In September 2026, Revolut disclosed customer passports, selfies, transaction histories and bitcoin activity to a criminal who used a spoofed but domain-authenticated government email address. The email passed technical authentication checks because the attacker controlled a legitimate government domain, not because Revolut’s systems failed a technical test. The case is a warning for any business that processes “official” data requests: domain authentication proves the message came from that domain, not that the sender is who they claim to be.
A single fraudulent email exposed passports, selfies and bitcoin transaction histories at Revolut, and the incident shows why vendor-impersonation risk now belongs on every finance and compliance team’s agenda. The fintech giant confirmed that an unauthorized third party used a legitimate government agency’s email domain to submit a fraudulent data request, and Revolut’s staff, following normal law-enforcement request procedures, handed over sensitive know-your-customer (KYC) records. This guide breaks down what happened, why it worked, and what businesses that hold identity or financial data should change as a result.
This guide provides general information, not legal or cybersecurity advice. Response obligations after a data exposure vary by jurisdiction and data type; consult qualified counsel and incident-response professionals for your specific situation.
What happened to Revolut?
An attacker used a real government agency’s email domain to send a fraudulent data request, and Revolut disclosed passports, selfies, addresses and bitcoin transaction histories for a limited number of customers.
Why did the fake request succeed?
The email carried valid domain authentication, so automated and human checks confirmed it came from the claimed domain β but domain authentication does not verify that the specific sender or request is legitimate.
Who was affected?
Revolut said impact was limited to a specific group of customers and has not disclosed an exact number; reporting suggests high-net-worth and crypto-active users were disproportionately targeted.
What exactly happened in the Revolut data breach?
An unauthorized third party submitted a fraudulent law-enforcement-style data request from a legitimate government agency’s email domain, and Revolut’s team responded as it would to any authenticated official request, releasing sensitive customer records to the attacker.
According to reporting from TechCrunch, Decrypt and CoinDesk, the exposed data included customers’ full names, dates of birth, postal and email addresses, phone numbers, copies of passports and driver’s licenses, and β for a subset of users β verification selfies, account statements and full transaction histories, including bitcoin activity. Revolut said only a limited number of customers were affected and that it contacted them directly, but the company has not published an exact figure. Security researchers covering the case flagged that the pattern β precise targeting of identity documents and crypto transaction histories β is consistent with “wrench attack” risk, where criminals use leaked financial data to identify and physically target wealthy individuals.
How did a fake government request get past Revolut’s security checks?
The request passed because the attacker controlled or spoofed a genuine government domain’s email authentication (SPF/DKIM/DMARC-style checks), which confirms the technical origin of an email but says nothing about whether the human sending it has legitimate authority to make the request.
This is the core lesson security teams draw from the case: domain-level email authentication was never designed to validate the intent or authorization of an individual sender, only that a message genuinely originated from mail servers associated with that domain. If an attacker compromises a government mailbox, buys access to one, or exploits a misconfigured domain, every technical signal a receiving company checks can come back “valid” even though the request itself is fraudulent. Security Affairs’ analysis of the incident specifically frames it as a KYC data exposure that “passed security checks” β the failure was procedural and human-verification-based, not a software vulnerability in Revolut’s platform.
Why do fintechs and data-holding businesses remain prime targets for this kind of fraud?
Fintechs and other companies holding KYC data are attractive targets because they concentrate exactly the identity, financial and crypto-activity records that criminals need for account takeover, extortion or physical targeting, all in a single, verifiable-by-request source.
Revolut is not an isolated case: TechCrunch’s fintech coverage this month alone also reports Kalshi banning a public figure for prediction-market abuse and continued scrutiny of consumer fintech risk controls, reflecting an industry-wide moment of tightened attention on trust and verification systems. As more of finance moves into apps that hold both identity documents and crypto wallets β the exact combination exposed here β the payoff for successfully impersonating a government requester keeps rising, and attackers are responding accordingly.
What should a business do immediately if it discovers it disclosed data to a fraudulent request?
A business should immediately revoke or block the sender’s access, preserve all communications and logs related to the request, notify affected individuals and relevant regulators as required by law, and alert the real government agency whose domain was impersonated.
Revolut’s own response followed this pattern: it blocked the fraudulent email address once the scam was discovered, notified the affected customers directly, and alerted the impersonated government agency, law enforcement and relevant regulators. Speed matters because exposed identity documents and transaction histories can be weaponized quickly for account takeover or, in the more severe cases researchers flagged, physical targeting of high-net-worth individuals.
How can businesses verify that a data request is genuinely from a government agency?
Businesses should independently confirm the requester’s identity and authority through a channel they control β such as calling a phone number published on the agency’s official website, not one supplied in the request β before disclosing any personal or financial data.
Practical controls include maintaining a verified directory of known law-enforcement liaison contacts, requiring a second employee to approve any bulk data disclosure, logging every official data request in a searchable compliance record, and training frontline compliance staff specifically on impersonation tactics rather than only on data-formatting requirements. These steps map directly onto the verification practices covered in Kurums’ guides to sanctions screening and beneficial ownership verification, both of which depend on trusting the authenticity of counterparties and requesters rather than surface-level documentation.
What does the Revolut breach change about data governance for financial businesses?
It shifts the compliance conversation from “was the request properly formatted and authenticated” to “was the human requester actually verified,” pushing businesses to add an independent verification step to every high-sensitivity data disclosure process, not just customer-facing fraud checks.
For a deeper operational framework on containing and reporting an exposure once it is discovered, see Kurums’ guide to data breach response, which covers the notification and remediation steps that apply once a disclosure like Revolut’s has already happened. Google Trends data shows search interest in “data breach” and “Revolut” both climbing sharply in the days following disclosure, with “Revolut bank,” “Revolut account” and “Revolut business” among the highest-volume related queries β indicating the story is driving direct concern among the platform’s own business and retail customers, not just industry observers.
What regulatory obligations follow a KYC data exposure like this one?
Businesses that expose identity and financial records typically face breach-notification duties to affected individuals and data-protection or financial regulators, timelines that can run from 72 hours to 30 days depending on jurisdiction, and potential follow-up inquiries into whether their verification procedures met regulatory expectations.
Because the exposed records included KYC documentation collected for anti-money-laundering purposes, the incident also intersects with travel-rule and KYC compliance obligations that already require fintechs to safeguard the same data they must collect β a tension explored in Kurums’ guide to travel rule compliance for crypto and fintech businesses. Regulators increasingly expect firms to demonstrate not just that they collected required identity data, but that they controlled who could request and receive it after collection, which is precisely the control that failed in this case.
Frequently Asked Questions
What data was exposed in the Revolut breach?
Names, birth dates, addresses, phone numbers, passport and driver’s license copies, and for some customers, verification selfies, account statements and bitcoin transaction histories.
Was this a hack of Revolut’s systems?
No. Revolut’s technical systems were not breached; an attacker used a spoofed but domain-authenticated government email to trick staff into disclosing data through a normal request process.
How many customers were affected?
Revolut has said the number was limited and that it contacted affected customers directly, but it has not disclosed an exact figure publicly.
Can domain-authenticated email still be fraudulent?
Yes. Domain authentication (SPF/DKIM/DMARC) confirms technical origin, not sender authority or intent, so a compromised or misused government domain can still pass every automated check.
What is the single most effective control against this type of fraud?
An independent callback-verification step, using contact details looked up separately rather than supplied in the request, before releasing any personal or financial data.
Last updated: September 13, 2026. Sources: TechCrunch, Decrypt, CoinDesk, Security Affairs.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.
