Fake government request exposes Revolut’s customer data and Bitcoin histories – Details

In a surprising turn of events, a fake government request passed digital banking giant Revolut’s security checks. This caused the company to unknowingly share sensitive customer data, including IDs, addresses, and Bitcoin [BTC] transaction histories.

Revolut later discovered the request was fraudulent, and hence, they blocked the attacker and notified affected customers and regulators.

How did Revolut fall prey to a fake government request?

In this phishing attack, the attacker appears to have tricked Revolut’s internal process for responding to government information requests.

Someone sent Revolut a request that looked as though it came from a real government authority. Because the email appeared legitimate and its technical authentication credentials were valid, Revolut’s security checks apparently treated the request as genuine.

Revolut then provided customer information to the person behind the fraudulent request.

According to Revolut,

The request originated from an unauthorized email account created directly within an official government authority’s domain infrastructure.

The digital banking giant added,

The communication carried genuine domain authentication credentials leading Revolut to fulfill the request under the reasonable belief that it was an authentic government agency request.