Revolut tricked into handing hackers the passports and Bitcoin histories of wealthy customers

Revolut disclosed customers’ passports, verification selfies and Bitcoin transaction histories after treating a fraudulent government request as legitimate.

Affected customers were told Friday that the disclosed information could include passport or driver’s license copies, verification selfies, names, dates of birth, occupations, home addresses, phone numbers, IBANs, and account statements. Withdrawal records and complete transaction histories, including Bitcoin activity, may also have been released.

The request came from an unauthorized mailbox operating inside the domain infrastructure of a genuine government agency and carried valid authentication credentials.

Revolut subsequently contacted the agency, concluded the request was fraudulent, blocked the address and began notifying customers and regulators. The company has not identified the agency or disclosed how many customers were affected.

Compliance demands sharpen customer backlash

The incident has drawn scrutiny over how much information financial institutions collect from customers and the controls used when governments later seek access to those records.

Marc Zeller, founder of the Aave Chan Initiative, said the disclosure came shortly after Revolut demanded additional information from him, threatening to close his account.