Consumer complaint received 2026-03-03 00:00:00
Product: Checking or savings account — Checking account
Issue: Problem with a lender or other company charging your account — Transaction was not authorized
Company: Revolut Technologies Inc.
State: IN

Complaint narrative:
Subject : Violation of Regulation E ( 12 CFR 1005.11 ) Failure to Conduct a Reasonable Investigation Description of Error : Between XXXX & XXXX, XXXX unauthorized transactions totaling {$8500.00} were debited from my Revolut account. These transactions were " Unauthorized Electronic Fund Transfers '' as defined by 12 CFR 1005.2 ( m ), as I did not authorize them, did not participate in them, and received no benefit from them. Evidence of Account Takeover : The transactions in question were processed via a VPN and, crucially, without biometric ( SCA ) authentication. This deviates from my established spending pattern. Furthermore, I have obtained a location log from the merchant ( Moonpay ) proving that these transactions originated from an IP address and physical location outside of the United States, while I was physically present in the U.S. with my device. I've never been out of the country, but also wasn't out of the State of Indiana at any time during the period in question. Revoluts Regulatory Failure : Revolut issued a blanket denial of these disputes. By doing so, they have violated 12 CFR 1005.11 ( c ), which mandates a " reasonable investigation. '' Revolut failed to reconcile the geographic impossibility of the charges ( XXXX vs. XXXX XXXX ). Revolut ignored the lack of Strong Customer Authentication ( SCA ) for high-value transactions. Revolut has refused to provide the " Evidence Packet '' used to deny my claim, in violation of 12 CFR 1005.11 ( d ) ( 2 ). Desired Resolution : I am requesting that the CFPB compel Revolut to : Issue a full refund of the unauthorized {$8500.00}. Provide the full investigation report, including authentication logs showing whether a fingerprint was successfully captured for each of the 38 transactions, and also IP address data for where the purchases originated from. They also should explain why merchant-provided location data ( XXXX ) was disregarded during the initial investigation. I've trusted them as my banking partner and through a busy time they allowed me to be bled dry. I have been overloaded with work and wasn't keeping a steady eye of my finances and thought I was okay saving money but they've allowed a significant portion to be siphoned out of my account, and because of their lack to implement the security measures I've opted into. I have 0 text messages or emails from Revolut asking to confirm a transaction from the merchant, so it's pure negligence and just approving what should've been rather secure. Revoluts security protocols failed to challenge these high-value transactions for biometric authentication ( SCA ), which is their standard procedure for sensitive actions. The fact that 38 transactions were permitted via a VPN and without fingerprint verificationcontrary to my established user patternconstitutes a 'Security Violation ' and an 'Unauthorized Electronic Fund Transfer ' under Reg E . I formally exercise my right under 12 CFR 1005.11 ( d ) ( 2 ) to request all documents, logs, and internal notes that Revolut relied upon to conclude these transactions were authorized. I specifically request the 'Authentication Log ' showing whether SCA was successful for each of the 38 disputed items. Revolut has failed to fulfill its duty to conduct a 'reasonable investigation ' as required by Regulation E. I provided third-party evidence from the merchant ( XXXX ) showing that the transactions originated from an IP address and physical location outside of the United States. Despite this clear evidence of account takeover, Revolut issued a blanket denial without reconciling the geographic impossibility of these transactions.

Company response to consumer: Closed with explanation