WEBVTT
00:00:00.000 --> 00:00:02.399
Okay, so Revolut just had the worst month in its history.
00:00:02.560 --> 00:00:10.240
So someone spent months pretending to be a government official and asked Revolute for its customers' most sensitive data, passports, selfies.
00:00:10.480 --> 00:00:14.560
They even asked who the owners of specific crypto wallets were and where they lived.
00:00:14.640 --> 00:00:15.919
And Revolut handed it over.
00:00:16.079 --> 00:00:20.399
But in their defense, as we'll discuss, this was a very convincing con.
00:00:20.480 --> 00:00:21.839
And it's not victimless either.
00:00:22.079 --> 00:00:25.760
Some of the people whose data was leaked now fear for their safety.
00:00:25.920 --> 00:00:28.480
One of them has moved their family into a hotel.
00:00:28.559 --> 00:00:31.519
And Revolute's response, nothing, really, just a shrug.
00:00:31.679 --> 00:00:38.399
You know, a short statement, their systems were unaffected, there were a limited number of customers affected, and their funds were untouched.
00:00:38.560 --> 00:00:44.799
Which might all be true, but it misses the point entirely because the hackers weren't after the funds in their Revolut accounts.
00:00:44.880 --> 00:00:46.719
They were after their personal information.
00:00:46.880 --> 00:00:49.679
So who they are, where they live, what they look like.
00:00:49.840 --> 00:00:58.399
And this stuff is becoming so common that only two weeks later, I got an email from Revolut telling me I'd been caught in a leak as well.
00:00:58.479 --> 00:01:03.359
So I contacted Revolute to ask what I was supposed to do about it, and I'll share their response shortly.
00:01:03.520 --> 00:01:06.400
So that's two customer data breaches in one month.
00:01:06.560 --> 00:01:13.200
And in the same month, Revolut also chose to launch Pay with Smile, where you pay for your coffee with your face.
00:01:13.359 --> 00:01:19.120
Now that raises a few obvious concerns, which we can get into, and as always, please get in the comments and let us know your thoughts.
00:01:19.200 --> 00:01:23.519
But first, Jan, we have to talk about this data breach and exactly how they pulled it off.
00:01:23.599 --> 00:01:32.159
Because Revolut is a company worth over a hundred billion dollars with a pending US banking license, and they were tricked by a stolen email account.
00:01:32.480 --> 00:01:36.000
Yeah, Johnny, reading through the story, I think it's it's kind of shocking.
00:01:36.079 --> 00:01:37.120
How can that even happen?
00:01:37.200 --> 00:01:39.040
Um, that's the first thing I asked myself.
00:01:39.120 --> 00:01:42.239
And I think they're it's maybe not purely their fault.
00:01:42.400 --> 00:01:48.640
Um the regulators for uh is as much if fault, in my opinion, um, due to the fact that they lost access to the email.
00:01:48.719 --> 00:01:50.480
We'll go into that detail in that detail later.
00:01:50.640 --> 00:01:52.159
What really angers me is their response.
00:01:52.319 --> 00:01:54.400
They really shrugged it off, basically.
00:01:54.560 --> 00:01:58.400
Um, didn't really admit much, just inform people that there was a data breach.
00:01:58.480 --> 00:02:02.799
And I think this is sad because this data breach has led to actual consequences.
00:02:02.879 --> 00:02:04.079
We know that for a fact.
00:02:04.239 --> 00:02:07.359
Um, and just feel sorry about the people affected in it.
00:02:07.519 --> 00:02:09.120
It's uh it's a disaster, actually.
00:02:09.439 --> 00:02:09.919
Yeah, yeah.
00:02:10.000 --> 00:02:18.080
So there is a certain level of incompetence here at play from both sides, not only Revolute, but also the Italian Ministry of Interior.
00:02:18.240 --> 00:02:24.240
They've had their account or their email address accessed by a party called I Am Not a Villain.
00:02:24.319 --> 00:02:27.919
This is like a hacking group, I believe, who have essentially bought access.
00:02:28.000 --> 00:02:30.000
And that's where the story begins, Jan.
00:02:30.159 --> 00:02:36.800
Inside this Italian email account, essentially, that's being used to contact Revolute.
00:02:36.960 --> 00:02:41.039
And this is an account that is also being used by the Ministry of Interior.
00:02:41.120 --> 00:02:42.560
It's also an active account.
00:02:42.719 --> 00:02:50.240
But the hackers are able to stay silent, stay hidden by deleting any correspondence that would be for them immediately when it's received.
00:02:50.319 --> 00:02:54.080
So they just download it as a.eml attachment and delete it.
00:02:54.240 --> 00:02:58.319
And then the the the authorities, the Italian authorities, are none the wiser.
00:02:58.479 --> 00:03:01.280
I actually hate to say this, but it's quite genius, really.
00:03:01.439 --> 00:03:06.400
You know, they they created like a recovery email address so if they lost access, they could get access again.
00:03:06.560 --> 00:03:11.520
This episode is sponsored by no one, really, just Jan and I and our website, depositscout.com.
00:03:11.680 --> 00:03:18.560
We built a savings comparison website basically because we couldn't find a website or a resource that we thought was good enough for what we wanted.
00:03:18.639 --> 00:03:22.240
Now we've built a database full of pretty much every account in the UK.
00:03:22.400 --> 00:03:29.120
We have easy access, fixed accounts, notice accounts, regular savers, even junior iters if you have children or if you're a grandparent.
00:03:29.280 --> 00:03:32.800
Some of my favorite features amongst many have to be the rate alerts.
00:03:32.879 --> 00:03:40.080
With Deposit Scout, you can track any account type that you want and we'll automatically email you if a new rate becomes available.
00:03:40.240 --> 00:03:42.000
We can also send you a weekly roundup.
00:03:42.080 --> 00:03:52.639
We send it out every Monday so you can see the latest accounts and you can track specific accounts if you're only interested in, say, fixing your money or keeping up with the latest and greatest easy access account.
00:03:52.800 --> 00:03:55.039
Jan, do you want to share a favorite feature as well?
00:03:55.280 --> 00:04:04.159
Johnny, I really love these account pages that we've set up because they provide a level of detail on each account that's available in our database that has uh yeah not been accessible before.
00:04:04.319 --> 00:04:22.319
So you can quickly look at an account, get an idea whether it's competitive or not compared to other accounts out there, and then also draw a conclusion from that, whether it's an account worth signing up for, or whether you should rather go with a different alternative, really makes the whole account choosing process more seamless, right?
00:04:22.399 --> 00:04:30.000
And at the end, I believe, I really do, that you end up with a better product, which can make a huge difference in terms of interest that you receive at the end of the year.
00:04:30.079 --> 00:04:32.319
Take a look at the website, it's something that Johnny and I have built.
00:04:32.399 --> 00:04:35.839
It is the best way to give back to the channel, to the podcast, and to us personally.
00:04:36.000 --> 00:04:38.000
Um, it's depositscout.com, everyone.
00:04:38.079 --> 00:04:39.759
We'll show a QR code on the screen.
00:04:39.920 --> 00:04:42.079
Feel free to sign up and let us know what you think about it.
00:04:42.399 --> 00:04:53.680
So they begin inside this official verified Italian email account and they start to send messages to Revolut, specifically the UAB, Revolut UAB Bank Entity.
00:04:53.839 --> 00:04:59.199
They send them forged documents that look like European investigation order documents.
00:04:59.360 --> 00:05:00.959
I'll put it on the screen for those who are watching.
00:05:01.120 --> 00:05:02.879
I think it looks pretty solid.
00:05:03.040 --> 00:05:10.480
They start to send these across and they're saying, hey, we've got these transaction IDs and we want to know who's responsible for them.
00:05:10.639 --> 00:05:17.600
And they start to send these forged documents to Revolut and they are requesting the profile of crypto transaction IDs, but these aren't random accounts or transactions.
00:05:17.680 --> 00:05:28.959
The attackers have already performed blockchain analysis to identify the richest wallets they could find, and it's the identities of those wallets, those transactions that they are trying to extract from Revolut.
00:05:29.199 --> 00:05:30.800
Crypto is meant to be anonymous.
00:05:30.879 --> 00:05:33.439
That was all what it was always about, you know, anonymity.
00:05:33.600 --> 00:05:36.800
And Revolut are just revealing the people behind these.
00:05:36.959 --> 00:05:43.040
This goes on for months, Yan, and they continue to give more and more data across to this email inbox.
00:05:43.279 --> 00:05:53.519
File after file, profile after profile, we're talking names, phone numbers, selfies so they can identify the people, addresses, which is important here.
00:05:53.680 --> 00:05:56.959
There's something in crypto, Yan called a wrench attack.
00:05:57.600 --> 00:06:08.079
It's where someone will attack someone physically, in person, in order to extract their seed phrase, their secret passwords, maybe get access to a hardware wallet.
00:06:08.240 --> 00:06:11.839
And that's what this information could be used to do.
00:06:12.000 --> 00:06:17.199
And these were celebrities, there's allegedly a tennis player called Chevchenko.
00:06:17.360 --> 00:06:23.360
We have the founder, CEO of an online gambling company called Felix Roma.
00:06:24.160 --> 00:06:26.879
He's been quite outspoken about this on Twitter.
00:06:27.120 --> 00:06:30.160
Um he has been potentially extorted.
