Revolut Gave Away Passport and Bitcoin Records After Spoofed Agency Email Passed Security Checks

Stock photo via Pexels

Digital bank Revolut disclosed passport scans, home addresses and full Bitcoin transaction histories belonging to an unknown number of customers after a fraudulent email impersonating a government agency cleared its internal verification process, CoinDesk reported on Friday.

The company discovered the error only after separately contacting the agency and learning the original request was unauthorised.

Revolut has since notified affected customers and alerted law enforcement, the relevant government agency and financial regulators, according to TechCrunch. Customer funds were not compromised.

What the Fraudulent Request Looked Like

The email was sent from an official government agency domain, not a lookalike address, and carried authentication credentials that passed Revolut's checks, according to an analysis by breachhistory.com. Revolut fulfilled the request on the reasonable belief it came from a legitimate authority.

The company has not identified the agency involved, disclosed when the request arrived, or said how many customers are affected.

On-chain investigator ZachXBT, whose post first surfaced the customer notice publicly, said the incident appeared limited in scale and seemed directed at higher-net-worth users, as reported by cryptonews.net.