Revolut Discloses Customer Data Exposure After Email Scam

What happened: Digital bank Revolut confirmed that fraudsters obtained customer data—including passport scans, selfies, IBANs, and transaction histories—by impersonating a legitimate government email domain. The breach, executed via a spoofed official request, did not compromise Revolut’s internal systems or customer funds, according to the company. The incident was corroborated by multiple security outlets and affects an undisclosed number of users.

Why it matters: The breach highlights persistent vulnerabilities in data sharing protocols between fintechs and government agencies. While Revolut claims no financial losses occurred, the exposure of sensitive identity and transaction data raises concerns over potential phishing and identity theft risks for affected customers. The event underscores the need for more robust verification processes in responding to official data requests.

Source: Cointelegraph, TechCrunch, Bloomberg