The shift is that the break-in did not need a break-in. Revolut, Europe’s largest fintech, says fraudsters posing as government officials talked their way into customer records, and the haul reportedly included passports, driving licences and verification selfies.
Revolut called it a “sophisticated external impersonation scam.” An unauthorised party used an email address tied to a genuine government agency’s domain to submit requests for customer data, and those requests were treated as legitimate at first. The company blocked the address once it spotted the deception, then notified the agency, law enforcement, data protection authorities and financial regulators. “Revolut systems and customer funds are unaffected,” it said.
It has described the number of affected customers as “very limited.” It contacted around 700 people after an initial investigation.
What was taken
The exposure varies by customer, but it reportedly covers names, dates of birth, postal and email addresses, phone numbers, account statements, IBANs, withdrawal records, verification photographs, passports, driving licences and detailed transaction histories. Some customers were warned that records of their Bitcoin activity may also be out.
Mark Karpelès, the former chief executive of Mt. Gox, said he was among those notified. The notice he shared mentioned account statements, IBANs, withdrawal records and complete transaction histories. Blockchain investigator ZachXBT suggested the target was high-net-worth customers, though Revolut has not confirmed that.
The Financial Times reported that the criminals have threatened to publish the data unless Revolut pays a ransom. The Information Commissioner’s Office has reportedly opened an investigation after Revolut told the UK regulator.
A trusted domain is not proof
No software flaw was exploited. The weak point was the process for assessing official information requests. Banks handle such requests from police, courts, regulators and tax authorities all the time, and a message from a real government domain looks credible. But a domain only shows where an email came from, not that the sender is authorised, or that the legal paperwork is genuine.
The trick is established. In November 2024 the FBI warned of rising criminal chatter about fraudulent emergency data requests, built on compromised government and police email accounts. In 2022, similar forged requests reportedly got Apple and Meta to hand over user information.
Revolut has not named the agency whose domain was used. It also has not said when the requests began, how many were processed or what documents came with them.
For victims, the damage outlasts the news cycle. Passwords can be changed and cards cancelled, but a passport number, a home address and a selfie cannot. A scammer armed with a real balance or a recent Bitcoin transfer can make a fake security alert sound genuine.