00:06:30.240 --> 00:06:40.959
I don't think he has necessarily paid up, but they are trying to extort him, or people are trying to extort him by saying, hey, if you don't pay or if you don't act on this, we will expose your data online, which is quite frightening.
00:06:41.120 --> 00:06:44.240
There's another guy called, I believe, Mark Carpellis.
00:06:44.399 --> 00:06:49.040
He was like the CEO of a Bitcoin exchange and um obviously has some wealth.
00:06:49.199 --> 00:06:51.519
You would assume he would have a large crypto holding.
00:06:51.839 --> 00:06:56.319
He was targeted, he was the person that's had to move out of his home and into a hotel.
00:06:56.399 --> 00:06:57.920
And I mean, this is something, Jan.
00:06:58.000 --> 00:06:59.759
It's important to know for context.
00:07:00.000 --> 00:07:05.279
Kidnapping is becoming rife inside of the Bitcoin world, so to speak.
00:07:05.519 --> 00:07:12.079
There was the founder of Ledger, the hardware wallet, that was kidnapped him and his wife, and they were brutalized.
00:07:12.240 --> 00:07:18.000
Apparently, I think he may have had his finger chopped off before the French counter-terrorist police found him.
00:07:18.160 --> 00:07:19.120
So this is happening.
00:07:19.199 --> 00:07:24.240
This is rife inside of this world, and that's why this data is very valuable.
00:07:24.319 --> 00:07:28.639
And it might not be the hacking group, I am not a villain, that are planning on robbing these people.
00:07:28.800 --> 00:07:30.319
I'm not suggesting that for a moment.
00:07:30.480 --> 00:07:35.839
They might sell this information to the highest bidder who then, like a nefarious actor who then wants to go and rob them.
00:07:35.920 --> 00:07:36.240
Yeah.
00:07:36.480 --> 00:07:41.279
So can you I hope the severity of this incident is coming along, coming across here.
00:07:41.439 --> 00:07:44.319
The cleverness, I think, of it is also very important.
00:07:44.480 --> 00:07:49.839
I don't want to gratify illegal behavior by saying it was so smart and so innovative.
00:07:49.920 --> 00:07:52.160
And I think there's a lot of stupidity behind this.
00:07:52.319 --> 00:07:58.560
But the fact they were able to gain access to these accounts, send these requests, and Revolute were complicit.
00:07:58.639 --> 00:08:00.160
They just happily just passed them across.
00:08:00.240 --> 00:08:09.120
In one case, Jan, they sent an email, the hackers from this Italian account, incorrectly formatted the document, requested the wrong information, or the way they phrased it.
00:08:09.360 --> 00:08:14.399
And I can put it on the screen, it's in Italian, but Revolute responded in Italian and said, Hey, this is wrong.
00:08:14.560 --> 00:08:15.439
You need to change this.
00:08:15.519 --> 00:08:16.879
And I've I've had it translated.
00:08:16.959 --> 00:08:22.959
They essentially just told them, hey, you need to do this differently and then re-request and we'll send you the information you want.
00:08:23.360 --> 00:08:31.600
So at the same time, they are just willingly handing over this data without double-checking it.
00:08:31.680 --> 00:08:36.559
Because I think if someone makes a mistake like that, yeah, and you think, okay, there seems something wrong with this.
00:08:36.720 --> 00:08:37.679
They've made a mistake.
00:08:37.759 --> 00:08:39.279
Maybe we should investigate this now.
00:08:39.519 --> 00:08:42.000
Yeah, Johnny, let me let me quickly interject here.
00:08:42.080 --> 00:08:43.279
I mean, I totally get your point.
00:08:43.600 --> 00:08:46.879
This was um yeah, not right what Revolute did here.
00:08:46.960 --> 00:09:02.000
Obviously, um not supposed to hand out customer data to um malicious groups, but speaking in their defense, if an official government email emails you or emails any bank, I'm sure this would get some sort of attention within that entity, right?
00:09:02.159 --> 00:09:03.679
And um we should start at the beginning.
00:09:03.759 --> 00:09:07.360
How did they get access to this email in the first place when looking for someone to blame?
00:09:07.519 --> 00:09:19.200
Um obviously Revolute is also to blame because they actually handed over the data, but um, I think the the Italian, um, the Italian Ministry of Interior, you know, losing access of that email address.
00:09:19.440 --> 00:09:20.559
That's the start of it, right?
00:09:20.639 --> 00:09:23.519
So they're as much asked for it as Revolute, in my opinion.
00:09:23.840 --> 00:09:25.840
I believe it was obtained through an info stealer.
00:09:25.919 --> 00:09:37.120
So, like there was some malicious software on a computer somewhere that stole and scraped a number of passwords that were then it was established that these passwords belong to these accounts and then they were sold online.
00:09:37.279 --> 00:09:46.320
According to Hudson Rock, which is like an Israeli cybersecurity firm, there's like 300 at one point of these Italian Ministry of Interior email accounts available to buy.
00:09:46.559 --> 00:09:48.159
I mean, that is unbelievable.
00:09:48.240 --> 00:09:51.039
And how they weren't aware that these were even available in the first place.
00:09:51.120 --> 00:10:04.720
You know, they're not they're not scanning for these things, they're not looking out for these things, they're not aware that they've had like a breach, and just so brazen as well, just to get into the accounts and whenever an email came in, just deleting it immediately and then just continuing on.
00:10:04.879 --> 00:10:16.159
I really want to hear from people in the comments section because there is a big part of me that that says at some point we have to have a real conversation about the data that we're handing over to banks and how it's been stored.
00:10:16.240 --> 00:10:21.360
And possibly there needs to be some type of third-party, hyper-secure method of storing our data.
00:10:21.519 --> 00:10:30.159
It's not stored with the banks, it's stored with an independent authority that's located on Mars, so it's in pr it so it cannot be accessed.
00:10:30.240 --> 00:10:31.519
I don't know, that sounds ridiculous.
00:10:31.759 --> 00:10:37.440
But I'd like to hear from people about this one because our KYC data, it's very valuable and it's very dangerous.
00:10:37.600 --> 00:10:41.360
And I personally can relate to this, Jan, because I have been a victim of this as well.
00:10:41.600 --> 00:10:41.759
Right.
00:10:42.000 --> 00:10:54.559
I have an email from Revolut to tell me that Drive Wealth, the brokerage firm that I was essentially signed up to when I signed up for trading equities, US equities with Revolut, I think back in 2023, were breached.
00:10:54.720 --> 00:11:05.759
And that includes my name, my postal address, my occupation, my the aggregate value yan of my trading account.
00:11:06.399 --> 00:11:07.919
So hey, let's just say that.
00:11:09.279 --> 00:11:10.000
Yeah, that's the same thing.
00:11:10.320 --> 00:11:10.960
I know exactly.
00:11:11.279 --> 00:11:13.360
Imagine you if you were really wealthy, Johnny.
00:11:13.440 --> 00:11:20.559
I mean, I know for a fact you're not, um, but if you were just kidding, if you were really wealthy, um it's the same thing, right?
00:11:20.720 --> 00:11:24.639
Um now there's data about where you live somewhere available.
00:11:24.799 --> 00:11:25.919
What a disaster.
00:11:26.159 --> 00:11:33.039
Um it's it's yeah, someone with mean and ten could buy the data and uh yeah, harm the person.
00:11:33.200 --> 00:11:38.399
I mean it's an it's a data breach of equal um severity, weight.
00:11:38.720 --> 00:11:40.639
It's a data breach of equal severity.
00:11:40.799 --> 00:11:41.840
Yeah, you're right.
00:11:42.320 --> 00:11:55.759
May may maybe though I I mean I'm gonna sleep fine tonight as a result of this, but I think these people with the crypto wealth, because of what's been going on in the in the in the crypto world, these wrench attacks, I think these people won't sleep as well at night.
00:11:55.919 --> 00:11:57.519
And they might have hardware wallets at home.
00:11:57.759 --> 00:12:02.320
Yes, you can see how much my equities account is worth, but that doesn't mean I have any value in my house at all.
00:12:02.480 --> 00:12:06.240
And again, Revolut's response to me, hey, we're not responsible.
00:12:06.559 --> 00:12:10.480
They basically just said, hey, this is a drive wealth issue, you've got to take it up with them.
00:12:10.879 --> 00:12:14.960
Interestingly though, Jan, I did ask them to write me an email.
00:12:15.120 --> 00:12:18.080
And Revolut's chatbot, weirdly, does anyone have any experience with this?
00:12:18.159 --> 00:12:19.759
It kind of acts like ChatGPT.
00:12:20.000 --> 00:12:21.919
Probably it's powered by ChatGPT or Claude.
00:12:22.159 --> 00:12:23.759
Possibly, and it gave me an email address.
00:12:23.840 --> 00:12:27.440
It drafted an email for me to send to them, which by the way, they haven't replied yet.
00:12:27.519 --> 00:12:28.559
It's been a while.
00:12:28.720 --> 00:12:30.799
Uh, seven days, I'm still waiting.
00:12:30.960 --> 00:12:34.799
It requested whether my full or partial account numbers were included.
00:12:35.039 --> 00:12:37.360
And this is what's most interesting, Jan.
00:12:37.519 --> 00:12:48.879
Third point, what measures DriveWealth is offering affected customers, such as credit monitoring or identity protection services, and whether any compensation is available for costs I may incur.
