> The problem stemmed from differences between European and US payment systems, which meant that when certain transactions were declined Revolut would erroneously refund accounts, handing them its own money [...] In late 2021, organised criminal groups took advantage of the fault, encouraging individuals to try to make expensive purchases that would go on to be declined. This would then be cashed out via ATMs.

$20m seems like a lot to lose without internal controls flagging anything. The issue was only discovered by a US partner bank that informed them about their lower than normal account balances.

BDO did not provide them with a clean audit, pointing to revenue recognition and internal controls issues [0]

[0] https://www.reuters.com/business/finance/revoluts-2022-reven...

As the details are not disclosed, my guess is some kind of race condition or using messages wrongly. I.e. have deposits or withdrawals credited, but not debited. I would not be surprised many such gotchas could exist with the US legacy payment infra like ACH.

This is one of the companies I would stay far away from already since the start when the treatment of employees by the CEO leaked. Any sociopath like that will eventually commit actual crimes as well.