Validated Domain Credentials Helped Impostor Obtain Customer Records
Revolut has confirmed that sensitive customer information was disclosed to an unauthorized party after a fraudulent request appeared to originate from a legitimate government agency.
The incident was not caused by a compromise of Revolut's systems. Instead, an attacker used an email account operating within an official government domain to submit a request for customer information. Because the message carried valid domain authentication credentials, Revolut initially treated it as a genuine government request.
Identity Documents Among Exposed Information
The information provided to the unauthorized party included a broad range of customer records.
KYC Data and Transaction Records
According to customer notifications, the exposed information could include:
- Full name, date of birth and occupation
- Postal address, email address and phone number
- Passport or driver's license copies
- Verification selfies
- Account statements and account details
- Withdrawal records
- Full transaction histories, including Bitcoin activity
Revolut said the incident affected a limited number of customers, although it has not disclosed an exact figure. The company said it notified affected customers and the relevant authorities after discovering the fraudulent request.
Fraud Was Discovered Through Direct Verification
The suspicious request initially passed the company's normal checks because it originated from an authenticated government-domain account.
Revolut later contacted the government agency independently to verify the request. The agency confirmed that it had not submitted the information demand, exposing the deception.
The case demonstrates that valid email authentication does not necessarily prove that the person controlling an account is authorized to request sensitive information.
A Warning for High-Trust Data Requests
The incident highlights a difficult security problem for financial institutions: attackers do not always need to break into a company's infrastructure when they can manipulate a trusted communication channel.
Organizations handling sensitive customer information should therefore apply additional verification to unusual government or law-enforcement requests, particularly when they involve identity documents, financial records or authentication-related information.
The breach also shows why domain-level email authentication should be treated as one verification signal rather than definitive proof of the legitimacy of a request.