00:12:48.960 --> 00:12:54.960
So, this partner of Revolut, you know, DriveWealth, Revolut in itself are trying to throw them under the bus, aren't they?
00:12:55.120 --> 00:12:56.480
Yeah, it's a good way to phrase it.
00:12:56.559 --> 00:12:58.399
They are throwing them under the bus.
00:12:58.720 --> 00:13:00.799
They picked them as a as a partner in the first place.
00:13:00.879 --> 00:13:05.519
So, in my opinion, at least from my perspective, um they're equally at fault here.
00:13:05.759 --> 00:13:07.759
Why do they get to abscond responsibility?
00:13:07.919 --> 00:13:09.840
I I don't get that as well.
00:13:10.080 --> 00:13:11.759
Like, why are they not culpable?
00:13:12.000 --> 00:13:13.360
They they partnered with them.
00:13:13.600 --> 00:13:17.200
Did you know about DriveWorth in the first place before before this data breach?
00:13:17.279 --> 00:13:18.399
You probably never heard it the name.
00:13:18.799 --> 00:13:19.039
Exactly.
00:13:19.200 --> 00:13:23.200
Embarrassingly, no, I haven't been curious to hear from people in the comments if you were affected by this.
00:13:23.519 --> 00:13:26.000
But no one, no one had any idea who DriveWealth was.
00:13:26.240 --> 00:13:30.960
There's a terms, you know, of course, and it would have been clear to me if I'd have read the terms, I'm sure.
00:13:31.200 --> 00:13:31.519
Yeah, right.
00:13:31.840 --> 00:13:32.879
That's what I'm saying, Jan.
00:13:32.960 --> 00:13:36.960
Like, I I don't remember partnering with Drive Wealth or agreeing to this.
00:13:37.039 --> 00:13:41.200
I I I partnered with Revolut to help me trade stocks and shares, but they're not responsible.
00:13:41.440 --> 00:13:42.320
Yeah, that's not right, Johnny.
00:13:42.480 --> 00:13:42.879
That's not right.
00:13:42.960 --> 00:13:48.960
And I think I have a feeling that these large corporations, they're not really prioritizing data safety as much as they should be, right?
00:13:49.039 --> 00:13:51.600
Especially nowadays where where data is so important.
00:13:51.759 --> 00:13:54.799
Um why are there not more severe fines?
00:13:55.039 --> 00:13:58.879
I believe the maximum fine they could be getting is 20 million euros, if I'm not wrong.
00:13:59.120 --> 00:14:01.360
I think that might be the GDPR ceiling.
00:14:01.440 --> 00:14:02.399
Yeah, I think so.
00:14:02.559 --> 00:14:03.200
I think so.
00:14:03.440 --> 00:14:03.840
Right.
00:14:04.159 --> 00:14:06.159
Um, or 4% of total revenue.
00:14:06.240 --> 00:14:08.480
So for Revolution that yeah, it's 20 million euros.
00:14:08.879 --> 00:14:09.919
Dent in a balance sheet.
00:14:10.000 --> 00:14:11.360
There's nothing, literally nothing.
00:14:11.600 --> 00:14:14.480
I suppose there is a brand equity perspective here.
00:14:14.559 --> 00:14:16.240
Like, what is the damage to the brand?
00:14:16.399 --> 00:14:20.720
I know that doesn't really make a huge dent in any sort of cost because they're so significant.
00:14:20.879 --> 00:14:23.440
But do you think people are put off by this as a result?
00:14:23.600 --> 00:14:25.440
Like, get in the comments, let us know.
00:14:25.600 --> 00:14:26.799
Like, how does this make you feel about it?
00:14:26.960 --> 00:14:29.440
It's not like it's the first time this has happened to Revolut either.
00:14:29.600 --> 00:14:32.000
I wish it doesn't seem to make a difference, does it?
00:14:32.159 --> 00:14:36.399
I wish this would repel people, but I don't think it's going to repel anyone.
00:14:36.480 --> 00:14:40.399
I think people will just forget about this, just as they have with any other data breach in the past.
00:14:40.559 --> 00:14:46.320
This is something that's occurring so regularly nowadays that it's it's not even making news.
00:14:46.480 --> 00:14:52.960
And I think if if we check on YouTube, I I'm not even sure if there are many other videos talking about this incident.
00:14:53.120 --> 00:14:57.440
Um, although it has been, I mean, it's been fascinating, right?
00:14:57.519 --> 00:14:58.960
So there's certainly something to report.
00:14:59.279 --> 00:15:01.120
You would think that there's a public interest in this.
00:15:01.200 --> 00:15:04.000
Um, I just found a few newspaper articles, but that's pretty much it.
00:15:04.080 --> 00:15:09.440
And then then, like five days afterwards, after there was in the news, it was done, right?
00:15:09.519 --> 00:15:10.240
People forgot about it.
00:15:11.279 --> 00:15:12.080
Next topic.
00:15:12.399 --> 00:15:19.759
Some AI chatbot hacking, some other large corporation, you know, some some rogue AI um going crazy.
00:15:19.840 --> 00:15:22.559
It's just feels like this is data.
00:15:23.600 --> 00:15:29.679
Until there is a victim, until there is a victim, Yan, and someone is harmed as a result of this, someone is kidnapped.
00:15:30.320 --> 00:15:32.240
You know, that's when it gets back into the news.
00:15:32.399 --> 00:15:38.879
But then again, at the same time, I don't I don't think Revolute are gonna come out and you know take responsibility for it.
00:15:39.039 --> 00:15:41.360
They've not taken responsibility at this point.
00:15:41.519 --> 00:15:43.600
Um, you know, they've they've confirmed something's happened.
00:15:44.000 --> 00:15:44.320
Isn't it?
00:15:44.480 --> 00:15:47.919
I mean, it's it's kind of making me angry as well.
00:15:48.080 --> 00:15:54.240
It's not it's not the fact that they lose the data in the first place, it's the fact that they they react like that, you know, like they couldn't care less.
00:15:54.480 --> 00:15:54.960
Ooh.
00:15:55.600 --> 00:15:56.159
Puts me off.
00:15:56.559 --> 00:15:58.960
Let's be real, it's something that they don't want to talk about.
00:15:59.039 --> 00:16:00.720
They want to talk about it as little as possible.
00:16:00.879 --> 00:16:06.559
They want to brush it under the carpet, and at the same time, you know, they want to roll out new products, new features.
00:16:06.639 --> 00:16:15.600
They don't want anything to stain or interrupt or get in the way of their rapid, fast growth, which is arguably potentially one of the reasons why this is happening in the first place.
00:16:15.759 --> 00:16:28.879
You know, there is certainly an argument for why we're allowing fintech or we're allowing any organization to act hard and fast, you know, with with our data as a you know, and while they grow as quickly as possible to maximize revenue and profit.
00:16:29.039 --> 00:16:34.480
But at the same time, yeah, that this has all been going on, Jan, while they while they launch pay.
00:16:34.639 --> 00:16:37.360
I keep wanting to call it pay by smile, but it's not, is it?
00:16:37.440 --> 00:16:41.440
It's pay with smile, which I think is an awful name.
00:16:41.600 --> 00:16:43.039
I don't know what you make of this.
00:16:43.279 --> 00:16:44.879
I think it's ridiculous, you know.
00:16:45.039 --> 00:16:49.679
Um definitely could have could have thought of a better name, but the timing, that's even more ridiculous.
00:16:49.919 --> 00:17:01.919
The timing is just, I mean, could not have imagined any worse timing that there's two data breaches in a month, and that's the same month they're launching this feature that lets you pay with your biometric data.
00:17:02.159 --> 00:17:04.960
Okay, so we should explain what pay with smile is for those that aren't aware.
00:17:05.119 --> 00:17:16.799
If you went into, I think it was Kiss the Hippo, it's a coffee chain in London, there were three chains that were selected for this across a two-day period where they had a Revolute terminal where you pay and you could look at the terminal to process the payment.
00:17:16.880 --> 00:17:24.240
But I believe you had to scan a QR code to accept that you were gonna do the payment in the first place, choose it as an option, so it's quite convoluted.
00:17:24.319 --> 00:17:29.440
It might not be like that in the future, but for this one it was a bit convoluted, and then you would look into the terminal and pay.
00:17:29.599 --> 00:17:38.240
I don't believe it's like um using telemetry data or trying to um extract as much data about you as possible from your face.
00:17:38.400 --> 00:17:41.599
The merchant doesn't store any of it either, Yan, it's gone immediately.
00:17:41.759 --> 00:17:45.680
Revolute will, however, I believe, according to the privacy policy, at least be storing that data.
00:17:45.839 --> 00:17:53.440
I guess some people would argue, mate, you know, this could, once they iron out a few things, could be a quicker way to pay for smaller purchases, just grab your coffee and go.
00:17:53.680 --> 00:17:55.839
It feels kind of unnecessary to me personally.
00:17:55.920 --> 00:17:57.519
You know, I'm happy paying with my phone.
00:17:57.680 --> 00:18:01.119
It's it's never been something that uh I found disturbing at all.
00:18:01.359 --> 00:18:08.799
You know, you when you have an iPhone, you just press the power button twice, I believe, Apple Pay opens up, or the home button, sorry, it's a home button on the side.
