Revolut Exposes Bitcoin Records, Passports After Fraudulent Government Email Attack

Key Takeaways:

• Revolut had to share sensitive data about its users after receiving a phishing request that looked legitimate from an official representative from the government. 
• Information revealed were copies of a passport, a driver’s license with verification selfies, full Bitcoin transactions and home address.
• Blockchain investigator ZachXBT stated that the incident looks small in scale but could have targeted high-net-worth crypto users.

Revolut is said to have had to reveal sensitive user data, such as records linked to Bitcoin transactions, after a sophisticated impersonation attempt. This incident is particularly significant as it shows an inability for a financial platform to adhere to trust-based security checks on a legitimate government email.

Revolut Falls for Fraudulent Government Request

The notice warned customers that Revolut had been sent a request from a valid government body, claiming to contain customer details.

This request was made from an unauthorized email address on the agency’s official domain. It also had valid domain authentication credentials and Revolut treated the communication as an authentic government request. That decision led to disclosure of customer information prior to discovery that the request was a fraud.