Revolut falls for fake government requests, hands over customer data

British bank Revolut exposed sensitive customer information after falling for fraudulent requests sent from a legitimate government agency's email domain.

In a statement shared with The Register, Revolut confirmed the attack, but did not specify how many customers were affected.

The company also did not provide a list of affected data types.

However, blockchain investigator ZachXBT, who shared Revolut's customer notifications on Friday, claimed the exposed information includes know-your-customer (KYC) data.

Whichever identity document customers submitted as part of the account registration process – passport or driver's license – was compromised, as was the verification selfie submitted through the app, according to the shared emails.

The notifications also list account statements, IBANs, withdrawal records, and full transaction histories, including Bitcoin transactions, among the exposed data.

Other exposed details include full names, dates of birth, home and email addresses, phone numbers, and occupations.

Sources close to the fintech say only a small proportion of its customers were impacted.

They say ongoing investigations and confidentiality obligations prevent Revolut from providing further details.

Revolut said it exposed the data to an unauthorized third party after they submitted requests from a genuine government agency's email domain.

The company, which received approval to launch its UK bank in March, did not identify the government agency, but said it informed the relevant officials of the findings.

"Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information," the spokesperson said.

"Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators.

Revolut systems and customer funds are unaffected.