00:18:08.880 --> 00:18:16.079
You press it, press it twice, Apple Pay opens up, you look into the camera, and then you consciously tap your card against the card reader, right?
00:18:16.160 --> 00:18:19.519
You make a a conscious decision to pay at that moment.
00:18:19.680 --> 00:18:27.279
I don't like the idea of having to look into a into a camera, potentially smile, and then pay that way.
00:18:27.359 --> 00:18:30.799
You know, feels like there's there's something, yeah, not nothing conscious about that.
00:18:30.960 --> 00:18:33.599
You know, what if you accidentally look into the wrong direction?
00:18:33.759 --> 00:18:35.039
Oh, you've just paid.
00:18:35.279 --> 00:18:38.319
At least that's what I'm imagining from hearing this, these kind of details.
00:18:38.400 --> 00:18:40.000
It's it feels kind of kind of funny.
00:18:40.160 --> 00:18:45.200
Feels like something something useless I would not really want to use, feels like it comes out of a Black Mirror episode.
00:18:45.359 --> 00:18:45.920
It really does.
00:18:46.160 --> 00:18:48.799
And I don't think it's really meant to be for the customer.
00:18:48.880 --> 00:18:50.559
I don't think they're trying to innovate anything.
00:18:50.640 --> 00:18:52.799
I mean, it might appear like that, it might be dressed up like that.
00:18:52.880 --> 00:18:54.000
Please again get in the comments.
00:18:54.079 --> 00:18:55.440
Let us know if you think this is useful.
00:18:55.599 --> 00:18:58.400
But I don't really see the use case for it, and I can tell what this is.
00:18:58.799 --> 00:19:03.119
This is just an opportunity for Revolut to capture more merchants.
00:19:03.359 --> 00:19:09.519
You know, it might make payments faster, but they can offer this as a 0% acquisition.
00:19:09.599 --> 00:19:15.920
So if a merchant uses this payment method, they won't charge, Revolut won't charge them a fee for the transaction.
00:19:16.000 --> 00:19:20.640
Whereas, you know, if it's a card, for example, they might charge 1.5 or 2% per transaction.
00:19:20.799 --> 00:19:21.599
This will be free.
00:19:21.680 --> 00:19:23.440
So that'll get people to sign up for Revolut.
00:19:23.599 --> 00:19:35.920
That'll get people to pay the£350 plus VAT for their terminal to install it into their business, and then obviously Revolut can start to charge or or generate revenue from non-pay with smile transactions like cards, credit cards, etc.
00:19:36.079 --> 00:19:36.240
etc.
00:19:36.480 --> 00:19:41.039
So it's a it's a really clever way, Jan, to come up with something quite unique and innovative.
00:19:41.119 --> 00:19:47.920
So people talk about it, people like us, so like the sun reports on it, people go in there purposely just to use it, talk about it.
00:19:48.079 --> 00:19:59.279
That gets people in the merchant, that gets people in the business, that'll attract people to getting this product, and as a result, Revolute get their terminal inside these companies so they can generate revenue from those checkout conversions.
00:19:59.440 --> 00:20:01.599
And this is so this is not for the customer.
00:20:01.920 --> 00:20:07.759
So once they control the checkout, you you're suggesting that it would start implementing fees because it's then too difficult to switch back?
00:20:08.000 --> 00:20:13.119
They they might not start implementing fees on pay with smile, but they will immediately have fees on any other transaction.
00:20:13.359 --> 00:20:13.759
Fair enough.
00:20:13.839 --> 00:20:22.000
Um pay with smile would be 0%, but they'll immediately so they they just use pay with smile as a quirky way to get merchants to to buy into this idea.
00:20:22.160 --> 00:20:26.559
Because it you you you you can see why it could arguably be convenient, I would say it's not.
00:20:26.720 --> 00:20:32.960
But it it it's it's a merchant acquisition play, not like a customer innovation play, is what I'm trying to say.
00:20:33.119 --> 00:20:35.119
I want to try to see an upside though.
00:20:35.200 --> 00:20:38.880
I I I think it feels dystopian, I think it feels weird, but let's talk about what it could be.
00:20:39.119 --> 00:20:41.119
I mean, from a technical What was the upside here, Jan?
00:20:41.200 --> 00:20:41.920
Is there anything positive?
00:20:42.160 --> 00:20:46.400
Yeah, from a technological perspective, I think it's quite fascinating that this is possible nowadays, right?
00:20:46.559 --> 00:20:48.240
Think back two decades or so.
00:20:48.319 --> 00:20:53.839
You know, if you would have told that someone in 2020 uh 2006, they would have thought you were crazy, honestly.
00:20:54.160 --> 00:21:00.160
I I do agree that the technological innovation side of this is is is is fascinating and impressive.
00:21:00.319 --> 00:21:09.759
At the same time, it's creating more opportunities to gather data, which, again, we know now is far more valuable than the money in our wallets.
00:21:10.000 --> 00:21:12.559
So there's more value being put on this data.
00:21:12.640 --> 00:21:17.519
The more data that's collected, the more that's accessible, the more hackers can try to get hold of.
00:21:17.680 --> 00:21:20.400
It creates more and more risk for further data breaches.
00:21:20.559 --> 00:21:26.400
You know, if I'm paying with SMALE every time, I'm constantly sharing an updated selfie video of myself.
00:21:26.559 --> 00:21:32.960
So no longer is it the old dated one from like five years ago when I was a little less grey and a little less wrinkly.
00:21:33.200 --> 00:21:45.279
You get the latest image that you could then use if you were a nefarious actor to, if you are able to get hold of it at least, open an account, mimicking me, or maybe even work it out how you could use it to gain access to an account.
00:21:45.359 --> 00:21:45.759
I don't know.
00:21:46.000 --> 00:22:04.720
The bigger picture here for me is Jan that this innovation creates more value or it makes this KYC data, this data that we share with these banks, more valuable, more compelling, and this underbelly economy that goes on in the world of criminal organization just gets more opportunities to steal more things.
00:22:04.960 --> 00:22:09.440
Yeah, I wish people were more conscious about when they hand data over to large corporations.
00:22:09.519 --> 00:22:15.119
I wish they were more conscious about it, maybe um a bit skeptical, you know, here and there.
00:22:15.279 --> 00:22:16.640
And it's just unfortunate.
00:22:16.720 --> 00:22:21.039
Because data breaches nowadays, they're part of day-to-day lives, unfortunately.
00:22:21.200 --> 00:22:26.880
Um, and this, you know, might not change anytime soon, given how fast AI is developing.
00:22:27.039 --> 00:22:28.880
I don't think this will change anytime soon.
00:22:28.960 --> 00:22:31.839
I think this might even become more common, right?
00:22:32.079 --> 00:22:35.599
Because with the help of AI, you know, actual hacks could happen.
00:22:35.680 --> 00:22:37.359
Um, and more actual hacks could happen.
00:22:37.440 --> 00:22:39.359
It's it's much easier to hack something, I assume.
00:22:39.599 --> 00:22:43.200
Yeah, be skeptical when you when you hand over your data, you know, be be cautious about it.
00:22:43.519 --> 00:22:45.119
Skepticism is important, Jan.
00:22:45.200 --> 00:22:49.359
But what were you supposed to do if you just wanted to use Revolute to trade crypto?
00:22:49.599 --> 00:22:50.240
Yeah, can't do much.
00:22:53.200 --> 00:22:54.640
Like it could have happened to any platform.
00:22:54.720 --> 00:22:57.039
We should be in you know, should we should mention that, of course.
00:22:57.200 --> 00:22:59.839
You know, this can happen anywhere and it happens all the time.
00:23:00.240 --> 00:23:05.119
But you know, you you just basically, I think we're all just better off offline, aren't we?
00:23:05.279 --> 00:23:13.599
Just not using the internet, because essentially, like, you know, you your data is necessary to gain access to most things, most things are gated.
00:23:14.240 --> 00:23:16.240
And you know, what are you supposed to do?
00:23:16.480 --> 00:23:17.519
Yeah, what are you gonna do?
00:23:17.759 --> 00:23:19.599
Get in the comments, let us know your thoughts.
00:23:19.759 --> 00:23:24.799
Come join the Discord, we'll stick a QR code on the screen now if you want to come and further the conversation.
00:23:25.039 --> 00:23:31.680
I'd like to ask you, Johnny, are you intending to inform the Discord community as soon as a drivework response comes in?
00:23:31.839 --> 00:23:33.440
Is that where they will they will learn about it?
00:23:33.680 --> 00:23:34.160
Yeah, yeah, yeah.
00:23:34.240 --> 00:23:35.680
I'll keep everyone up to date on Discord.
00:23:35.759 --> 00:23:36.559
Yeah, that's a good point.
00:23:36.720 --> 00:23:37.920
I haven't had a response yet.
00:23:38.000 --> 00:23:40.799
I ha they have to respond, right, at some point, I would expect so.
00:23:40.960 --> 00:23:43.359
Otherwise I'll contact Revolute again and see what they have to say.
00:23:43.519 --> 00:23:43.839
Hopefully.
00:23:44.079 --> 00:23:46.319
Or I should say what the the the chat bot has to say.
00:23:46.559 --> 00:23:47.680
Try to escalate that a bit.
00:23:47.839 --> 00:23:48.640
Okay, thanks everyone.
00:23:48.799 --> 00:23:49.599
We'll see you in the next one.
