Fake Revolut Payment Alert Phishing
Criminals send SMS or email alerts mimicking Revolut's payment-notification format, claiming a large outgoing payment was just made from the account, with a link to dispute it — leading to a credential-harvesting page that replicates Revolut's app login screen.
Part of: Phishing
Last reviewed: 7 June 2026
Revolut's app notifies users in real time for every transaction, making genuine payment alerts a familiar part of the Revolut experience. Scammers copy this format precisely — complete with transaction amounts, merchant-style names, and timestamp details — and send fake payment notifications claiming a large, unrecognised payment has been made.
The fake alert's 'Not you? Dispute this payment' link is the trap. Because Revolut users know that disputing a payment quickly is possible and often effective, clicking this link seems like exactly the right protective action. The link leads to a page that replicates Revolut's app login interface, asking for the user's phone number to 'verify identity before processing the dispute'.
After the phone number is entered, the fake page sends a real Revolut sign-in code to the victim's number — because the attacker is simultaneously triggering a Revolut login — and asks the victim to enter it to 'confirm the dispute'. Entering the code on the fake page hands it to the attacker, who uses it to complete the login.
How this scam works on the Revolut brand
Real Revolut payment alerts arrive as push notifications from the Revolut app on a device where the app is installed. They may also arrive as in-app messages. Revolut may send email receipts for certain transactions, but urgent 'dispute this payment' notices with external links are not a standard feature of Revolut's email communications.
Fake alerts are sent via SMS to phone numbers obtained from data breaches. They use Revolut's distinctive payment-notification format, including the Revolut name, a merchant-style payee name, a plausible amount in the victim's likely currency, and a short link. The short link obscures the phishing domain.
If the victim opens the Revolut app independently (not via the link) and checks their transaction history, they will see the payment described in the fake alert does not exist. The alert is fabricated. Real Revolut transaction history is the definitive record.
Common red flags
- An SMS claiming a large Revolut payment was made, with a link to dispute it
- The dispute link goes to a domain that is not app.revolut.com or revolut.com
- You are asked to enter your phone number and a verification code to dispute a payment
- A sign-in code from Revolut arrives after you enter your number on the fake page
- No corresponding payment appears in the real Revolut app when you check independently
- The alert arrived via SMS rather than as a push notification from the Revolut app
- The link uses a URL shortener that hides the true destination
How to protect yourself
- Open the Revolut app directly to check your transaction history — do not use the link in the alert
- If no payment appears in your real app, the alert is fake — delete it
- Never enter a sign-in code on a web page to dispute a payment
- Enable push notifications in the Revolut app so genuine alerts arrive there first
- Forward suspicious SMS texts to 7726 (SPAM) in the US and UK
- Contact Revolut through in-app chat if you see a real unauthorised payment
- Report the phishing link to your national cybercrime unit
How to report it
- Report through Revolut in-app chat: Profile > Help > Chat with us
- In the UK, forward phishing texts to 7726 (SPAM) and report to Action Fraud at actionfraud.police.uk
- Report to the FTC at reportfraud.ftc.gov (US)
- Submit the phishing URL to Google Safe Browsing at safebrowsing.google.com/safebrowsing/report_phish/
- Report to Revolut through the in-app transaction dispute tool if a real payment needs to be challenged
Frequently asked questions
Does Revolut send SMS alerts for disputed payments?
Revolut's primary notification channel is push notifications through the Revolut app. Disputes are handled within the app by tapping on the relevant transaction. An SMS with a dispute link leading to an external website is not a standard Revolut communication.
How do I dispute a real Revolut payment?
Open the Revolut app, find the transaction in question, tap on it, and select 'Something wrong with this payment?' to begin the in-app dispute process. You do not need to click any external link to dispute a Revolut payment.
What if the SMS arrived in the same thread as genuine Revolut messages?
SMS spoofing can place a fake message in the same conversation thread as real Revolut messages by using the same sender name. The thread position does not guarantee authenticity. Always verify by opening the Revolut app independently.