Revolut confirms customer data breach through fake government requests

British fintech company Revolut has confirmed that sensitive customer information was disclosed to an unauthorized third party after receiving fraudulent requests from a legitimate government agency email domain. The exposed data included customers' identity, contact details, birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driver's licenses.

The notification to affected customers, reviewed by TechCrunch, also mentioned the possibility of verification selfies, account statements, and transaction histories being compromised. A Revolut spokesperson confirmed that a limited number of customers were impacted, though the exact count was not disclosed. The company blocked the email address after discovering the scam and alerted the relevant government agency, law enforcement, and regulators.

Revolut, which has over 80 million customers globally, operates as a bank in more than 30 countries and recently expanded its presence in markets such as India, Mexico, France, and the UAE. The U.S. Office of the Comptroller of the Currency recently granted Revolut conditional approval to set up a national bank in the country, with the launch expected in the first half of 2027.

The incident follows Revolut's potential public listing, which could value it at up to $200 billion, and its expansion of banking licenses in Europe and globally. The fintech has sought banking licenses in France and the UK in recent months.