Revolut Exposes Customer Data After Fraudulent Government Request

Revolut disclosed that it mistakenly provided sensitive customer information to an unauthorized third party after receiving a fraudulent request that appeared to come from a legitimate government agency, according to reporting highlighted by @coinbureau. The incident exposed personal and financial records belonging to a limited group of customers.

According to Reuters, Revolut confirmed that the request originated from a fraudulent email associated with a legitimate government agency domain. The company said its systems were not hacked and that customer funds were not affected.

Sensitive Identity and Bitcoin Transaction Data Exposed

The information potentially disclosed was extensive. Customer notifications reportedly listed passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, email addresses, phone numbers and IBANs.

The exposed records may also have included account statements, withdrawal records and full transaction histories, including Bitcoin activity. Revolut has not publicly disclosed the exact number of affected customers or identified the government agency involved.

The incident is particularly significant for cryptocurrency users because transaction histories can reveal detailed financial activity even when account credentials or funds themselves remain secure. Revolut said the affected customers were contacted directly and that relevant authorities and regulators had been notified.

Revolut Says Customer Funds and Systems Remain Secure

Revolut characterized the incident as a sophisticated external impersonation attack. The company said it later contacted the relevant government markets agency to verify the request, discovered the unauthorized source and blocked the email address.

The company has emphasized that the incident did not involve a compromise of its core systems or unauthorized movement of customer funds. The distinction means the event was primarily a data-disclosure incident rather than a conventional account or infrastructure breach.

The episode nevertheless highlights the security risks surrounding highly sensitive know-your-customer information held by financial and cryptocurrency platforms. Revolut itself requires identity documents and other personal information, including selfies in applicable jurisdictions, as part of its customer verification processes.

For affected customers, the immediate issue is therefore not reported loss of funds but the potential misuse of exposed identity and financial records. The next significant developments will depend on regulators' investigation, the identification of the compromised government channel and whether authorities determine how the unauthorized party obtained access to it.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.