When someone asks a person about bank details, the person might decide to share his bank details with someone voluntarily. That is not the point.
2 Likes
But I could pretty easily find out without your consent.
When you get your card or phone out to pay, for instance.
Why are you against letting users decide?
It’s not about you being able to find out someone’s bank brand, it’s about someone’s choice to share this personal data with potentially millions of other users.
3 Likes
I’ll add some more background to this:
Years ago, there were attempts to take over accounts from N26 customers. Criminals were adding “random” cellphone numbers to the app. The app would then show who’s got an N26 account and would help them to identify potential targets.
6 Likes
This point by Frank is interesting and disturbing. If correct, perhaps it is time for me to leave Revolut?
1 Like
I am not too concerned myself, it was easier back then to hijack an N26 account than it is now to take over someone’s Revolut account, I would say. Ironically, not having a web interface makes Revolut safer.
1 Like
This is really interesting. Could you also share a source? I’m having trouble finding out more about it
2 Likes
on android is quite easy to write a fake contacts provider and pretend you know everyone
This was 2 months ago… At least it seems acknowledged but this is still quite a big issue. In principle, the option to opt out should have been there day one.
5 Likes
This definitely needs to be introduced, I agree with what Frank stated above: that’s not just a choice but a security concern.
2 Likes
I have a related data protection question. If you send a Revolut payment to someone else’s mobile number, can the payee see your name as registered with Revolut? This could present privacy issues if retail businesses start to accept Revolut as a means of payment to avoid card processing fees.
For all intra-Revolut payments that I’ve done so far, both payer and payee have been been in each other’s contacts, so I don’t know whether this is an issue.
1 Like
Yes, they do.
20202020
1 Like
Of course. The recipient is forwarded to a Revolut branded website where he can either withdraw directly to Revolut or enter account details for a regular bank transfer. Your name is displayed on this website: “Frank sent you …”
The link is shared via your own contact details, via the phone’s text message app or your mail client (or any other way). So depending on how you share the link, these contact details are also transmitted.
How would this be different to sharing your bank details via any other option like Paypal, traditional bank transfer or any other P2P system like Klarna’s Wavy? You’re always identified as an account holder with the provider you chose to use.
1 Like
To clarify, I’m talking about sending money to a mobile number that is already registered to a Revolut account. Obviously a business would solicit payments via Revolut only if it (or the business owner) had an existing account with Revolut.
The reason I see a privacy issue is that, when accepting card payments, retail businesses do not see the payer’s name. Are you sure that a payee sees the payer’s name (as registered with Revolut as opposed to registered in the payee’s contacts) if both payer and payee are existing Revolut customers and the payment is sent from one mobile number to another mobile number?
1 Like
When the recipient is not in your address book, the only option you’ve got is to create a payment link (let’s ignore “near me” for a moment). The app (iOS) does not show the option to pay to a phone number “directly” without adding the contact to your address book. When a payment link is created, the recipient is forwarded to a website that says “Your name has sent you 123 GBP”.
The recipient can then “withdraw” the funds directly to his own Revolut account or he can provide account details of a third party bank and initiate a bank transfer.
So a use case could be that the merchant gives you the option to pay “via Revolut P2P” and shares his phone number. One would then create a payment link in case one does not want to add the merchant to the contact list.
(Regarding privacy, how would such a scenario be different compared to PayPal? The merchant also gets your name and PayPal email address.)
The transaction is then recorded in the app as either a P2P or a regular bank transfer, showing the same details as if it would have been set up without a payment link.
I’m suggesting where the payer is not in the payee’s address book, rather than where the payee is not in the payer’s address book. What does the payee see? Just the mobile number of the payer or the name that the payer registered with Revolut?
1 Like
My assumption is that the transfer will be displayed identical to how a regular P2P transfer will show up on both transaction lists. Including the name. But I haven’t tested this.
what i find paradoxical is that individuals are exposed without opt-out and 
businesses are not allowed to opt-in…
1 Like
Well - good grief: I just found the opt-out in the app! It seems that it ‘only’ took them a phishing scandal in August 2019 to introduce this privacy necessity!
Can’t believe it: I spent close to 2 years argueing for this privacy/security opt-in and ‘all it took’ was this phishing scandal (for German readers):
Gee…
5 Likes
This is worse than I thought. Two weeks ago, I was in Budapest and looking for a boat trip. There was a girl selling tickets, but she didn’t have a card machine and accepted only cash. Just as I began to walk away, she asked whether I had the Revolut app (not a Revolut card but specifically the app). I then paid her directly for the tickets via a Revolut HUF payment from my mobile number to her mobile number. I could immediately see her full name as registered with Revolut and she could immediately see my full name and photo registered with Revolut.
This means that Revolut can be used to find out the Revolut-registered identity of any mobile number, just by sending a tiny payment to it. The smallest value payment that Revolut supports in any currency is HUF 0.01. It’s quite a cheap way to do a reverse phone number lookup, although the recipient would know that you’ve done it. Revolut should not reveal the registered identity of the payer to the payee or of the payee to the payer; they should be identified using only mobile numbers, which can in turn be matched to contact lists in the phone.
5 Likes