

> I can't tell if you froze ALL of your cards, either immediately upon discovering the fraudulent event or before raising/disabling limits and then 'deal' with the rogue virtual card afterwards.

I froze the card the charge was made on immediately after I discovered the fraudulent transaction, yes. I didn't freeze anything before removing the limit because I didn't think it was fraud until quite a bit after I saw the large transaction go through.

Initially I thought my work had used my card to book a trip for me or something similar. I didn't even imagine someone could have gotten my card details somehow.

> Initially I thought my work had used my card to book a trip for me or something similar. I didn't even imagine someone could have gotten my card details somehow.

I must be missing something here. Is sharing your card details with your workplace, so they can spend your money on your behalf, a normal thing for you (or anybody) to do? Legitimately asking here because I don't understand this at all.

No, it's not. I was just super confused by the charge and what's what I thought. It makes no sense, and yet the probability ranked higher than "fraud" in my mind.

A blunt question on that point: So what?

Let's say someone shares their card details with their workplace. For some reason beyond your or mine understanding. Which causes them, in a rush, to think "Ah, must be that, I'll drop the limit". Does this justify that person losing their money that was stolen from them via fraudulent charges?

>Revolut is a pre-paid card. You can't expect expect the same level of protection or consumer rights, which are provided by a Credit Card or a bank registered in your jurisdiction.

Er, are you sure?

In the UK marketing: https://www.revolut.com/a-radically-better-account

it is described as "Free UK current account". That's the name of a full, normal, bank account. I would expect it to have the full consumer protection, FSCS, etc.

If it doesn't, they're committing some pretty massive advertising fraud...

>I would expect it to have the full consumer protection, FSCS, etc. If it doesn't, they're committing some pretty massive advertising fraud...

You can expect all you like, but there is no UK FSCS protection. They have frequently ran into trouble with their advertising campaigns!

https://www.pymnts.com/news/payment-methods/2019/revolut-ad-...

Revolut community is censored. You cannot post everything there, probably this story will be never visible there.

> Revolut is a pre-paid card. You can't expect expect the same level of protection

The hell I can't. If they can't make their service secure and stand behind it when they fail, they have no business providing the service at all.

What Revolut's legal status and responsibilities are, I don't know. (Although the update says that they did eventually refund him, so clearly someone was aware they fucked up.) But implying that it's the user's fault for not anticipating Revolut's insecurity is absurd. He did make a mistake, but so did Revolut, and they should have (and, eventually, did) make it right.

>What Revolut's legal status and responsibilities are, I don't know.(Although the update says that they did eventually refund him, so clearly someone was aware they fucked up.)

I also use them as my main debit card, because I (mistakenly) thought that the immediate notifications and safety limits would keep me safer in case of fraudulent transactions.

My comment was referencing the above statement from the blog post, which highlights the fact that using this card as a debit card is not a prudent decision. There was absolutely no implication that Revolut was blameless, in any way whatsoever!

I am glad that the matter has now been resolved. For your reference, this card is not protected under the UK Financial Services Compensation Scheme, neither does it provide protection under Section 75 of Consumer Credit Act 1974. However, it is regulated by the Financial Conduct Authority(FCA) under Electronic Money Regulations 2011 and Section 12 describes the complaint handling procedure, which requires the consumer to follow the dispute resolution process by contacting the business first, before escalating it to the Financial Ombudsman Service. In most cases, there is a resolution before it reaches FOS.

https://www.fca.org.uk/publication/archive/emoney-approach.p...

https://news.ycombinator.com/item?id=20263121

on sixt this month i had a transaction with google pay that is connected on my revolut card. that it took 2 days to show up. even support could not see it. they kept saying the top up will ve reversed, even when it was a completely different issue.

Out of interest don't you get any penalties for all those declined/failed payments?

No, the card is canceled so it's not even the user's problem any more.

He means in the ordinary case, where you regularly hit the limit before, just through legitimate transactions.

Oh, no, there don't seem to be any penalties. I only get a few failed transactions here and there anyway, but so far it's been 100% "legitimate transaction getting restricted", so I trained myself to raise the limit.

Why would you raise the card limit? Panic?

In my case, it was because it's a thing that happens frequently. I set limits low and I routinely get transactions failing, so I raise/remove the limit and they retry.

It generally happens when recurring bill payments come through, so I didn't really think much of it, I did what I do when a transaction fails. If I had seen the amount, I definitely wouldn't have done anything like that.

> I set limits low and I routinely get transactions failing, so I raise/remove the limit and they retry.

What's the point of a limit, if you automatically remove it whenever something is over the limit?

It didn't start out like that, but yep, it just trained me to override it. The rationale was that I could first see the transactions that fail, but the UI doesn't encourage that.

What's the point of a banking app, if it doesn't show you the failed transaction after sending you a vague notification about a limit being reached (due to that transaction)?

It's weird to me that the focus is on Stavros not doing this or that, when the original failure was the bank's. If the notification had said "This transaction here failed because it hit the limit" none of this would have happened. If the app had shown that transaction in the list, none of this would have happened.

Yet here we are asking why the user didn't react perfectly to the failures of the bank. It's weird.

If it happened to be the day your bills go out, you might just assume you messed up in your planning.

And there's no weird transaction listed, so assuming it's a standing order wouldn't be unusual.

And yeah, "panic", the fees for missing payments on some bills can be fairly high so you probably can't wait till beyond 2pm that day.

Reply on news.ycombinator.com