SKN | Revolut Says Fake Government Email Exposed Sensitive Customer Data

Key Points

• Revolut disclosed sensitive information belonging to a limited number of customers after a fraudster used a legitimate government-agency email domain to submit fake data requests.
• Exposed information reportedly included passport copies, verification selfies and complete transaction histories, although Revolut said its systems and customer funds were not affected.
• The incident has renewed concerns over KYC data security and the risks created when financial institutions rely on identity-verification information and external data requests.

Revolut Discloses Customer Data After Impersonation Attack

Financial technology and banking company Revolut has acknowledged a security incident in which sensitive customer information was disclosed following fraudulent requests that appeared to originate from a legitimate government agency.

According to the company, an unauthorized third party used an authentic government-agency email domain to submit requests for customer information. The requests initially passed Revolut’s authentication checks before the company determined that they were fraudulent.

The exposed information included copies of passports, verification selfies and full transaction histories belonging to some affected customers.

Revolut said the number of impacted customers was limited and that those individuals were contacted directly after the company identified the incident.

Legitimate Government Domain Used in Fraud

The incident highlights a particularly challenging form of impersonation in which attackers exploit legitimate communication infrastructure rather than attempting to compromise Revolut’s own systems.

Requests sent from the government agency’s genuine email domain were initially treated as authentic by Revolut’s verification processes. The company subsequently determined that the requests were unauthorized.

Once the activity was detected, Revolut said it blocked the relevant address and notified the government agency whose domain had been misused.

The company also alerted law enforcement agencies and financial regulators.

A Revolut spokesperson said the incident did not affect the company’s systems or customer funds.

Sensitive KYC Information at Risk

The nature of the disclosed information makes the incident particularly significant.

Passports and verification selfies are commonly collected as part of know-your-customer procedures, while transaction histories can reveal detailed information about an individual’s financial activity.

Although the data was reportedly exposed through a fraudulent information request rather than a direct compromise of customer accounts, the incident demonstrates how sensitive information can become vulnerable through processes designed to support regulatory and law-enforcement requirements.

Crypto and financial-technology users have increasingly raised concerns about the concentration of identity information held by centralized financial platforms.

Crypto investigator ZachXBT reportedly assessed the incident as relatively limited in scale and suggested that high-net-worth customers may have been among the targets.

KYC Security Debate Intensifies

The disclosure triggered criticism on social media, particularly around mandatory customer identification and information-sharing requirements.

Marc Zeller, a figure in the decentralized finance community, said the incident reinforced his concerns that extensive KYC requirements can create additional risks for individuals when sensitive information is mishandled or exposed.

The debate highlights a fundamental trade-off facing financial institutions. KYC information can support compliance, fraud prevention and regulatory enforcement, but maintaining large repositories of highly sensitive personal and financial data also creates attractive targets and potentially serious consequences when access controls fail.

Outlook

The Revolut incident underscores that protecting customer data requires more than securing internal systems. Authentication procedures for external information requests can become a critical attack surface when legitimate government infrastructure is impersonated. For financial and crypto platforms, the episode is likely to add pressure for stronger verification procedures around sensitive data disclosures while keeping the broader debate over KYC requirements and customer privacy firmly in focus.