Revolut Confirms Customer Data Breach From Fake Government Requests

• British fintech Revolut confirmed that unauthorized third parties accessed sensitive customer data through a sophisticated impersonation scam involving spoofed government emails.
• The breach exposed identity documents, contact details, and cryptocurrency transaction histories for a limited number of users, primarily high-net-worth individuals.
• The incident occurred as the London-based firm pursues a US national bank charter and a potential public listing that could value the company at up to $200 billion.
• Revolut emphasized that core banking systems and customer funds remain unaffected, though the breach highlights significant vulnerabilities in compliance verification procedures.

British fintech giant Revolut disclosed on September 12 that it had compromised sensitive customer information after receiving fraudulent data requests sent from an email address impersonating a legitimate government agency. The spoofed messages were sophisticated enough to pass standard security checks, including SPF, DKIM, and DMARC authentication protocols, which are typically used to verify sender identity and content integrity.

According to notifications sent to affected customers and reviewed by media, the exposed data included identity and contact details such as birth dates, postal and email addresses, phone numbers, and copies of identity documents like passports and driver’s licenses. The firm also indicated that verification selfies, account statements, and transaction histories may have been compromised.

A Revolut spokesperson stated that the company identified the scam, immediately blocked the fraudulent email address, and alerted relevant government agencies, law enforcement, and regulators. The company emphasized that its systems and customer funds were unaffected, describing the event as a sophisticated social-engineering attack rather than a breach of its internal infrastructure.

Security researcher ZachXBT noted that the incident appeared targeted at high-net-worth users, a group that faces elevated risks of phishing, SIM-swapping, extortion, and physical threats. This data breach occurs as Revolut weighs a potential public listing that could value the fintech at up to $200 billion, a significant increase from its $75 billion private valuation in November.

How Did the Spoofed Emails Bypass Revolut's Security?

The technical significance of this breach lies in the failure of email authentication protocols to detect the spoofing. SPF checks authorized sending servers, DKIM verifies content integrity, and DMARC manages failure handling. The fraudulent emails bypassed these layers, allowing the compliance team to fulfill the request under the reasonable belief it was authentic.

The attack vector demonstrates that technical email checks verify domain authenticity but do not confirm sender authorization. Once an attacker controls an account inside a genuine domain, these technical safeguards fail. The incident underscores the need for organizations handling sensitive customer records to independently validate high-risk information requests through out-of-band channels, rather than relying solely on domain authentication.

The compliance team likely treated these requests as lawful due to the authenticated domain, handing over documents under emergency data request protocols designed for imminent danger scenarios. This highlights a critical operational risk in Know Your Customer (KYC) data handling, where procedural attacks can succeed even when core systems remain secure.

What Data Was Compromised and What Are the Risks?

The data categories exposed include passports, driving licenses, identity verification selfies, names, dates of birth, occupations, home addresses, email addresses, phone numbers, IBANs, account statements, withdrawal logs, and complete Bitcoin transaction histories. Crucially, credentials, passcodes, and biometric templates were not compromised.

The exposure of Bitcoin transaction history allows for cluster analysis, linking public blockchain addresses to specific identities, home addresses, and wealth levels. This creates tangible physical security risks, including potential extortion or kidnapping, as seen in similar past incidents in Europe.

For impacted Revolut customers, the combination of identity documents, contact details, account information, and transaction history could provide attackers with the material needed to construct convincing social-engineering lures. Fraudsters may impersonate Revolut support staff, law-enforcement agencies, exchanges, or tax authorities while using personal information to make messages appear legitimate.

How Does This Affect Revolut's Strategic Ambitions?

This breach coincides with significant strategic developments for the London-based fintech, which has over 80 million customers globally and operates in more than 30 countries. Revolut recently secured banking licenses in France and the UK and received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank, expected to launch in the first half of 2027.

The company is reportedly weighing a public listing that could value it at up to $200 billion, a substantial increase from its $75 billion private valuation in November. The incident presents reputational challenges as Revolut pursues European expansion and signals ambitions toward a public listing.

While customer funds were unaffected, the long-term reputational and liability risks are significant. Users are advised to verify communications directly through the app rather than email links, file subject access requests under GDPR Article 15 to confirm data exposure, and consider decoupling holdings from identity records by moving excess wealth to self-custody solutions with passphrase protections.

The case demonstrates how trusted email domains can be abused when an attacker gains access to, or misuses, a legitimate organization’s mail infrastructure. Even properly authenticated email can be malicious when the sender account itself is unauthorized. This incident marks a shift from previous security challenges, such as a 2022 breach involving social engineering of an employee, whereas this latest event targets the compliance process itself.