Still pretty unlikely to happen in the wild, anyone with that kind of 0 day isn’t going to be using it on random attacks either. Is there a single case of this happening to HTTPS in the last 20 or so years you could show?
You also have to consider that Revolut and any other bank app will be checking the IP your connecting from, and might consider any transfer you try to make a little more risky since VPNs are a very common thing used in fraud with all of the IP reputation providers I integrated into apps at work giving them a trust score of zero
You also chance ending up connecting to Revolut from an IP known to them as being used for fraudulent activity, where you have to hope some overzealous protection doesn’t just close your account
So it’s a risk reward scenario but the reward is really a very small chance, if someone can push a root cert to your phone they can probably find a better way to do malicious things than intercepting your traffic
What makes you think that?
There is no doubt that Android phones are at the top of the list for exploits and malware but iPhones are exploited and suffer malware too.
There are websites that show the number of recorded exploits of phones, operating systems etc and I was quite surprised at just how many there were for both operating systems.
I assumed that the article was inferring that his device was hacked, ie the line that says “my Revolut app was compromised”
As far as I know there hasn’t been any iPhone malware that has been used by anyone less than the NSO group / state sponsored actors, since iOS 12 due to the way that iOS sandboxes apps into their own containers. Jailbreaking makes this weaker hence why a lot of banks block it
Due to that I wouldn’t really imagine an iPhone being hacked is a possible attack vector here
What would actually make a lot more sense is that the persons mobile carrier account was taken over, followed by their iCloud or Google account and then somehow bypassing Revoluts face scanning to login as them (since the first step is a 6 digit SMS code), and then resetting their phone using the lost my phone functions to delay the person from noticing
Though one would hope Revolut would stop a brand new device logging in and instantly draining an account to a new payee
Just seen my first Revolut TV ad in Ireland (not on a British channel but actually on an Irish TV channel - Virgin Media One).
Revolut have started a campaign here to get people to move their salaries and DD’s over, and that’s what the ad was about:
An interesting note in this article was that only 5% of people are actually interested in moving bank accounts, and given that Ireland has just had a massive shift of account moves with the exit of Ulster and KBC in the last couple of years, I wonder how this bodes for Monzo’s upcoming plans to launch in Ireland.
Particularly with Revolut’s huge penetration here - yet they still have a need to run a campaign to get people to pay their salary in.
It’s interesting actually that talking to Revolut users here, it’s surprising how many are still not aware that Revolut is a bank and not a prepaid card - and don’t realise they can receive salary inbound.
has done before
guess that’s only ~10 transactions a month for 48mil customers but still blows my mind.