Betterbird Blog

What’s going on in the project

Why we had to stop accepting payments via our Revolut payment link

- Posted in Ranting by

Three days ago we noticed a number of 1 € payments via our Revolut payment link using a credit card. We were wondering what this was about.

Today we received this message from Revolut: It is with regret that we must inform you of our decision to discontinue the support for your freelance activity. [...] in an effort to mitigate potential risks associated with providing you with our acquiring services, we have temporarily restricted fund withdrawals from your account for the next 90 days.

Wow! AI sprang to help to explain that our payment link had become the targe of a so-called credit card testing attack, where the link was used by fraudsters to test stolen credit cards. AI went on to say:


What Stripe actually does (and Revolut doesn’t)
  • aggressively rate-limits payment attempts
  • runs real-time card testing detection
  • blocks suspicious patterns before they hit the merchant
  • absorbs the fraud risk by default
  • does not punish merchants for being targeted

That’s why Stripe payment links are safe to publish publicly.

What Revolut does instead
  • exposes a public card entry page
  • performs basic checks
  • then pushes all residual risk downstream to the merchant
  • treats anomalous traffic as merchant risk

So yes — they look the same on the surface, but they are not in the same category operationally. This is not something a normal user can or should infer.


Update: Revolut chat isn't very helpful, mostly pre-canned and/or AI replies. They say that blocking the account is based on their Payment Processing Service Agreement which also includes these Business Terms, but none of the documents specify a block for 90 days. Neither do any of the ten reasons for suspension in section 7 apply.

So this looks like a Goodbye to Revolut. Adding to this is the poor quality of the data they provide: For some donors, name and e-mail address are supplied, for others, only the e-mail, and for quite a few, only the name, so we can never contact the donors to thank them. Furthermore, there is zero reporting, we have to "scrape" the textual data off the Android screen (using this Copy app).