Technology 4 min read By Callum Montgomery
Revolut discloses customer data after being deceived by fake government agency
Revolut has admitted that sensitive personal data from a limited number of customers was sent to an unauthorised third party after the fintech was tricked by fraudulent requests originating from an email domain linked to a legitimate government agency.
Revolut has disclosed that sensitive personal information belonging to a limited number of its customers was passed to an unauthorised third party after the digital bank was deceived by fraudulent requests sent from an email domain associated with a legitimate government agency.
The incident, which the company has described as a security breach, involved the disclosure of data including phone numbers, postal addresses, copies of identity documents such as passports and driving licences, and verification selfies. The information was handed over after Revolut believed it was responding to a genuine official request.
According to a notification issued by the company, the fraudulent requests appeared to come from an email address on a domain belonging to a real government body. That apparent legitimacy led Revolut staff to treat the correspondence as authentic, and the data was subsequently transmitted to the attackers.
The breach is the latest in a series of security challenges facing financial technology firms, which hold vast amounts of personal and financial data and are frequently targeted by increasingly sophisticated social engineering attacks. Unlike conventional hacking, these schemes rely on manipulating employees into believing they are dealing with trusted partners or authorities.
Revolut has not specified exactly how many customers were affected, describing the number as limited. The company has also not named the government agency whose domain was mimicked, nor has it provided a detailed timeline of when the breach occurred or when it was discovered.
The disclosure raises questions about the verification procedures that financial institutions use when responding to requests for customer data from official bodies. In the UK and across Europe, banks and payment firms are subject to strict data protection rules, and any unauthorised disclosure of personal information can trigger regulatory scrutiny and potential fines.
Revolut, which is headquartered in London and holds a European banking licence, has grown rapidly in recent years to become one of Europe's most valuable fintech companies, with millions of customers across the continent. Its expansion has been accompanied by heightened regulatory attention, particularly regarding its compliance and risk management systems.
The company has said it is contacting affected customers and has taken steps to address the incident. It is not yet clear whether the breach has been reported to the Information Commissioner's Office or to financial regulators, or whether any investigation has been opened.
For customers, the exposure of identity documents and selfies is particularly concerning because such data can be used to attempt identity fraud or to open accounts in their name. Phone numbers and addresses can also facilitate targeted phishing attempts.
Revolut has advised customers to remain vigilant against suspicious communications. The company has not indicated whether the attackers have been identified or whether any arrests have been made.
The incident underscores the growing risk that even well-resourced technology companies can be tricked by convincing impersonations of official bodies. It also highlights the importance of robust internal controls when handling sensitive customer information, especially in an era when remote communication and digital verification have become standard practice across the financial sector.
