Revolut confirmed the disclosure in a comment reported by TechCrunch. The company said it had uncovered a “sophisticated external impersonation fraud scheme” involving an email address from a legitimate government agency domain.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” a company spokesperson said.

Revolut did not disclose the number of affected customers, the country in which the incident occurred or the government agency whose domain was used. The company said it contacted affected customers directly, blocked the relevant email address and notified the government agency, law enforcement and relevant regulators.

“Revolut systems and customer funds are unaffected,” the spokesperson said.

Data potentially disclosed

ZachXBT, who reported the incident, said Revolut apparently failed to recognize the request as fraudulent because it came from a legitimate government agency domain. According to ZachXBT, the request was fulfilled on the assumption that it came from a genuine government body.

ZachXBT said the information potentially disclosed included customers’ full names, dates of birth, occupations, home mailing addresses, email addresses and phone numbers. It may also have included copies of passports or driver’s licenses, verification selfies, withdrawal records and bank statements containing IBANs, account status, opening dates and wallet numbers.

Complete transaction histories, including bitcoin activity, may also have been disclosed, ZachXBT said. Revolut said biometric information gathered during facial analysis was not compromised.

ZachXBT described the incident as a potentially targeted attack against high-net-worth customers but estimated that the number of affected users remained limited. Several customers have received warning emails from Revolut, according to ZachXBT.

Customers and industry figures respond

The incident prompted criticism of Revolut on X. Aave co-founder Mark Zeller said the exposure of his data was another reminder that know-your-customer procedures had created additional risks without providing significant benefits. Zeller said Revolut had recently demanded substantial personal information while threatening to close his account within 20 days, and that attackers were then able to exploit the information-request mechanism.

Customer Nikhil Foster said he received a notification stating that the disclosed information included a copy of his passport, a selfie and his full transaction history. He remarked that his “facial biometric data” was supposedly not compromised. Another user, Charles Reed, said he learned that his own data had been exposed through reports about the incident.

Financial expert Austin Campbell said banks and regulators “are deeply unprepared” for modern fraud. Campbell said the disclosure could expose Revolut to significant legal risks and provide criminals with another tool for attacks.

Helius co-founder and CEO Mert Mumtaz said such disclosures can lead to home robberies and losses of millions. In his view, if KYC requirements are retained, verification should be conducted exclusively through already available zero-knowledge proof technology.

Revolut’s expansion

The incident comes as Revolut expands its financial and crypto services. The company is preparing a secondary share sale that could value it at about $115 billion and is developing its own digital-asset products.

Early Revolut investor Max Karpis previously said about 80% of suspicious-transaction reports in Lithuania came from Revolut Bank. The company has also introduced EURR, its first euro-denominated stablecoin. Revolut said EURR complies with the European Union’s Markets in Crypto-Assets regulation and that it plans to expand its stablecoin lineup over time.

Source: Incrypted