00:00:00.000 --> 00:00:02.399
Okay, so Revolut just had the worst month in its history.
00:00:02.560 --> 00:00:10.240
So someone spent months pretending to be a government official and asked Revolute for its customers' most sensitive data, passports, selfies.
00:00:10.480 --> 00:00:14.560
They even asked who the owners of specific crypto wallets were and where they lived.
00:00:14.640 --> 00:00:15.919
And Revolut handed it over.
00:00:16.079 --> 00:00:20.399
But in their defense, as we'll discuss, this was a very convincing con.
00:00:20.480 --> 00:00:21.839
And it's not victimless either.
00:00:22.079 --> 00:00:25.760
Some of the people whose data was leaked now fear for their safety.
00:00:25.920 --> 00:00:28.480
One of them has moved their family into a hotel.
00:00:28.559 --> 00:00:31.519
And Revolute's response, nothing, really, just a shrug.
00:00:31.679 --> 00:00:38.399
You know, a short statement, their systems were unaffected, there were a limited number of customers affected, and their funds were untouched.
00:00:38.560 --> 00:00:44.799
Which might all be true, but it misses the point entirely because the hackers weren't after the funds in their Revolut accounts.
00:00:44.880 --> 00:00:46.719
They were after their personal information.
00:00:46.880 --> 00:00:49.679
So who they are, where they live, what they look like.
00:00:49.840 --> 00:00:58.399
And this stuff is becoming so common that only two weeks later, I got an email from Revolut telling me I'd been caught in a leak as well.
00:00:58.479 --> 00:01:03.359
So I contacted Revolute to ask what I was supposed to do about it, and I'll share their response shortly.
00:01:03.520 --> 00:01:06.400
So that's two customer data breaches in one month.
00:01:06.560 --> 00:01:13.200
And in the same month, Revolut also chose to launch Pay with Smile, where you pay for your coffee with your face.
00:01:13.359 --> 00:01:19.120
Now that raises a few obvious concerns, which we can get into, and as always, please get in the comments and let us know your thoughts.
00:01:19.200 --> 00:01:23.519
But first, Jan, we have to talk about this data breach and exactly how they pulled it off.
00:01:23.599 --> 00:01:32.159
Because Revolut is a company worth over a hundred billion dollars with a pending US banking license, and they were tricked by a stolen email account.
00:01:32.480 --> 00:01:36.000
Yeah, Johnny, reading through the story, I think it's it's kind of shocking.
00:01:36.079 --> 00:01:37.120
How can that even happen?
00:01:37.200 --> 00:01:39.040
Um, that's the first thing I asked myself.
00:01:39.120 --> 00:01:42.239
And I think they're it's maybe not purely their fault.
00:01:42.400 --> 00:01:48.640
Um the regulators for uh is as much if fault, in my opinion, um, due to the fact that they lost access to the email.
00:01:48.719 --> 00:01:50.480
We'll go into that detail in that detail later.
00:01:50.640 --> 00:01:52.159
What really angers me is their response.
00:01:52.319 --> 00:01:54.400
They really shrugged it off, basically.
00:01:54.560 --> 00:01:58.400
Um, didn't really admit much, just inform people that there was a data breach.
00:01:58.480 --> 00:02:02.799
And I think this is sad because this data breach has led to actual consequences.
00:02:02.879 --> 00:02:04.079
We know that for a fact.
00:02:04.239 --> 00:02:07.359
Um, and just feel sorry about the people affected in it.
00:02:07.519 --> 00:02:09.120
It's uh it's a disaster, actually.
00:02:09.439 --> 00:02:09.919
Yeah, yeah.
00:02:10.000 --> 00:02:18.080
So there is a certain level of incompetence here at play from both sides, not only Revolute, but also the Italian Ministry of Interior.
00:02:18.240 --> 00:02:24.240
They've had their account or their email address accessed by a party called I Am Not a Villain.
00:02:24.319 --> 00:02:27.919
This is like a hacking group, I believe, who have essentially bought access.
00:02:28.000 --> 00:02:30.000
And that's where the story begins, Jan.
00:02:30.159 --> 00:02:36.800
Inside this Italian email account, essentially, that's being used to contact Revolute.
00:02:36.960 --> 00:02:41.039
And this is an account that is also being used by the Ministry of Interior.
00:02:41.120 --> 00:02:42.560
It's also an active account.
00:02:42.719 --> 00:02:50.240
But the hackers are able to stay silent, stay hidden by deleting any correspondence that would be for them immediately when it's received.
00:02:50.319 --> 00:02:54.080
So they just download it as a.eml attachment and delete it.
00:02:54.240 --> 00:02:58.319
And then the the the authorities, the Italian authorities, are none the wiser.
00:02:58.479 --> 00:03:01.280
I actually hate to say this, but it's quite genius, really.
00:03:01.439 --> 00:03:06.400
You know, they they created like a recovery email address so if they lost access, they could get access again.
00:03:06.560 --> 00:03:11.520
This episode is sponsored by no one, really, just Jan and I and our website, depositscout.com.
00:03:11.680 --> 00:03:18.560
We built a savings comparison website basically because we couldn't find a website or a resource that we thought was good enough for what we wanted.
00:03:18.639 --> 00:03:22.240
Now we've built a database full of pretty much every account in the UK.
00:03:22.400 --> 00:03:29.120
We have easy access, fixed accounts, notice accounts, regular savers, even junior iters if you have children or if you're a grandparent.
00:03:29.280 --> 00:03:32.800
Some of my favorite features amongst many have to be the rate alerts.
00:03:32.879 --> 00:03:40.080
With Deposit Scout, you can track any account type that you want and we'll automatically email you if a new rate becomes available.
00:03:40.240 --> 00:03:42.000
We can also send you a weekly roundup.
00:03:42.080 --> 00:03:52.639
We send it out every Monday so you can see the latest accounts and you can track specific accounts if you're only interested in, say, fixing your money or keeping up with the latest and greatest easy access account.
00:03:52.800 --> 00:03:55.039
Jan, do you want to share a favorite feature as well?
00:03:55.280 --> 00:04:04.159
Johnny, I really love these account pages that we've set up because they provide a level of detail on each account that's available in our database that has uh yeah not been accessible before.
00:04:04.319 --> 00:04:22.319
So you can quickly look at an account, get an idea whether it's competitive or not compared to other accounts out there, and then also draw a conclusion from that, whether it's an account worth signing up for, or whether you should rather go with a different alternative, really makes the whole account choosing process more seamless, right?
00:04:22.399 --> 00:04:30.000
And at the end, I believe, I really do, that you end up with a better product, which can make a huge difference in terms of interest that you receive at the end of the year.
00:04:30.079 --> 00:04:32.319
Take a look at the website, it's something that Johnny and I have built.
00:04:32.399 --> 00:04:35.839
It is the best way to give back to the channel, to the podcast, and to us personally.
00:04:36.000 --> 00:04:38.000
Um, it's depositscout.com, everyone.
00:04:38.079 --> 00:04:39.759
We'll show a QR code on the screen.
00:04:39.920 --> 00:04:42.079
Feel free to sign up and let us know what you think about it.
00:04:42.399 --> 00:04:53.680
So they begin inside this official verified Italian email account and they start to send messages to Revolut, specifically the UAB, Revolut UAB Bank Entity.
00:04:53.839 --> 00:04:59.199
They send them forged documents that look like European investigation order documents.
00:04:59.360 --> 00:05:00.959
I'll put it on the screen for those who are watching.
00:05:01.120 --> 00:05:02.879
I think it looks pretty solid.
00:05:03.040 --> 00:05:10.480
They start to send these across and they're saying, hey, we've got these transaction IDs and we want to know who's responsible for them.
00:05:10.639 --> 00:05:17.600
And they start to send these forged documents to Revolut and they are requesting the profile of crypto transaction IDs, but these aren't random accounts or transactions.
00:05:17.680 --> 00:05:28.959
The attackers have already performed blockchain analysis to identify the richest wallets they could find, and it's the identities of those wallets, those transactions that they are trying to extract from Revolut.
00:05:29.199 --> 00:05:30.800
Crypto is meant to be anonymous.
00:05:30.879 --> 00:05:33.439
That was all what it was always about, you know, anonymity.
00:05:33.600 --> 00:05:36.800
And Revolut are just revealing the people behind these.
00:05:36.959 --> 00:05:43.040
This goes on for months, Yan, and they continue to give more and more data across to this email inbox.
00:05:43.279 --> 00:05:53.519
File after file, profile after profile, we're talking names, phone numbers, selfies so they can identify the people, addresses, which is important here.
00:05:53.680 --> 00:05:56.959
There's something in crypto, Yan called a wrench attack.
00:05:57.600 --> 00:06:08.079
It's where someone will attack someone physically, in person, in order to extract their seed phrase, their secret passwords, maybe get access to a hardware wallet.
00:06:08.240 --> 00:06:11.839
And that's what this information could be used to do.
00:06:12.000 --> 00:06:17.199
And these were celebrities, there's allegedly a tennis player called Chevchenko.
00:06:17.360 --> 00:06:23.360
We have the founder, CEO of an online gambling company called Felix Roma.
00:06:24.160 --> 00:06:26.879
He's been quite outspoken about this on Twitter.
00:06:27.120 --> 00:06:30.160
Um he has been potentially extorted.
