Revolut says customer data exposed through fake government email

Revolut, a financial technology and banking company, disclosed that sensitive customer data, such as passports, verification selfies, and transaction histories, was exposed due to a sophisticated impersonation scam involving a fraudulent request from a government agency. The breach occurred after a fraudster utilized a legitimate government agency domain email to submit a request for information that passed Revolut's authentication checks.

Upon detecting the scam, Revolut promptly blocked the address and alerted the relevant government agency. The company subsequently notified affected customers and relevant enforcement agencies and financial regulators about the incident. Revolut confirmed that their systems and customer funds remained unaffected. The company spokesperson stated, "Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilized a legitimate government agency domain email to submit fraudulent requests for information."

One crypto sleuth, ZachXBT, suggested that the incident was limited in scale and targeted high-net-worth users. The breach sparked discussions on social media, with some users criticizing the mandatory information-sharing requirements and highlighting the potential risks associated with Know Your Customer (KYC) policies.