Revolut

Revolut Confirms Limited Data Exposure After Fraudulent Government Email Request

Revolut has confirmed that a small number of customers had personal documents and full transaction histories exposed after the company responded to a fraudulent request that appeared to come from a government authority. The incident, disclosed on September 13, involved no intrusion into Revolut systems. Attackers instead used an unauthorized email account that carried valid credentials from a government domain, making the request appear legitimate. Exposed data included passport and driver’s license copies, identity verification selfies, full names, dates of birth, occupations, addresses, contact details, IBAN statements, complete transaction histories, and Bitcoin activity records. The combination of identity documents and detailed financial history significantly raises the risk of account takeover and targeted social engineering. Revolut stated that customer funds remained secure, blocked the malicious email source, notified regulators, and contacted all affected users.