Revolut confirms customer data exposed via fake government email
Revolut exposed customer data after fake government request
Revolut released sensitive customer data after a scammer sent a fraudulent request that appeared to come from a government agency. The data included copies of passports, verification selfies, and full transaction histories.
Customers whose information was exposed were notified on Friday, according to a company spokesperson.
Key points
- The fraudulent request came from a legitimate government agency email domain and passed Revolut's authentication checks.
- Revolut later concluded the requests were not authentic.
- The company says its systems and customer funds were unaffected.
- Revolut blocked the sender's address and alerted the relevant government agency, enforcement agencies, and financial regulators.
What Revolut says
A Revolut spokesperson told Cointelegraph that the company identified a sophisticated external impersonation scam, in which an unauthorised third party used a legitimate government agency domain email to submit fraudulent requests for information.
The spokesperson said Revolut contacted the limited number of impacted individuals directly to inform them and provide support.
What other reports say
Crypto investigator ZachXBT reportedly said he believed the incident was limited in size and targeted high-net-worth users. This claim has not been independently confirmed.
Marc Zeller, a crypto industry figure, posted on X that he woke up to all his data being leaked by Revolut. He called it a sharp reminder that KYC has not produced meaningful upside and has put many people in harm's way. That statement is his personal opinion.
What is confirmed
Revolut confirmed that passport copies, selfies, and financial transaction histories were released. The request used a real government agency domain, and affected customers were notified on Friday.
What is still unclear
Revolut did not disclose the exact number of customers affected. It is also not clear which government agency's domain was used or who was behind the scam.
Why it matters
The incident drew criticism of mandatory KYC (know your customer) checks, a process that requires users to verify their identity with documents. Marc Zeller argued that KYC created risk for users without meaningful benefits. This is his stated opinion, not a proven fact.
What happens next
Revolut said it has contacted impacted customers directly to support them. The company also reported the incident to the government agency, enforcement agencies, and financial regulators.