00:06:30.240 --> 00:06:40.959
I don't think he has necessarily paid up, but they are trying to extort him, or people are trying to extort him by saying, hey, if you don't pay or if you don't act on this, we will expose your data online, which is quite frightening.
00:06:41.120 --> 00:06:44.240
There's another guy called, I believe, Mark Carpellis.
00:06:44.399 --> 00:06:49.040
He was like the CEO of a Bitcoin exchange and um obviously has some wealth.
00:06:49.199 --> 00:06:51.519
You would assume he would have a large crypto holding.
00:06:51.839 --> 00:06:56.319
He was targeted, he was the person that's had to move out of his home and into a hotel.
00:06:56.399 --> 00:06:57.920
And I mean, this is something, Jan.
00:06:58.000 --> 00:06:59.759
It's important to know for context.
00:07:00.000 --> 00:07:05.279
Kidnapping is becoming rife inside of the Bitcoin world, so to speak.
00:07:05.519 --> 00:07:12.079
There was the founder of Ledger, the hardware wallet, that was kidnapped him and his wife, and they were brutalized.
00:07:12.240 --> 00:07:18.000
Apparently, I think he may have had his finger chopped off before the French counter-terrorist police found him.
00:07:18.160 --> 00:07:19.120
So this is happening.
00:07:19.199 --> 00:07:24.240
This is rife inside of this world, and that's why this data is very valuable.
00:07:24.319 --> 00:07:28.639
And it might not be the hacking group, I am not a villain, that are planning on robbing these people.
00:07:28.800 --> 00:07:30.319
I'm not suggesting that for a moment.
00:07:30.480 --> 00:07:35.839
They might sell this information to the highest bidder who then, like a nefarious actor who then wants to go and rob them.
00:07:35.920 --> 00:07:36.240
Yeah.
00:07:36.480 --> 00:07:41.279
So can you I hope the severity of this incident is coming along, coming across here.
00:07:41.439 --> 00:07:44.319
The cleverness, I think, of it is also very important.
00:07:44.480 --> 00:07:49.839
I don't want to gratify illegal behavior by saying it was so smart and so innovative.
00:07:49.920 --> 00:07:52.160
And I think there's a lot of stupidity behind this.
00:07:52.319 --> 00:07:58.560
But the fact they were able to gain access to these accounts, send these requests, and Revolute were complicit.
00:07:58.639 --> 00:08:00.160
They just happily just passed them across.
00:08:00.240 --> 00:08:09.120
In one case, Jan, they sent an email, the hackers from this Italian account, incorrectly formatted the document, requested the wrong information, or the way they phrased it.
00:08:09.360 --> 00:08:14.399
And I can put it on the screen, it's in Italian, but Revolute responded in Italian and said, Hey, this is wrong.
00:08:14.560 --> 00:08:15.439
You need to change this.
00:08:15.519 --> 00:08:16.879
And I've I've had it translated.
00:08:16.959 --> 00:08:22.959
They essentially just told them, hey, you need to do this differently and then re-request and we'll send you the information you want.
00:08:23.360 --> 00:08:31.600
So at the same time, they are just willingly handing over this data without double-checking it.
00:08:31.680 --> 00:08:36.559
Because I think if someone makes a mistake like that, yeah, and you think, okay, there seems something wrong with this.
00:08:36.720 --> 00:08:37.679
They've made a mistake.
00:08:37.759 --> 00:08:39.279
Maybe we should investigate this now.
00:08:39.519 --> 00:08:42.000
Yeah, Johnny, let me let me quickly interject here.
00:08:42.080 --> 00:08:43.279
I mean, I totally get your point.
00:08:43.600 --> 00:08:46.879
This was um yeah, not right what Revolute did here.
00:08:46.960 --> 00:09:02.000
Obviously, um not supposed to hand out customer data to um malicious groups, but speaking in their defense, if an official government email emails you or emails any bank, I'm sure this would get some sort of attention within that entity, right?
00:09:02.159 --> 00:09:03.679
And um we should start at the beginning.
00:09:03.759 --> 00:09:07.360
How did they get access to this email in the first place when looking for someone to blame?
00:09:07.519 --> 00:09:19.200
Um obviously Revolute is also to blame because they actually handed over the data, but um, I think the the Italian, um, the Italian Ministry of Interior, you know, losing access of that email address.
00:09:19.440 --> 00:09:20.559
That's the start of it, right?
00:09:20.639 --> 00:09:23.519
So they're as much asked for it as Revolute, in my opinion.
00:09:23.840 --> 00:09:25.840
I believe it was obtained through an info stealer.
00:09:25.919 --> 00:09:37.120
So, like there was some malicious software on a computer somewhere that stole and scraped a number of passwords that were then it was established that these passwords belong to these accounts and then they were sold online.
00:09:37.279 --> 00:09:46.320
According to Hudson Rock, which is like an Israeli cybersecurity firm, there's like 300 at one point of these Italian Ministry of Interior email accounts available to buy.
00:09:46.559 --> 00:09:48.159
I mean, that is unbelievable.
00:09:48.240 --> 00:09:51.039
And how they weren't aware that these were even available in the first place.
00:09:51.120 --> 00:10:04.720
You know, they're not they're not scanning for these things, they're not looking out for these things, they're not aware that they've had like a breach, and just so brazen as well, just to get into the accounts and whenever an email came in, just deleting it immediately and then just continuing on.
00:10:04.879 --> 00:10:16.159
I really want to hear from people in the comments section because there is a big part of me that that says at some point we have to have a real conversation about the data that we're handing over to banks and how it's been stored.
00:10:16.240 --> 00:10:21.360
And possibly there needs to be some type of third-party, hyper-secure method of storing our data.
00:10:21.519 --> 00:10:30.159
It's not stored with the banks, it's stored with an independent authority that's located on Mars, so it's in pr it so it cannot be accessed.
00:10:30.240 --> 00:10:31.519
I don't know, that sounds ridiculous.
00:10:31.759 --> 00:10:37.440
But I'd like to hear from people about this one because our KYC data, it's very valuable and it's very dangerous.
00:10:37.600 --> 00:10:41.360
And I personally can relate to this, Jan, because I have been a victim of this as well.
00:10:41.600 --> 00:10:41.759
Right.
00:10:42.000 --> 00:10:54.559
I have an email from Revolut to tell me that Drive Wealth, the brokerage firm that I was essentially signed up to when I signed up for trading equities, US equities with Revolut, I think back in 2023, were breached.
00:10:54.720 --> 00:11:05.759
And that includes my name, my postal address, my occupation, my the aggregate value yan of my trading account.
00:11:06.399 --> 00:11:07.919
So hey, let's just say that.
00:11:09.279 --> 00:11:10.000
Yeah, that's the same thing.
00:11:10.320 --> 00:11:10.960
I know exactly.
00:11:11.279 --> 00:11:13.360
Imagine you if you were really wealthy, Johnny.
00:11:13.440 --> 00:11:20.559
I mean, I know for a fact you're not, um, but if you were just kidding, if you were really wealthy, um it's the same thing, right?
00:11:20.720 --> 00:11:24.639
Um now there's data about where you live somewhere available.
00:11:24.799 --> 00:11:25.919
What a disaster.
00:11:26.159 --> 00:11:33.039
Um it's it's yeah, someone with mean and ten could buy the data and uh yeah, harm the person.
00:11:33.200 --> 00:11:38.399
I mean it's an it's a data breach of equal um severity, weight.
00:11:38.720 --> 00:11:40.639
It's a data breach of equal severity.
00:11:40.799 --> 00:11:41.840
Yeah, you're right.
00:11:42.320 --> 00:11:55.759
May may maybe though I I mean I'm gonna sleep fine tonight as a result of this, but I think these people with the crypto wealth, because of what's been going on in the in the in the crypto world, these wrench attacks, I think these people won't sleep as well at night.
00:11:55.919 --> 00:11:57.519
And they might have hardware wallets at home.
00:11:57.759 --> 00:12:02.320
Yes, you can see how much my equities account is worth, but that doesn't mean I have any value in my house at all.
00:12:02.480 --> 00:12:06.240
And again, Revolut's response to me, hey, we're not responsible.
00:12:06.559 --> 00:12:10.480
They basically just said, hey, this is a drive wealth issue, you've got to take it up with them.
00:12:10.879 --> 00:12:14.960
Interestingly though, Jan, I did ask them to write me an email.
00:12:15.120 --> 00:12:18.080
And Revolut's chatbot, weirdly, does anyone have any experience with this?
00:12:18.159 --> 00:12:19.759
It kind of acts like ChatGPT.
00:12:20.000 --> 00:12:21.919
Probably it's powered by ChatGPT or Claude.
00:12:22.159 --> 00:12:23.759
Possibly, and it gave me an email address.
00:12:23.840 --> 00:12:27.440
It drafted an email for me to send to them, which by the way, they haven't replied yet.
00:12:27.519 --> 00:12:28.559
It's been a while.
00:12:28.720 --> 00:12:30.799
Uh, seven days, I'm still waiting.
00:12:30.960 --> 00:12:34.799
It requested whether my full or partial account numbers were included.
00:12:35.039 --> 00:12:37.360
And this is what's most interesting, Jan.
00:12:37.519 --> 00:12:48.879
Third point, what measures DriveWealth is offering affected customers, such as credit monitoring or identity protection services, and whether any compensation is available for costs I may incur.
