Ombudsman finds in favour of Revolut customer after sophisticated HMRC impersonation scam

Miss N was contacted in March 2021 by fraudsters claiming to be calling from HMRC regarding unpaid tax relating to a former employer. The caller told her she was facing arrest and a court case if she did not follow their instructions.

This, of course, was untrue and was a ruse used by the scammers to get Miss N to do what they needed her to do to get their hands on her money; however, by using number spoofing technology (in which they clone the number of a legitimate business to make their scam more believable) the criminals were able to convince Miss N that they were calling from a genuine Ministry of Justice number.

Over the course of an hour, Miss N transferred six separate payments to three different accounts, totalling £9,373. After hanging up the phone with the scammers Miss N contacted the Ministry of Justice directly, at which point she was told she had been the victim of an impersonation scam, and she reported the fraud to Revolut.

Revolut looked into recovering the money, but as it had already been moved on from the accounts that Miss N moved it to (as is often the case) only £1.03 could be retrieved.

The bank then refused to refund Miss N the remainder of the lost money arguing that it had given sufficient warnings whilst the scam was ongoing, and that further contact, such as a direct phone call to Miss N, would not have stopped her going ahead with the payments and prevented the scam.

Miss N disagreed with this decision and referred the complaint to the Financial Ombudsman Service for an independent review.

The tactics used in Miss N’s case of convincing her to make and authorise payments from her own bank accounts to those of the scammer, are a classic example of Authorised Push Payment (APP) fraud.

APP fraud involves scammers using social engineering techniques, such as impersonating well-known and trusted organisations, to convince victims to willingly transfer money to the scammer’s account for what they believe is a legitimate purpose – in this case, to avoid arrest. Unfortunately, by the time the scam has been uncovered, the funds have usually been quickly moved on from the scammer’s account and become difficult, or impossible, to recover.

In the UK, banks have a duty of care to customers that involves having in place safeguards to detect and protect them from APP scams. Where banks have failed in this duty of care and refuse to compensate, the complaint can be taken to the FOS, and increasingly the service is seeing banks failing to fulfil their responsibilities sufficiently.

In Miss N’s case, the Ombudsman decided in Miss N’s favour – and against Revolut – for a number of reasons, including:

• Whilst Revolut did give warnings and try to halt the payment, the warning given was generic and ‘didn’t highlight what the risks of making the payment might be’.
• Once the account activity became more suspicious as Miss N transferred further amounts of money, no further interventions were made by Revolut.
• If further intervention had been taken, such as a direct phone call between Miss N and Revolut, the scam ‘would quickly have been revealed’.

The investigator found that, although Miss N did receive warnings, she was the victim of a sophisticated, pressurised scam, and as Revolut is ‘the expert in the relationship’ it should have been relied upon to do more.

Following the Ombudsman’s investigation, Miss N was compensated for the full amount lost, plus 0.1% interest and £250 for the distress and inconvenience.

In 2022 it was reported that Revolut, the online bank used by Miss N had been the victim of a data breach in which fraudsters gained access to the personal details of tens of thousands of customers.

While ‘no card details, PINs, or passwords were accessed’, it was reported that the criminals likely got access to customers’ partial card payment data, names, addresses, emails, and phone numbers which could be used by scammers.

Following the breach, Revolut warned its customers about the risk of phishing emails, calls, and SMS messages claiming to be from the bank asking for login details or access codes, as these would likely be from scammers. These are common tactics used by scammers to gain access to victims’ money, so it is important to be vigilant when it comes to any contact from banks – no matter who you bank with.

Some precautions to take include:

• Do not give any personal information like your name, address, or bank details, to organisations or people before you have checked they are who they say they are.
• Keep your computer software and security settings up-to-date and use strong passwords – never give anyone remote access to your computer or online banking.
• Be vigilant for phishing emails – ones that ask you to click on a link to verify or complete bank details or personal information.
• Look out for post, phone calls or emails offering you deals out of the blue, especially ones with time-sensitive deadlines – pressure tactics are often used by scammers.
• Help elderly or vulnerable friends and family members stay safe too – teach them the signs to look out for.

If you believe you have been the victim of fraud, report it immediately to your bank, Action Fraud, and the police.

Sarah Spruce, Head of TLW Solicitors’ specialist fraud claims team, said:

“Miss N’s story is not uncommon and is one we hear a lot from our own clients; scammers are using sophisticated tactics and putting pressure on victims to make them act quickly and perhaps not take the precautions they usually would. While Revolut did issue some warnings, it is important for banks to have in place extra safeguards for particularly suspicious-looking transactions, such as these, so it is clear to see why the FOS reached the decision it did.

We would recommend everyone familiarise themselves with the checklist of precautions to keep themselves safe from scammers, no matter who they bank with, and if the worst comes to the worst, get in touch with my team and we can help you with your refund claim.“