Bitcoin activity, passports exposed after Revolut falls for fake government request

Revolut, a financial technology company, has admitted to sending customer passport and Bitcoin records to an impostor who used a legitimate government email domain. Customers began receiving notices on Friday, and crypto researcher ZachXBT brought the incident to light on Saturday, September 12. The suspicious emails looked official as they arrived from a government domain and passed standard mail checks.

Initially, staff at Revolut treated these emails as genuine, leading to the sending of the files. However, Revolut later identified the mailbox as unauthorized and shut it down. The company confirmed that their systems were not compromised and no cash was moved. The package of information included passport or driving-license copies, selfies for identity checks, personal details, account statements, and Bitcoin transaction history.

According to ZachXBT, the number of affected customers is small, mostly consisting of high-net-worth individuals. Revolut informed the relevant authorities and blocked the email address, but the value of the stolen data remains significant. A passport scan combined with a matching face photo is enough for someone to open accounts, apply for credit, or perform a SIM swap.

Transaction lists can make later emails appear more personal. This incident is not the first time Revolut has faced fraud concerns. The company has previously dealt with police fraud complaints and a French banking license affecting Spain-based customers. Due to the risks associated with passport scans, users should treat unexpected messages from Revolut, tax offices, or police as hostile until proven otherwise within the app.

Users are advised not to share phone numbers or reply-to addresses in inbound messages, and to immediately hang up on anyone who already "knows" their transaction details and requests sensitive information. It is crucial to secure the phone number first by obtaining a port-out or SIM-swap PIN from the mobile service provider to prevent number theft and interception of one-time codes.

Users should also enable app-based two-step verification for email, Revolut, and any cryptocurrency exchange. If a replacement passport or license is necessary, it may be worthwhile to consider it. For UK residents, the ICO provides steps for handling personal data breaches and identity theft, including CIFAS Protective Registration.

The UK National Cyber Security Centre offers guidance on identifying official-looking scam emails. Residents in Spain can contact INCIBE's free 017 line for assistance. Users who bank with Revolut from Spain or the UK should assume follow-up scams will reference real transactions. Every alert should be verified within the app, and odd activities should be reported to Revolut chat, the bank, and local law enforcement.

While money in the account may still be present, identity papers and Bitcoin holdings are already in the hands of an unauthorized individual.