00:12:48.960 --> 00:12:54.960
So, this partner of Revolut, you know, DriveWealth, Revolut in itself are trying to throw them under the bus, aren't they?
00:12:55.120 --> 00:12:56.480
Yeah, it's a good way to phrase it.
00:12:56.559 --> 00:12:58.399
They are throwing them under the bus.
00:12:58.720 --> 00:13:00.799
They picked them as a as a partner in the first place.
00:13:00.879 --> 00:13:05.519
So, in my opinion, at least from my perspective, um they're equally at fault here.
00:13:05.759 --> 00:13:07.759
Why do they get to abscond responsibility?
00:13:07.919 --> 00:13:09.840
I I don't get that as well.
00:13:10.080 --> 00:13:11.759
Like, why are they not culpable?
00:13:12.000 --> 00:13:13.360
They they partnered with them.
00:13:13.600 --> 00:13:17.200
Did you know about DriveWorth in the first place before before this data breach?
00:13:17.279 --> 00:13:18.399
You probably never heard it the name.
00:13:18.799 --> 00:13:19.039
Exactly.
00:13:19.200 --> 00:13:23.200
Embarrassingly, no, I haven't been curious to hear from people in the comments if you were affected by this.
00:13:23.519 --> 00:13:26.000
But no one, no one had any idea who DriveWealth was.
00:13:26.240 --> 00:13:30.960
There's a terms, you know, of course, and it would have been clear to me if I'd have read the terms, I'm sure.
00:13:31.200 --> 00:13:31.519
Yeah, right.
00:13:31.840 --> 00:13:32.879
That's what I'm saying, Jan.
00:13:32.960 --> 00:13:36.960
Like, I I don't remember partnering with Drive Wealth or agreeing to this.
00:13:37.039 --> 00:13:41.200
I I I partnered with Revolut to help me trade stocks and shares, but they're not responsible.
00:13:41.440 --> 00:13:42.320
Yeah, that's not right, Johnny.
00:13:42.480 --> 00:13:42.879
That's not right.
00:13:42.960 --> 00:13:48.960
And I think I have a feeling that these large corporations, they're not really prioritizing data safety as much as they should be, right?
00:13:49.039 --> 00:13:51.600
Especially nowadays where where data is so important.
00:13:51.759 --> 00:13:54.799
Um why are there not more severe fines?
00:13:55.039 --> 00:13:58.879
I believe the maximum fine they could be getting is 20 million euros, if I'm not wrong.
00:13:59.120 --> 00:14:01.360
I think that might be the GDPR ceiling.
00:14:01.440 --> 00:14:02.399
Yeah, I think so.
00:14:02.559 --> 00:14:03.200
I think so.
00:14:03.440 --> 00:14:03.840
Right.
00:14:04.159 --> 00:14:06.159
Um, or 4% of total revenue.
00:14:06.240 --> 00:14:08.480
So for Revolution that yeah, it's 20 million euros.
00:14:08.879 --> 00:14:09.919
Dent in a balance sheet.
00:14:10.000 --> 00:14:11.360
There's nothing, literally nothing.
00:14:11.600 --> 00:14:14.480
I suppose there is a brand equity perspective here.
00:14:14.559 --> 00:14:16.240
Like, what is the damage to the brand?
00:14:16.399 --> 00:14:20.720
I know that doesn't really make a huge dent in any sort of cost because they're so significant.
00:14:20.879 --> 00:14:23.440
But do you think people are put off by this as a result?
00:14:23.600 --> 00:14:25.440
Like, get in the comments, let us know.
00:14:25.600 --> 00:14:26.799
Like, how does this make you feel about it?
00:14:26.960 --> 00:14:29.440
It's not like it's the first time this has happened to Revolut either.
00:14:29.600 --> 00:14:32.000
I wish it doesn't seem to make a difference, does it?
00:14:32.159 --> 00:14:36.399
I wish this would repel people, but I don't think it's going to repel anyone.
00:14:36.480 --> 00:14:40.399
I think people will just forget about this, just as they have with any other data breach in the past.
00:14:40.559 --> 00:14:46.320
This is something that's occurring so regularly nowadays that it's it's not even making news.
00:14:46.480 --> 00:14:52.960
And I think if if we check on YouTube, I I'm not even sure if there are many other videos talking about this incident.
00:14:53.120 --> 00:14:57.440
Um, although it has been, I mean, it's been fascinating, right?
00:14:57.519 --> 00:14:58.960
So there's certainly something to report.
00:14:59.279 --> 00:15:01.120
You would think that there's a public interest in this.
00:15:01.200 --> 00:15:04.000
Um, I just found a few newspaper articles, but that's pretty much it.
00:15:04.080 --> 00:15:09.440
And then then, like five days afterwards, after there was in the news, it was done, right?
00:15:09.519 --> 00:15:10.240
People forgot about it.
00:15:11.279 --> 00:15:12.080
Next topic.
00:15:12.399 --> 00:15:19.759
Some AI chatbot hacking, some other large corporation, you know, some some rogue AI um going crazy.
00:15:19.840 --> 00:15:22.559
It's just feels like this is data.
00:15:23.600 --> 00:15:29.679
Until there is a victim, until there is a victim, Yan, and someone is harmed as a result of this, someone is kidnapped.
00:15:30.320 --> 00:15:32.240
You know, that's when it gets back into the news.
00:15:32.399 --> 00:15:38.879
But then again, at the same time, I don't I don't think Revolute are gonna come out and you know take responsibility for it.
00:15:39.039 --> 00:15:41.360
They've not taken responsibility at this point.
00:15:41.519 --> 00:15:43.600
Um, you know, they've they've confirmed something's happened.
00:15:44.000 --> 00:15:44.320
Isn't it?
00:15:44.480 --> 00:15:47.919
I mean, it's it's kind of making me angry as well.
00:15:48.080 --> 00:15:54.240
It's not it's not the fact that they lose the data in the first place, it's the fact that they they react like that, you know, like they couldn't care less.
00:15:54.480 --> 00:15:54.960
Ooh.
00:15:55.600 --> 00:15:56.159
Puts me off.
00:15:56.559 --> 00:15:58.960
Let's be real, it's something that they don't want to talk about.
00:15:59.039 --> 00:16:00.720
They want to talk about it as little as possible.
00:16:00.879 --> 00:16:06.559
They want to brush it under the carpet, and at the same time, you know, they want to roll out new products, new features.
00:16:06.639 --> 00:16:15.600
They don't want anything to stain or interrupt or get in the way of their rapid, fast growth, which is arguably potentially one of the reasons why this is happening in the first place.
00:16:15.759 --> 00:16:28.879
You know, there is certainly an argument for why we're allowing fintech or we're allowing any organization to act hard and fast, you know, with with our data as a you know, and while they grow as quickly as possible to maximize revenue and profit.
00:16:29.039 --> 00:16:34.480
But at the same time, yeah, that this has all been going on, Jan, while they while they launch pay.
00:16:34.639 --> 00:16:37.360
I keep wanting to call it pay by smile, but it's not, is it?
00:16:37.440 --> 00:16:41.440
It's pay with smile, which I think is an awful name.
00:16:41.600 --> 00:16:43.039
I don't know what you make of this.
00:16:43.279 --> 00:16:44.879
I think it's ridiculous, you know.
00:16:45.039 --> 00:16:49.679
Um definitely could have could have thought of a better name, but the timing, that's even more ridiculous.
00:16:49.919 --> 00:17:01.919
The timing is just, I mean, could not have imagined any worse timing that there's two data breaches in a month, and that's the same month they're launching this feature that lets you pay with your biometric data.
00:17:02.159 --> 00:17:04.960
Okay, so we should explain what pay with smile is for those that aren't aware.
00:17:05.119 --> 00:17:16.799
If you went into, I think it was Kiss the Hippo, it's a coffee chain in London, there were three chains that were selected for this across a two-day period where they had a Revolute terminal where you pay and you could look at the terminal to process the payment.
00:17:16.880 --> 00:17:24.240
But I believe you had to scan a QR code to accept that you were gonna do the payment in the first place, choose it as an option, so it's quite convoluted.
00:17:24.319 --> 00:17:29.440
It might not be like that in the future, but for this one it was a bit convoluted, and then you would look into the terminal and pay.
00:17:29.599 --> 00:17:38.240
I don't believe it's like um using telemetry data or trying to um extract as much data about you as possible from your face.
00:17:38.400 --> 00:17:41.599
The merchant doesn't store any of it either, Yan, it's gone immediately.
00:17:41.759 --> 00:17:45.680
Revolute will, however, I believe, according to the privacy policy, at least be storing that data.
00:17:45.839 --> 00:17:53.440
I guess some people would argue, mate, you know, this could, once they iron out a few things, could be a quicker way to pay for smaller purchases, just grab your coffee and go.
00:17:53.680 --> 00:17:55.839
It feels kind of unnecessary to me personally.
00:17:55.920 --> 00:17:57.519
You know, I'm happy paying with my phone.
00:17:57.680 --> 00:18:01.119
It's it's never been something that uh I found disturbing at all.
00:18:01.359 --> 00:18:08.799
You know, you when you have an iPhone, you just press the power button twice, I believe, Apple Pay opens up, or the home button, sorry, it's a home button on the side.
