Revolut confirms customer data breach through fake government requests

British fintech Revolut disclosed that it unintentionally shared sensitive personal information of a limited number of its customers with an unauthorized third party after falling victim to a sophisticated impersonation scam. The fraudsters used an email address that appeared to come from a legitimate government agency domain to submit requests for data, prompting Revolut to provide identity and contact details—including birth dates, postal and email addresses, phone numbers, and copies of passports and driver’s licences—along with verification selfies, account statements and transaction histories. The company confirmed that it has notified the affected individuals directly, alerted the relevant government agency, law‑enforcement bodies and financial regulators, and blocked the fraudulent email address, while asserting that its systems and customer funds remain secure.

The breach highlights the growing threat of external impersonation attacks that exploit trusted government domains to bypass security controls, a concern underscored by crypto‑security researcher ZachXBT, who noted the incident appeared to target high‑net‑worth users. Revolut, which serves over 80 million customers across more than 30 countries and is in the process of expanding its banking footprint—including recent licences in France and the UK and a pending U.S. national bank approval—did not disclose the exact number of affected customers, the specific market segment involved, or the government agency whose domain was spoofed. The firm’s spokesperson emphasized that the incident was limited in scope and that no customer funds were compromised.

The episode arrives as Revolut contemplates a potential public listing that could value the company at up to $200 billion, a substantial increase from its $75 billion private valuation earlier this year. While the breach may raise regulatory scrutiny and prompt tighter verification protocols, Revolut’s rapid response—blocking the malicious address and notifying authorities—aims to mitigate reputational damage. The incident also serves as a cautionary example for other fintech firms operating globally, underscoring the need for robust safeguards against sophisticated social engineering schemes that can exploit trusted communication channels.

⚡ Effects Interpreter