Revolut's fake government request exposes the weakest door in a bank

Revolut confirmed on September 12 that it had disclosed sensitive customer information to an unauthorised third party after receiving fraudulent information requests sent from the email domain of a genuine government agency. The London-based group, which has more than 80 million personal customers, described the episode as "a sophisticated external impersonation scam". It said it blocked the address once the fraud was detected, alerted the agency concerned as well as enforcement agencies, data protection authorities and financial regulators, and that "Revolut systems and customer funds are unaffected". It has not named the agency, nor said how many customers were affected beyond calling the number "limited".

The data involved is the most valuable a bank holds. According to customer notifications seen by several outlets, it included full names, dates of birth, occupations, home and email addresses, phone numbers, copies of passports or driving licences, the selfie taken during onboarding, account statements with IBANs, withdrawal records and full transaction histories, including Bitcoin activity. By Monday, The Register reported, people claiming responsibility were posting samples in Telegram groups and demanding 10,000 Bitcoin. Revolut did not comment on the demand.

No exploit, no malware, one email

What sets this incident apart is that nothing was broken into. Revolut's notice to customers said the request "carried valid domain authentication credentials" and was therefore fulfilled under the "reasonable belief" that it came from the real agency. In other words, the message passed the technical checks that are supposed to separate genuine mail from spoofed mail, because it was sent from a real mailbox on a real government domain. Revolut established only later that the request was not genuine, and says it then contacted the agency to validate it and to alert it to the unauthorised user.

This is a familiar technique, now aimed at a much richer target. In November 2024 the FBI issued a private industry notification warning that criminals were using compromised US and foreign government email accounts to send fraudulent emergency data requests to companies. It cited forum posts advertising "High Quality .gov emails" for social engineering and data extortion, a seller claiming control of government accounts in more than 25 countries, and an offer to teach anyone to file such requests for $100. One fraudulent request submitted to PayPal, the bureau noted, was rejected. Until now the public cases have mostly involved social networks and technology platforms, where the prize is a phone number or an IP address. A neobank holds a verified identity, a face and a complete financial history in one file.

KYC data is a honeypot by design

Regulation obliges banks and payment firms to collect exactly this material. Know-your-customer rules require a passport scan, proof of address and, at most digital lenders, a live selfie matched against the document. That makes every regulated fintech a concentrated store of the very data needed to open accounts in someone else's name, to defeat another firm's identity checks, or to target individuals in person. ZachXBT, the crypto investigator who first circulated a customer notice, said the request appeared aimed at high net worth users. As Decrypt noted, that is a concern given the rise in so-called wrench attacks, in which criminals coerce holders of digital assets physically.

The pairing of a selfie with a transaction history is particularly damaging. A stolen password can be changed. A passport number lasts for a decade, and a face does not change at all. Revolut said biometric facial telemetry was not shared, according to the notification as described by Privacy Guides and Decrypt, but the onboarding image itself was.

A process failure, not a technology failure

Security budgets at fintechs are overwhelmingly spent on systems: fraud engines, device fingerprinting, encryption, access controls. The Revolut case shows that a legal and compliance workflow can bypass all of them. Requests from police and government bodies typically arrive by email or portal, are handled by a small team under time pressure, and are designed to be answered quickly, because refusing a genuine request can carry legal consequences. The FBI's own guidance captures the tension: criminals "understand the need for exigency", and use it to short circuit review.

The controls that matter here are procedural. They include calling back the requesting authority on an independently sourced number before releasing anything, limiting disclosures to the minimum fields a stated legal basis requires, routing bulk or multi-customer requests to senior sign-off, and refusing to send identity documents by ordinary email at all. None of these is expensive. All of them slow things down, which is why they erode in fast-growing companies whose request volumes rise with their customer base. Revolut, which now operates as a bank in more than 30 countries, receives requests from many jurisdictions, each with its own agencies, formats and legal codes. That variety is exactly what makes a forged or misused request harder to spot.

Regulators, valuations and the vendors behind identity checks

The timing is awkward. Revolut secured its UK banking licence in March, and earlier this month the US Office of the Comptroller of the Currency granted conditional approval for a national bank. It was valued at $115 billion in an employee share sale in July, up from $75 billion last November, and its chief executive, Nik Storonsky, has hinted at an eventual listing, not before 2028, at around $200 billion. Bank supervisors judge applicants partly on the maturity of their controls, and data protection authorities in Europe can impose fines tied to global turnover. A disclosure caused by human judgement rather than a sophisticated intrusion is the kind of finding that tends to invite questions about governance more broadly.

For investors in neobanks the lesson is that operational risk does not scale linearly. A firm can double its customers while its legal response team, vendor oversight and manual approval steps stay roughly the same size. For identity verification providers, the incident cuts both ways. It strengthens the case for tools that authenticate counterparties, including government senders, rather than relying on email domain checks. It also adds weight to arguments, voiced loudly by crypto users after the news broke, that the industry collects and retains too much raw identity data in the first place, which could push regulators and clients towards tokenised or minimised verification.

Our view

Revolut will likely survive this reputationally; it has weathered a social engineering breach before, in 2022, which exposed data on 50,150 customers. The broader point matters more. The attack surface of a modern bank now includes every inbox that can release customer data on the strength of an official-looking letter, and the authentication protocols that protect those inboxes do nothing if the sender's own mailbox is compromised. Founders building regulated financial products should treat lawful access requests as a high-risk transaction, with verification as strict as a large outbound payment. Investors doing diligence on fintechs should ask how such requests are verified, who signs them off and what data can leave by email. What to watch: whether Revolut names the agency and the number of customers affected, whether the UK and EU authorities open formal inquiries, how the extortion claims develop, and whether other banks disclose that they received similar requests.

Sources

• TechCrunch: Revolut confirms customer data breach through fake government requests
• The Register: Revolut falls for fake government requests, hands over customer data
• BleepingComputer: Revolut discloses data breach exposing financial info, passports
• Decrypt: Revolut leaks passports, Bitcoin transaction histories to fake government request
• Privacy Guides: Revolut gives away customer passports, selfies, and transaction histories to a fake government request
• The Irish Times: Revolut blames sophisticated impersonation scam for customer data breach
• The Paypers: Revolut confirms data breach after fake government requests
• FBI IC3: Fraudulent emergency data requests impact US-based companies and law enforcement agencies

Filed under Cybersecurity. Written by Invest Times Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.