ADVICIFAS Pro is a paid platform for challenging CIFAS fraud markers. This report draws on its case data. Between May and July 2026, 22 people challenged markers filed by Revolut Limited. Every marker was Misuse of Facility, the category that requires evidence the account holder knowingly allowed their account to be used for fraud. Under CIFAS rules, naivety, manipulation, and coercion do not meet that threshold. The institution bears the burden of proof, not the individual.
We analysed 65 responses across all 22 cases. What follows is what we found.
The Template
The most striking finding is not what Revolut said. It is that Revolut said the same thing to everyone.
The following table shows sentences that appeared, word for word, in responses to multiple unrelated complainants. These individuals had different markers, different accounts, different circumstances, and in most cases had never heard of each other.
| Sentence | Complainants receiving it verbatim |
|---|---|
| "I have gathered all the information we need to provide you with our Final Response" | 5 |
| "I have decided not to uphold your complaint" | 5 |
| "We have thoroughly reviewed your case and our decision remains final" | 4 |
| "If you have any concerns regarding the CIFAS marker procedure, please contact CIFAS directly" | 4 |
| "To proceed with your request, we need solid evidence to prove the dispute the payer raised is not valid" | 3 |
| "We have completed a careful review... we've found that this marker did meet these principles" | 3 |
| "Without receiving the anything from you, we are unable to take any further action" | 3 |
The last entry is reproduced exactly as written, including the grammatical error. The same broken sentence, uncorrected, sent to three different people.
In one case, Complaints Analyst Palash issued the same one-paragraph rejection to seven consecutive counter-representations. Each contained new evidence and legal arguments. Each response stated the decision "remains final" without engaging with any of the submitted material.
A process that produces identical language across unrelated cases is not assessing those cases individually. That observation holds regardless of the merits of any individual complaint, because the response does not vary with the facts.
The SAR Problem
Under UK GDPR Article 15, individuals have the right to request all personal data an institution holds about them. In every documented SAR response from Revolut, the following were systematically withheld:
- CIFAS filing forms: the document recording what evidence was relied upon when the marker was filed
- Fraud investigation reports: internal assessments of the alleged fraud
- Legitimate Interest Assessments: the legal document required to justify processing under GDPR
- Vulnerability assessments: records of whether the individual's vulnerability was considered
- Internal communications: emails, notes, and decision records relating to the marker
Transaction data and chat history were redirected to "the Revolut App", despite the complainant's account being terminated, making app access impossible.
Please note the vast majority of information that we hold on you is available through the Revolut App.
Revolut SAR response to a terminated account holder who can no longer access the app
Location data was withheld on the basis that "file sizes are exceptionally large." This is not a recognised exemption under UK GDPR or the Data Protection Act 2018.
The absence of CIFAS filing forms from SAR responses is significant. If they do not exist, the marker was filed without a documented evidential basis. If they exist but were withheld, the response raises potential compliance concerns under Article 15. Either outcome is significant for the institution's legal position.
Six instances were identified across these cases as raising potential compliance concerns under UK GDPR, covering missed SAR deadlines, incomplete disclosures, inaccessible redirect channels, invalid exemptions, and a failure to respond to a formal Article 21 objection.
The Evidence Loop
One case illustrates the burden-of-proof inversion with particular clarity.
On a single day in December 2025, a complainant received three successive emails from Revolut's Marker Disputes team. Each raised the evidential bar after the previous request had been satisfied.
8:52am: Revolut lists specific payments from three payers and asks the complainant to describe their relationship to each, explain the purpose of the transfers, and attach evidence if possible.
The complainant responded with a full explanation.
3:45pm: Revolut acknowledges the initial information but now requires the "complete chat conversation with the relative who asked you to receive this payment." Screenshots must include clear timestamps, references to payments, the initial contact where the relative approached the complainant, and a clear explanation of the arrangement.
The complainant provided the requested chat screenshots. In the same reply, they wrote:
If something isn't covered, I would request that you point this out to me, and not just reject the complaint.
The complainant's reply to Revolut, 4:36pm
7:32pm: Three hours later, Revolut responded. The screenshots were now insufficient. Revolut required a video screen recording of the entire chat, scrolling slowly from the first message to the end, with highlighted sections where disputed funds are referenced and clear timestamps throughout. They did not identify what was missing. They escalated.
