Revolut Confirms Customer Data Exposed Through Fake Government Requests
British fintech Revolut has confirmed that sensitive customer data reached an unauthorized third party after fraudulent information requests were sent using a genuine government agency's email domain. The company says its systems and customer funds remain unaffected.
London-based fintech Revolut has confirmed it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent through a legitimate government agency's email domain. The admission came in a notification sent to affected customers and reviewed by TechCrunch.
The exposed information included customers' identity and contact details — birth dates, postal and email addresses, and phone numbers — along with copies of identity documents such as passports and driver's licenses. The notification also indicated that verification selfies, account statements, and transaction histories may have been included in the breach.
A Revolut spokesperson told TechCrunch that a "limited" number of customers were affected and that the company had contacted them directly. However, Revolut did not disclose the exact number of impacted customers, would not say whether the incident was confined to a specific market, and declined to name the government agency whose domain was impersonated.
Response and safeguards
Revolut said it blocked the email address used in the scam once it was discovered and notified the relevant government agency, law enforcement, and applicable regulators. The company stressed that its systems and customer funds were not affected by the incident.
Crypto security researcher ZachXBT shared Revolut's notification to affected customers, suggesting the scam appeared to target high-net-worth users specifically.
Revolut serves more than 80 million customers worldwide and operates as a bank in over 30 countries. The company has recently expanded into markets including India, Mexico, France, and the UAE, and earlier this month received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank, with a launch expected in the first half of 2027. The breach emerges as Revolut reportedly considers a public listing that could value the company at up to $200 billion.
