The Revolut case: a genuine certified email, three anomalies that should not be ignored

In the video, we briefly review the Revolut case and analyse some irregularities which, in our view, could have triggered further checks before the disclosure of confidential information.

The three anomalies identified by the analysis

1. The process of the European Investigation Order

The first concerns the operation of the European Investigation Order (EOI). Under this procedure, the order is transmitted by the competent Italian authority to that of the executing State – in this case, Lithuania – which is responsible for its execution.

However, according to the documents that have been circulated, the discussions appear to have taken place directly between the Italian party and Revolut, with no public confirmation of the Lithuanian authority’s involvement.

2. The transmission of the data collected

The second anomaly concerns the flow of information once it has been collected.

Under an OEI, the legislation provides that it is the authority of the executing State that is to transfer the evidence to the requesting State, in accordance with the procedures laid down in the Directive.

However, the screenshots that have been circulating appear to show a direct refund from Revolut to an Italian certified email address (PEC), without it being possible to trace the entire procedural process.

3. The remit of the office associated with the PEC

The third anomaly relates specifically to the address used.

The PEC refers to the ‘Local Authorities’ Department of the Prefecture of Reggio Calabria, an office that normally deals with relations with local councils, local government officials and elections, rather than international criminal investigations.

A circumstance that might have justified further checks on the origin and legitimacy of the request.

What checks has Revolut carried out?

It is important to point out that it would be incorrect to say that Revolut did not carry out any checks.

The available documentation shows that the company ascertained which group entity was responsible, distinguishing between different jurisdictions, such as the United Kingdom and Switzerland.

The point, therefore, is not the total absence of checks. The available evidence suggests that particular attention should be paid to internal organisational and jurisdictional aspects, whilst questions remain regarding the checks relating to the external party and the role that Revolut should have played in the procedure.

The value of fraud intelligence

This case provides food for thought on the value of fraud intelligence and on the importance of going beyond a mere formal check of individual elements.

A genuine certified email, a document that appears to be in order, or a correct reference to legislation do not, on their own, guarantee the legitimacy of a request.

It is also necessary to assess the overall consistency of the information, the context in which it is presented and the credibility of the procedure.

Because an element may be authentic without the request of which it forms part necessarily being so.

---

Regulatory reference: Directive 2014/41/EU on the European Investigation Order in criminal matters, in particular Articles 7 and 13.