Fake Revolut Order Confirmation Phishing Scam
Scammers send fake Revolut payment receipts claiming the user's card was just charged for a purchase they did not make, prompting a panicked login on a credential-harvesting page.
Part of: Fake Order Confirmation Phishing Scams
Last reviewed: 8 June 2026
Revolut sends push notifications and email receipts every time a card transaction or payment is processed. These notifications are a core part of Revolut's real-time spending-notification feature — one of its most popular capabilities. Criminals replicate these notifications with high precision, creating fake receipts that name familiar-sounding merchants, realistic amounts, and convincing transaction IDs.
The attack exploits one of Revolut's own selling points: users are trained to pay close attention to every card notification. When a notification appears for a transaction they do not recognise, the instinct to act immediately is strong. The 'dispute this payment' link in the fake notification leads to a phishing page rather than the Revolut app.
The distinctive Revolut visual identity — clean white background, dark text, circular merchant logos — is easy to replicate and widely recognised.
How this scam works on the Revolut brand
An email arrives with Revolut's branding, showing a transaction at a named merchant for $X, timestamped moments ago. The email says: 'If you don't recognise this payment, tap below to secure your account.' The button opens a fake Revolut login page that captures the user's phone number and PIN.
Because Revolut uses phone-number based login with an in-app code rather than a traditional username and password, the fake login page is designed to capture the phone number first, then present a fake code-entry screen while the scammer triggers a real Revolut login request on the victim's number and intercepts the code.
Some variants appear as genuine iOS or Android push notifications — generated by malicious apps or delivered through web-push subscriptions the victim unknowingly consented to — making the notification appear to come from the Revolut app itself.
Common red flags
- The email reports a transaction you did not make.
- The from-address is not @revolut.com.
- The link does not go to revolut.com or app.revolut.com.
- When you open the real Revolut app, the transaction does not appear in your feed.
- The 'dispute' link asks for your phone number and PIN on an external page.
- A push notification for Revolut comes from a source other than the official Revolut app.
- The merchant name in the fake receipt is for a major well-known brand to add plausibility.
How to protect yourself
- Open the Revolut app directly and check your transaction feed before clicking anything.
- Know that Revolut's dispute process is handled entirely within the app — no external page is needed.
- Disable web-push notification subscriptions for any unfamiliar sites that request them.
- Use a strong, unique PIN for your Revolut account and do not enter it on any page outside the official app.
- Enable Revolut's biometric login so the PIN alone is insufficient to access your account.
How to report it
- Report phishing emails to [email protected].
- Report within the Revolut app: Profile > Help > Chat with us.
- Report to Action Fraud at actionfraud.police.uk.
- Report to the FTC at reportfraud.ftc.gov.
- File with ic3.gov if funds were accessed.
Frequently asked questions
Does Revolut send email receipts for every transaction?
Revolut primarily uses push notifications for transactions. Email summaries are sent for some account actions. If you receive an email receipt for a transaction, verify it by opening the Revolut app — real transactions always appear there.
How do I dispute a transaction in Revolut?
Open the Revolut app, find the transaction in your feed, tap on it, and choose 'Something wrong?' You can dispute directly within the app — no external link or email is required.
I entered my phone number on a fake Revolut page. What should I do?
Open the real Revolut app immediately and check for any login attempts you did not initiate. Change your Revolut PIN and contact Revolut support through the in-app chat to flag potential account compromise.