Revolut Reportedly Released Customer Passports and Bitcoin Transaction Logs after Fake Government Email

Revolut customers have been told that a subset of their most sensitive records was released after the company treated a fraudulent information demand as a genuine government inquiry.

The episode became public on 11–12 September 2026 after affected users received notices and investigators circulated excerpts.

It did not depend on a conventional intrusion into Revolut’s networks.

The firm says it handed over data after an unauthorized mailbox sitting inside an official public-authority domain sent a request that carried valid sender-authentication credentials.

According to the customer notice quoted by on-chain investigator ZachXBT and by former Mt. Gox chief Mark Karpelès, who said he received the email himself, the message was framed as a lawful agency request.

Because it originated from an account created within the authority’s own domain infrastructure and passed the checks commonly used to detect spoofed mail—SPF, DKIM and DMARC—Revolut processed it in the belief that it was authentic.

Only later, when the company contacted the agency to confirm the demand, did it learn that the mailbox was unauthorized.

That outreach also alerted the government body to the rogue account on its own systems.