00:18:08.880 --> 00:18:16.079
You press it, press it twice, Apple Pay opens up, you look into the camera, and then you consciously tap your card against the card reader, right?
00:18:16.160 --> 00:18:19.519
You make a a conscious decision to pay at that moment.
00:18:19.680 --> 00:18:27.279
I don't like the idea of having to look into a into a camera, potentially smile, and then pay that way.
00:18:27.359 --> 00:18:30.799
You know, feels like there's there's something, yeah, not nothing conscious about that.
00:18:30.960 --> 00:18:33.599
You know, what if you accidentally look into the wrong direction?
00:18:33.759 --> 00:18:35.039
Oh, you've just paid.
00:18:35.279 --> 00:18:38.319
At least that's what I'm imagining from hearing this, these kind of details.
00:18:38.400 --> 00:18:40.000
It's it feels kind of kind of funny.
00:18:40.160 --> 00:18:45.200
Feels like something something useless I would not really want to use, feels like it comes out of a Black Mirror episode.
00:18:45.359 --> 00:18:45.920
It really does.
00:18:46.160 --> 00:18:48.799
And I don't think it's really meant to be for the customer.
00:18:48.880 --> 00:18:50.559
I don't think they're trying to innovate anything.
00:18:50.640 --> 00:18:52.799
I mean, it might appear like that, it might be dressed up like that.
00:18:52.880 --> 00:18:54.000
Please again get in the comments.
00:18:54.079 --> 00:18:55.440
Let us know if you think this is useful.
00:18:55.599 --> 00:18:58.400
But I don't really see the use case for it, and I can tell what this is.
00:18:58.799 --> 00:19:03.119
This is just an opportunity for Revolut to capture more merchants.
00:19:03.359 --> 00:19:09.519
You know, it might make payments faster, but they can offer this as a 0% acquisition.
00:19:09.599 --> 00:19:15.920
So if a merchant uses this payment method, they won't charge, Revolut won't charge them a fee for the transaction.
00:19:16.000 --> 00:19:20.640
Whereas, you know, if it's a card, for example, they might charge 1.5 or 2% per transaction.
00:19:20.799 --> 00:19:21.599
This will be free.
00:19:21.680 --> 00:19:23.440
So that'll get people to sign up for Revolut.
00:19:23.599 --> 00:19:35.920
That'll get people to pay the£350 plus VAT for their terminal to install it into their business, and then obviously Revolut can start to charge or or generate revenue from non-pay with smile transactions like cards, credit cards, etc.
00:19:36.079 --> 00:19:36.240
etc.
00:19:36.480 --> 00:19:41.039
So it's a it's a really clever way, Jan, to come up with something quite unique and innovative.
00:19:41.119 --> 00:19:47.920
So people talk about it, people like us, so like the sun reports on it, people go in there purposely just to use it, talk about it.
00:19:48.079 --> 00:19:59.279
That gets people in the merchant, that gets people in the business, that'll attract people to getting this product, and as a result, Revolute get their terminal inside these companies so they can generate revenue from those checkout conversions.
00:19:59.440 --> 00:20:01.599
And this is so this is not for the customer.
00:20:01.920 --> 00:20:07.759
So once they control the checkout, you you're suggesting that it would start implementing fees because it's then too difficult to switch back?
00:20:08.000 --> 00:20:13.119
They they might not start implementing fees on pay with smile, but they will immediately have fees on any other transaction.
00:20:13.359 --> 00:20:13.759
Fair enough.
00:20:13.839 --> 00:20:22.000
Um pay with smile would be 0%, but they'll immediately so they they just use pay with smile as a quirky way to get merchants to to buy into this idea.
00:20:22.160 --> 00:20:26.559
Because it you you you you can see why it could arguably be convenient, I would say it's not.
00:20:26.720 --> 00:20:32.960
But it it it's it's a merchant acquisition play, not like a customer innovation play, is what I'm trying to say.
00:20:33.119 --> 00:20:35.119
I want to try to see an upside though.
00:20:35.200 --> 00:20:38.880
I I I think it feels dystopian, I think it feels weird, but let's talk about what it could be.
00:20:39.119 --> 00:20:41.119
I mean, from a technical What was the upside here, Jan?
00:20:41.200 --> 00:20:41.920
Is there anything positive?
00:20:42.160 --> 00:20:46.400
Yeah, from a technological perspective, I think it's quite fascinating that this is possible nowadays, right?
00:20:46.559 --> 00:20:48.240
Think back two decades or so.
00:20:48.319 --> 00:20:53.839
You know, if you would have told that someone in 2020 uh 2006, they would have thought you were crazy, honestly.
00:20:54.160 --> 00:21:00.160
I I do agree that the technological innovation side of this is is is is fascinating and impressive.
00:21:00.319 --> 00:21:09.759
At the same time, it's creating more opportunities to gather data, which, again, we know now is far more valuable than the money in our wallets.
00:21:10.000 --> 00:21:12.559
So there's more value being put on this data.
00:21:12.640 --> 00:21:17.519
The more data that's collected, the more that's accessible, the more hackers can try to get hold of.
00:21:17.680 --> 00:21:20.400
It creates more and more risk for further data breaches.
00:21:20.559 --> 00:21:26.400
You know, if I'm paying with SMALE every time, I'm constantly sharing an updated selfie video of myself.
00:21:26.559 --> 00:21:32.960
So no longer is it the old dated one from like five years ago when I was a little less grey and a little less wrinkly.
00:21:33.200 --> 00:21:45.279
You get the latest image that you could then use if you were a nefarious actor to, if you are able to get hold of it at least, open an account, mimicking me, or maybe even work it out how you could use it to gain access to an account.
00:21:45.359 --> 00:21:45.759
I don't know.
00:21:46.000 --> 00:22:04.720
The bigger picture here for me is Jan that this innovation creates more value or it makes this KYC data, this data that we share with these banks, more valuable, more compelling, and this underbelly economy that goes on in the world of criminal organization just gets more opportunities to steal more things.
00:22:04.960 --> 00:22:09.440
Yeah, I wish people were more conscious about when they hand data over to large corporations.
00:22:09.519 --> 00:22:15.119
I wish they were more conscious about it, maybe um a bit skeptical, you know, here and there.
00:22:15.279 --> 00:22:16.640
And it's just unfortunate.
00:22:16.720 --> 00:22:21.039
Because data breaches nowadays, they're part of day-to-day lives, unfortunately.
00:22:21.200 --> 00:22:26.880
Um, and this, you know, might not change anytime soon, given how fast AI is developing.
00:22:27.039 --> 00:22:28.880
I don't think this will change anytime soon.
00:22:28.960 --> 00:22:31.839
I think this might even become more common, right?
00:22:32.079 --> 00:22:35.599
Because with the help of AI, you know, actual hacks could happen.
00:22:35.680 --> 00:22:37.359
Um, and more actual hacks could happen.
00:22:37.440 --> 00:22:39.359
It's it's much easier to hack something, I assume.
00:22:39.599 --> 00:22:43.200
Yeah, be skeptical when you when you hand over your data, you know, be be cautious about it.
00:22:43.519 --> 00:22:45.119
Skepticism is important, Jan.
00:22:45.200 --> 00:22:49.359
But what were you supposed to do if you just wanted to use Revolute to trade crypto?
00:22:49.599 --> 00:22:50.240
Yeah, can't do much.
00:22:53.200 --> 00:22:54.640
Like it could have happened to any platform.
00:22:54.720 --> 00:22:57.039
We should be in you know, should we should mention that, of course.
00:22:57.200 --> 00:22:59.839
You know, this can happen anywhere and it happens all the time.
00:23:00.240 --> 00:23:05.119
But you know, you you just basically, I think we're all just better off offline, aren't we?
00:23:05.279 --> 00:23:13.599
Just not using the internet, because essentially, like, you know, you your data is necessary to gain access to most things, most things are gated.
00:23:14.240 --> 00:23:16.240
And you know, what are you supposed to do?
00:23:16.480 --> 00:23:17.519
Yeah, what are you gonna do?
00:23:17.759 --> 00:23:19.599
Get in the comments, let us know your thoughts.
00:23:19.759 --> 00:23:24.799
Come join the Discord, we'll stick a QR code on the screen now if you want to come and further the conversation.
00:23:25.039 --> 00:23:31.680
I'd like to ask you, Johnny, are you intending to inform the Discord community as soon as a drivework response comes in?
00:23:31.839 --> 00:23:33.440
Is that where they will they will learn about it?
00:23:33.680 --> 00:23:34.160
Yeah, yeah, yeah.
00:23:34.240 --> 00:23:35.680
I'll keep everyone up to date on Discord.
00:23:35.759 --> 00:23:36.559
Yeah, that's a good point.
00:23:36.720 --> 00:23:37.920
I haven't had a response yet.
00:23:38.000 --> 00:23:40.799
I ha they have to respond, right, at some point, I would expect so.
00:23:40.960 --> 00:23:43.359
Otherwise I'll contact Revolute again and see what they have to say.
00:23:43.519 --> 00:23:43.839
Hopefully.
00:23:44.079 --> 00:23:46.319
Or I should say what the the the chat bot has to say.
00:23:46.559 --> 00:23:47.680
Try to escalate that a bit.
00:23:47.839 --> 00:23:48.640
Okay, thanks everyone.
00:23:48.799 --> 00:23:49.599
We'll see you in the next one.
