Revolut Accidentally Shares Customer Data with Fraudsters

Revolut informed customers on Friday, September 11 of a data security violation caused by employees handing a subset of clients personal identifying information (PII) and financial records to a third-party using a fake government email address. The request for information document appeared genuine and the fake government email address passed typical authenticity checks for emails (i.e. SPF, DKIM, DMARC protocols).

The data that leaked included PII, such as name, date of birth and occupation, as well as contract details such address email and phone. Know Your Customer (KYC) data, such as passport and driver license photos were provided. In addition, financial data, such was IBAN and crypto transaction history were given to the fraudsters.

No financial losses by affected customers have been reported as of yet, although well-known crypto security researcher ZachXBT, who was among the first to publicize the incident, said that the Revolut attack appeared to have been targeted at high net worth users.

Details are still emerging about the security breach, with the above-reported details shared online by individuals who received the notice from Revolut.
However, according to a Crypto Times report as of mid-day Saturday, Revolut had yet to issue a formal public statement regarding the incident.

Several hours later a Revolut spokesperson confirmed to a TechCrunch reporter that a “limited” number of customer had been impacted by the fraud attack.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information,” the spokesperson was quoted as saying by TechCrunch.

The spokesperson added, “Revolut systems and customer funds are unaffected.”

London-based Revolut has more than 80 million customers globally and operates as a bank in more than 30 countries, per its website. The fintech recently expanded its presence in markets including India, Mexico, France, and the UAE. Moreover, earlier this month, the U.S. Office of the Comptroller of the Currency granted a conditional approval to Revolut to set up a nationwide bank in the country, which the firm expects to launch in the first half of 2027.

Fraudbeat will continue adding information to this story as it develops.