Revolut Handed Over Passports, Bitcoin Records After Fake Government Request Slipped Through Email Authentication

Revolut has begun notifying customers that it disclosed their personal data to an unauthorized third party after receiving what it believed was a legitimate government request. The request was fraudulent. The fintech says it came from an email account that operated directly within an official government agency's domain infrastructure, passed standard authentication checks, and carried credentials that made it indistinguishable from the real thing.

The company's statement describes the incident as a "sophisticated external impersonation attack." What it describes is an email. One email, sent from the right domain, with the right headers, asking for customer files. Revolut complied.

What Was Disclosed

According to customer notices shared by blockchain investigator ZachXBT, the disclosed data included copies of identity documents such as passports and driver's licenses, along with the selfies customers submitted for identity verification. Account statements were also provided, including IBANs, account status, account-opening dates, and Bitcoin wallet reference numbers. Full transaction histories, including Bitcoin transactions, were handed over.

Revolut drew a distinction between the selfie images and derived biometric facial telemetry, the latter of which it says was not involved. The company also says no login credentials, passwords, or account access was compromised. Customer funds remain unaffected.