Three requests in one day. Each time the complainant complied, the requirements escalated. The complainant asked to be told what was needed. Revolut asked for a video instead. At no point did Revolut disclose what evidence it held when it filed the marker twenty-three months earlier.
The Redirect Loop
A pattern documented across multiple cases involves directing complainants between internal teams in a circle:
- [email protected] directs complainants to [email protected]
- [email protected] directs complainants to [email protected]
- Both teams direct complainants to "contact support via the in-app chat", despite the account being terminated
One case recorded five consecutive identical referrals between teams. In several cases, Revolut directed complainants to "request a Final Response Letter" from the complaints team after having already issued one. In one documented case, an FRL had been issued and upheld twice in writing before the complainant was told to request one.
The Data Handling
Two incidents from the same period illustrate how Revolut handles the data it asks complainants to trust.
In July 2026, correspondence relating to one complainant's marker challenge was associated by Revolut's own systems with the open support request of an entirely unrelated complainant, filed under a different reference. Revolut's system generated a notification confirming that both individuals were registered as copied parties on the same support request. The notification named them both. They had no connection to one another. The crossing occurred inside Revolut's ticketing system, and Revolut continued to correspond into the merged thread, compounding rather than containing the exposure.
An institution that cannot keep two unrelated complainants in two separate files, in the middle of a dispute about the accuracy of those files, cannot reasonably ask that the accuracy of a six-year fraud marker be taken on trust.
In a second incident, Revolut removed a CIFAS marker in late June 2026, confirming in writing that the removal was effective immediately. Three weeks later, its Data Protection Support team wrote to the same complainant's representative requiring proof of identity before it could act on the data subject request. Revolut had already reviewed the case, already acted on the representative's correspondence, and already removed the marker. It accepted the authority sufficiently to act on it, then required that authority be proved afresh before it would disclose the data underlying the decision it had already reversed.
The Numbers
| Outcome | Count | Percentage |
|---|---|---|
| Rejected (no engagement) | 24 | 36.9% |
| Acknowledged (auto-response) | 16 | 24.6% |
| Information Requested | 13 | 20.0% |
| SAR Partial (incomplete disclosure) | 5 | 7.7% |
| SAR Compliance | 3 | 4.6% |
| Rejected (with potential GDPR compliance issue) | 3 | 4.6% |
| Referred (internal redirect) | 1 | 1.5% |
These cases are active and at various stages of challenge.
Conclusion
Twenty-two unrelated people. Sixty-five responses. The same sentences, the same withholdings, the same escalation patterns. A process that does not vary with the facts cannot be assessing the facts.
The responses are on the record. The pattern is in the data. What Revolut does next is up to Revolut.
Right of Reply
On 17 July 2026, ADVICIFAS wrote to Revolut Limited at [email protected], [email protected], and [email protected], setting out the findings of this report in full and inviting a response by close of business on 22 July 2026. The letter put nine specific questions to Revolut concerning the evidential burden, the review process, sequencing, subject access, inaccessible channels, deflection to CIFAS, cross-contamination of records, verification after the event, and Consumer Duty obligations.
Revolut's automated support system acknowledged receipt at 11:59am on 18 July 2026, assigning case number 61370-00658-01952 and confirming that a response would follow within 48 hours.
Email tracking recorded 23 opens of the letter across the three recipient addresses between 18 and 21 July 2026. No substantive response was received by the deadline or at any point thereafter.
This report was compiled from anonymised case data. No individual complainants are identified. All quoted language is from Revolut Limited's own correspondence. Statistical analysis is based on AI-assisted document classification verified against source materials.
Data period: May to July 2026. Cases analysed: 22. Response analyses: 65. Intelligence observations: 245.
Methodology
This analysis draws on case data collected by ADVICIFAS Pro, a platform that assists individuals in challenging CIFAS fraud markers. The 22 cases represent all active Revolut-related cases on the platform during the period. Cases were not filtered or selected. A "response analysis" refers to an AI-assisted classification of each piece of correspondence received from Revolut, verified against the source document. Template matches were identified by comparing quoted language across response analyses from different cases. All quotations are reproduced from contemporaneous correspondence.
