LONDON, September 17 — Revolut has confirmed that it handed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain. The London-based fintech described the incident as a “sophisticated external impersonation scam,” saying “an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.” That is the shift worth watching. The attack did not crack Revolut’s defenses.
It walked through the front door wearing a government badge.
What was exposed
According to a notification emailed to affected customers and reviewed by TechCrunch, the exposed data included customers’ identity and contact details — birth date, postal and email addresses, and phone numbers — as well as copies of identity documents including passports and driver’s licenses. The notification said the data may have also included verification selfies, account statements, and transaction histories. A Revolut spokesperson told TechCrunch that a “limited” number of customers were impacted and that the company had contacted those customers directly.
Revolut did not disclose the exact number of impacted individuals, did not answer whether the incident was limited to a specific market, and declined to disclose the government agency involved. Revolut said it blocked the email address after discovering the scam and alerted the relevant government agency, law enforcement, and relevant regulators.
The company added that “Revolut systems and customer funds are unaffected.”
How the story surfaced
TechCrunch reported the incident on Saturday, September 12, at 7:40 a.m. PDT. Crypto security researcher ZachXBT posted about Revolut’s email to affected customers late on Friday, September 11, and said the incident appeared to have been targeted at high-net-worth users. Revolut has more than 80 million customers globally and operates as a bank in more than 30 countries, per its website, and has recently expanded its presence in markets including India, Mexico, France, and the UAE.
Earlier in September, the U.S. Office of the Comptroller of the Currency granted conditional approval to Revolut to set up a national bank in the United States, which the firm expects to launch in the first half of 2027. The fintech has also secured banking licenses in France and the U.K. in recent months.
The stakes
The breach lands as Revolut reportedly weighs a potential public listing that could value it at as much as $200 billion, up from its $75 billion private valuation in November. Watch this space. The trend underneath is not the breach itself but the vector — impersonation of trusted institutions, aimed at the companies that hold the most sensitive data.
For a fintech scaling toward a listing, the question now is how verification processes hold up when the request appears to come from the government itself.
