British fintech Revolut confirmed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain.
The exposed data included customers' identity and contact details — birth dates, postal and email addresses, phone numbers — as well as copies of identity documents including passports and driver's licenses. The data may have also included verification selfies, account statements, and transaction histories, including Bitcoin records.
"Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information," a Revolut spokesperson told TechCrunch.
The company blocked the email address after discovering the scam and alerted the relevant government agency, law enforcement, and regulators. Revolut said its systems and customer funds are unaffected.
Well-known crypto security researcher ZachXBT posted about the incident, saying it appeared to have been targeted at high net worth users. The researcher flagged the breach after reviewing Revolut's notification emails to affected customers.
London-based Revolut has more than 80 million customers globally and operates as a bank in more than 30 countries. The fintech recently expanded into markets including India, Mexico, France, and the UAE. Earlier this month, the US Office of the Comptroller of the Currency granted conditional approval for Revolut to set up a national bank in the US, expected to launch in the first half of 2027.
The incident comes as Revolut reportedly weighs a potential public listing that could value it at as much as $200 billion, up from its $75 billion private valuation in November.
The breach highlights a growing class of social engineering attacks in which threat actors exploit the trust relationship between government agencies and regulated financial institutions. By compromising or spoofing official email domains, attackers can bypass standard verification procedures designed to protect customer data.
