Revolut disclosed sensitive information about a limited number of customers after an unauthorized party submitted fraudulent requests through a legitimate government agency email domain, the fintech has confirmed. The incident did not require an intrusion into Revolut’s systems; it exploited the process used to assess and answer apparently official demands for customer data.
The company has not identified the government agency, the jurisdictions involved or the number of affected customers. Those omissions leave important questions unanswered about the incident’s reach and the request-validation controls that failed.
Identity documents and transaction records were exposed
TechCrunch, which reviewed a notification sent to affected customers, reported that the disclosed material included identity and contact information such as dates of birth, postal and email addresses and phone numbers, along with copies of passports or driving licences. Revolut’s notification said the data may also have included verification selfies, account statements and transaction histories, according to the report.
RTÉ separately reported that Revolut had told some customers their passport or driving-licence copies and contact details had been handed to criminals. Revolut has not publicly provided a complete field-by-field inventory applicable to every affected person, so the reported categories should not be read as confirmation that each customer’s entire record was disclosed.
In a statement carried by TechCrunch and RTÉ, Revolut said it identified a “sophisticated external impersonation scam” in which an unauthorized third party used a legitimate government agency domain email to submit fraudulent information requests. The company said it blocked the address after detection and alerted the relevant agency, enforcement bodies, data-protection authorities and financial regulators. It also said its systems and customer funds were unaffected and that it contacted impacted individuals directly.
Revolut did not disclose whether the agency email account itself had been compromised, whether another mechanism was used to send messages from the domain, how many fraudulent requests were accepted, or how long the activity continued. It also has not said whether it has found subsequent misuse of the disclosed records. The absence of those details makes it premature to characterize the full attack path or quantify downstream harm.
A trusted channel is not the same as an authorized request
The central control issue is not simply email security. A message can originate from infrastructure that appears authentic while the person operating the account, the legal authority cited and the requested scope remain unverified. Financial institutions routinely need to respond to lawful demands, but sender-domain checks alone cannot establish that a particular request is genuine and properly authorized.
Revolut has not described the checks applied in this case, so there is no public basis to claim that it relied only on the email domain. The incident nevertheless shows why regulated firms need layered verification around government and law-enforcement request channels. That includes validating the requesting official through independently maintained contact details or an authenticated portal, confirming a case or reference number outside the originating email thread, and checking that the authority and requested data match the jurisdiction and purpose stated.
Requests for high-risk records should also trigger stronger internal review. Passport images, identity selfies and detailed transaction histories can be more useful to an impersonator than ordinary contact data because they may help make later approaches sound credible. Dual approval, field-level disclosure controls and documented legal review can reduce the chance that one convincing message releases a broad customer file.
The risk continues after the initial disclosure
Revolut’s statement that customer funds and systems were unaffected is an important boundary: the disclosed incident is not, on the available evidence, a compromise of customer balances or the company’s production environment. It does not remove the risk created by durable identity data.
Unlike a password, a date of birth or passport image cannot be meaningfully rotated on demand. Combined with contact details and transaction information, those records could support targeted impersonation, account-recovery attempts or fraudulent applications. These are risks arising from the data set, not confirmed outcomes of this incident.
RTÉ cited ESET Ireland warning that someone holding accurate identity details could pose as a bank fraud investigator and pressure a victim to move money. Affected customers should therefore treat unexpected calls or messages that quote genuine personal or transaction information as unverified and reconnect through Revolut’s official app or another independently sourced channel. Revolut said it contacted the affected individuals directly, but neither the company nor the reports reviewed here specified a universal remediation package.
What payment and compliance teams should test now
Banks, fintechs and payment providers should treat government-request handling as a privileged data-disclosure workflow rather than a shared mailbox function. Useful controls include an allowlisted request portal, out-of-band verification for new officials or changed contact details, separation between intake and approval, narrowly scoped exports, secure time-limited delivery and immutable records of who approved each disclosure.
Monitoring should look beyond obviously fake domains. Sudden changes in an official’s request pattern, unusually broad record demands, repeated requests for identity images, new recipients and compressed deadlines can all justify escalation even when email authentication passes. Firms should also test whether staff can halt delivery after approval but before a file is retrieved, and whether they can quickly identify every customer and data field included in a questionable disclosure.
The remaining accountability questions are concrete: how the government-domain channel was abused, which validation step accepted the requests, the number and location of affected customers, the disclosure period, and whether regulators identify any breach of legal or supervisory obligations. Until Revolut or the relevant authorities provide those answers, the verified conclusion is narrower but still consequential: a fraudulent requester passed through a trusted government communication channel and obtained sensitive customer records.