Revolut customer data breach after fake govt requests

Fintech firm Revolut has notified a small number of its Irish customers that their personal data, including passport and driver's licence scans, dates of birth, home addresses, email addresses, and phone numbers, were provided to criminals. The exact number of affected individuals and their locations remain undisclosed.

Revolut recently uncovered a sophisticated external impersonation scam, where an unauthorized third party used a legitimate government agency email address to request personal information fraudulently. Upon discovering the breach, Revolut promptly blocked the suspicious email address and reported it to the relevant authorities, including data protection and financial regulators.

Revolut's systems and customer funds remain secure. The company has personally contacted the affected individuals to inform them and provide necessary support. However, cybersecurity experts warn that the real danger lies in how this leaked information could be misused. Despite a password reset taking only a minute, the stolen data could enable scammers to create convincing calls from Revolut's fraud team, posing as legitimate representatives.

These calls could trick customers into moving their funds to a new account, as the scammers possess extensive personal details that only banks should know. George Foley, a cybersecurity specialist for ESET Ireland, advises customers to remain vigilant. If they receive such a call, they should hang up immediately, open the Revolut app, and contact the company directly.

ESET Ireland cautions that the stolen documents could potentially be used to open accounts or apply for credit in victims' names, a threat that may not become apparent for months. For those who have received a notification from Revolut, they are advised to check their credit record with the Central Credit Register at no cost and consider replacing the affected document if Revolut confirms that a copy of the ID was included.