Revolut Breach: Government‑Agency Impersonation Exposes Passports and Financial Data

Revolut, the global fintech platform serving more than 80 million users, has disclosed a breach that involved the accidental release of sensitive personal and financial data to a malicious actor impersonating a legitimate government agency. The company says the attacker used an unauthorized email address that carried the official domain of a government body, complete with valid authentication credentials. Under the mistaken impression that the request was legitimate, Revolut complied and forwarded a wealth of customer information.

What Was Exposed?

• Personal identifiers – full name, date of birth, occupation
• Contact details – postal address, email, phone number
• Identity documents – copies of passports or driver’s licences and selfie images used for KYC verification
• Financial records – account statements, IBAN numbers, withdrawal logs, full transaction history, including Bitcoin movements

The breach reportedly impacted a "very limited" subset of customers, though Revolut has not released an exact figure. Analysts suggest the attack targeted high‑net‑worth individuals, a trend seen in recent fintech breaches.

"Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency's email domain," the company told affected users.

Revolut acted quickly: the suspicious email address was blocked, and the incident was reported to the relevant government and regulatory bodies. The company also confirmed that its systems and customer funds remain intact.

Implications for the Fintech Landscape

This incident underscores the growing sophistication of phishing campaigns that exploit domain spoofing and valid authentication tokens. Fintech firms must reinforce verification processes, especially when handling PII and financial data. Customers are advised to monitor their accounts for unusual activity and report any suspicious requests directly to Revolut through official channels.

What Customers Should Do

• Review recent account statements and transaction logs for anomalies
• Change passwords and enable multi‑factor authentication if not already active
• Notify Revolut immediately if you receive any unsolicited requests for personal information
• Keep an eye on identity‑verification documents for signs of tampering