Customer Information Leaked After Revolut Falls Victim to Government Email Spoofing Attack
Scammers leveraged authentic government domain email to deceive Revolut into disclosing sensitive customer information
Banking and financial technology firm Revolut disclosed confidential information belonging to certain customers, which included passport documentation, identity verification photographs and complete records of financial transactions, following receipt of a deceptive information request that appeared to originate from an official government entity.
Information requests that arrived from an authentic government agency email domain successfully cleared Revolut's security authentication procedures, as reported by International Cyber Digest in a post on X. The company subsequently determined these requests were fraudulent in nature, with affected customers receiving notification of the breach on Friday.
Speaking to Cointelegraph on Saturday, a company spokesperson stated that "Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information."
The spokesperson further explained that following discovery of the breach, Revolut immediately blocked the suspicious email address and provided notification to the appropriate government agency. The company also informed law enforcement agencies and financial regulatory authorities about the incident.
"Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support," the spokesperson said.
According to reports, cryptocurrency investigator ZachXBT indicated his belief that the security breach was relatively small in scope and appeared to specifically target individuals with high net worth.
The security breach generated significant discussion on X, with multiple users expressing criticism toward the current system requiring mandatory disclosure of personal information. Marc Zeller wrote that he woke up to all his data being leaked by Revolut, adding: "Sharp reminder that KYC hasn't produced meaningful upside and has put many in harm's way."