Possibly the Second-Worst Online Banking Outage in History
Tuesday morning my Revolut card declined at the checkout, and every screen in the app - support included - showed "Something went wrong. Please try again later". I had a hospital trip ahead and no way to pay for any of it. No cash, one bank, one app. The rescue was €100, an emergency fund by accident, in an ING account I'd been meaning to close. Procrastination, it turns out, is a redundancy strategy. I wasn't alone. By 08:00, outage trackers logged 1,500+ reports on Revolut alone, Lloyds, Halifax, Bank of Scotland, HSBC and NatWest customers filing their own.
None of it was any bank's code. At 06:08 GMT on 20 October a power event took out one zone - europe-west2-b - of Google Cloud's London region, in a facility Google describes as third-party. Most workloads were recovering about six hours later.
What one zone can do
A cloud region is a cluster of data centres in one area, and a zone is one failure domain inside it: separate power, separate networks, in principle a separate fate. Google's documentation is crisp: zones "should be considered a single failure domain within a region", a region is three or more zones in three or more buildings, and the cure for a zone dying is spreading the workload across its siblings.
The promise is that one zone's death is a non-event. On Tuesday the non-event covered 38 products on Google's incident page, down to the payments of a bank with tens of millions of customers.
The blast radius was bigger than the failure
Google's status entries describe the cause as zonal and the symptoms as regional - "elevated errors and intermittent network issues in europe-west2 region". One zone lost power, and the region felt it, unevenly: Revolut lost everything at once, sign-in, cards, ATM, while Lloyds' own app kept working, the damage on its login page. Whose architecture widened the blast is unanswered, it fails from either side. If regional services leaned on machinery inside the dead zone, the radius is Google's. If banks pinned databases and logins to one zone, it is theirs - Google's docs are explicit that spreading across zones is the customer's job. Google's analysis is still promised.
Revolut, serving the EEA off a Lithuanian licence, went dark for its people wherever they stood - cards declined at an airport, beauty appointments cancelled in Japan, mine in the eurozone. Lloyds and Halifax serve Britain, so theirs lived there. The region is where the machines are, not where the victims are.
Google's official workaround for affected customers, verbatim:
If feasible, the impacted customer may try to migrate their workload impacted to another available location (zone or region).
Read that aloud to the engineers watching their screens fill with errors. Mid-outage, "if feasible" is doing heroic work. What should exist instead is not exotic: the stateful core - databases, balances, who may move money - async-replicated into a sibling zone, with enough spare capacity there to sign people in and authorise payments. Degraded by design: the whole platform on standby is the expensive tier, a warm core that keeps cards working is not. Google's documentation tells every customer to spread across zones. For a bank that is baseline, not gold-plating.
Why a bank lives in one region anyway
Money is, for most companies, the least forgiving workload they run. The standard engineering answer to "why not two regions" is consistency: every payment must debit exactly one balance, and a strongly consistent ledger treats a faraway copy as a tax on every transaction. I can't vouch for any bank's architecture from the inside - I don't need to. Tuesday showed Revolut's whole customer-facing platform hanging off one region, zones carrying the availability argument alone. But zones in a region share a metro, the same weather and grid and roadworks, and independence is a claim about power feeds, not destiny.
The failure mode predates Google, and it does not even need a bank: in June 2018 a "very rare partial failure" in a Visa switch kept the backup from activating. Visa ran two redundant sites, either able to carry 100% of European transactions, and the backup did not take over - 5.2 million payments failed in about ten hours. Redundancy on paper and failover in fact are different products, and you find out which one you bought during the fire.
It isn't the record, but...
Rank bank outages by people × time, whole-bank ones only: failures that left customers unable to transact, not missing one feature. Visa 2018 took down one payment rail, not the banks behind it, AWS 2025 one bank's apps until mid-afternoon: partials, mentioned and set aside. What remains ranks like this:
| Outage | People | Time | Person-hours |
|---|---|---|---|
| RBS 2012 | 6.5m+ across RBS, NatWest and Ulster Bank, counted | several weeks | ≥1.1bn (one-week floor) |
| TSB 2018 | 20-30% of 5.2m locked out online, week one (FCA) | weeks, echoes into December | ~175-260m |
| October 2026 | Revolut, whole platform: ~66m UK+EEA base (13m + 52.7m, vendor) | degraded 11h+ | ~390m-700m+ |
Revolut's status page listed 21 of 27 services still broken at 5pm, Singapore not fully back near midnight. Sign-in was down: everyone who reached for the bank was blocked. That is ~390 million person-hours on Google's six-hour clock, past 700 million on Revolut's eleven-hour one. TSB's floor is the regulator's own finding: 20-30% of 5.2 million customers could make no online payments in week one, branches queueing as the fallback. Revolut has no branches to queue at. Lloyds' 28 million and HSBC's 15 million lost logins, not payments - partial, uncounted, out of the sum. Tuesday takes second of the outages anyone has put a number on. Beyond that, the table dissolves: Wells Fargo's 2019 day - smoke in one facility, online banking, ATMs and card processing down nationwide for some 24 hours - and HDFC Bank's 2020 outage, which killed its cards, UPI and ATMs across India. Both plausibly sit in Tuesday's band, neither ever counted. The industry ranks disasters by anecdote, so Tuesday may be the second-worst online-banking outage there has ever been - nobody can prove it either way: RBS got a headcount, TSB a percentage, every bank since, nothing.
RBS, spending £1bn a year on IT, was fined £56m. TSB drew £48.65m. The two old ones did it to themselves, Tuesday didn't - the bank's machines running while someone else's region died, two consecutive Octobers. The class of failure - one shared supplier's bad afternoon scaling to an economy's morning - is now annual.
Britain's regulators drew this map in advance: Google Cloud EMEA became one of the first Critical Third Parties, under direct Bank of England oversight, on 13 July. On 8 October the Bank chaired SIMEX26, rehearsing a global cloud outage with the 38 largest banks. Twelve days later the scenario ran again, minus the simulation.
The redundancy I already had
What's left of the €100 is still sitting in the ING account. My decision went further - out of the banks, into cash. The outage wasn't the reason so much as the final straw, and the pile had been building for years: banks are careless about the individual customer, and don't hesitate to discriminate or bend the law where it pays - even inside the EU, whose protections are advertised more than they are enforced. That's a whole other story, maybe for another post. I'd been planning the move for a while. Tuesday settled it. A banknote doesn't have a status page.