If it’s all authorised like this, it is technically a legit transaction. Revolut should have flagged it up for review though as per the article. I think card transactions are a bit different, as usually they don’t need to be authorised in the app, but this sounds like he spoke to a scammer, transferred them some money, handed out a 2FA code (something which banks always say “don’t give this to anyone, not even us”), and then was surprised when lots of money was transferred out of his account. I’m not sure Revolut are at fault here.