Revolut Released Customer IDs and Financial Data to a Fake Government Request

Revolut, a popular digital banking app, handed over customer identification documents and financial data to someone impersonating a government authority. The attacker used an official-looking email address from a real government domain to make the request seem legitimate, and the request was accepted.

This breach matters because it shows how scammers don't always need to hack their way in. Sometimes they just need to sound official enough to convince a company to hand over the keys themselves.

How It Happened

The attacker sent what looked like an official request from a government agency. The email came from a legitimate government domain, which gave it credibility. Revolut employees treated the request as authentic and released sensitive customer data without verifying the person behind it. No one called the government office to confirm the request was real.

What Data Was Exposed

Customers had their ID documents and financial information accessed. This type of data is valuable to scammers because it can be used to open fraudulent accounts, apply for loans, or sell on the dark web.

What You Should Do

If you use Revolut, monitor your account regularly for suspicious activity. Check your statements weekly. Watch for charges you didn't authorize and login attempts from unfamiliar locations. If you see anything odd, contact Revolut support immediately. You may also want to freeze your credit with the major credit bureaus (Equifax, Experian, TransUnion) to prevent someone from opening accounts in your name. This is free and takes about five minutes per bureau.

This is a reminder that even large, regulated companies can be tricked by convincing impersonation. No company is immune to social engineering. When you see official-looking requests for sensitive information, it's fair to ask questions. Even if the request seems to come from a trusted source.