How scammers got Revolut to hand over customer data itself

According to Britain News, Revolut disclosed sensitive customer information to scammers after receiving requests that appeared to come from a legitimate government agency email domain. The bank did not lose the data to a hack. It handed the data over, believing it was answering a lawful request.

Revolut confirmed the breach to TechCrunch and Reuters, describing it as a sophisticated external impersonation scam in which an unauthorized third party used a legitimate government agency domain email to submit fraudulent requests for information. That single sentence contains the whole mechanism. The scam did not need to break into Revolut's systems. It needed to look like it belonged inside a process Revolut already trusts: a government agency asking for customer records.

What was taken

The exposed data included customers' birth dates, phone numbers, postal and email addresses, and copies of passports and driver's licenses, according to a notification Revolut sent to affected clients. The compromised data may also have included verification selfies, account statements, and transaction histories.

That list is worth reading slowly. It is not a password or a card number. It is the set of documents someone would need to open a new account, apply for credit, or pass identity checks somewhere else, in the customer's name.

Where the scam depends on trust, not technology

The scam works because email domains carry authority that most people, and apparently most internal review processes, do not question. A request that arrives from a genuine government agency domain looks like it comes with legal weight behind it. Revolut has said the number of customers affected was limited, but has not said how many, or which government agency's domain was spoofed or compromised.

This is not the first sign of trouble around Revolut and impersonation. Police on the British island of Jersey warned Revolut users last month of a rise in fraud cases where victims received phone calls from people posing as Revolut's own support or security teams. Two different impersonation routes, aimed at two different targets: one at customers directly, one at the bank's internal request-handling process.

The tell for anyone affected

Nobody outside Revolut can check whether a request came from a real agency domain or a compromised one. What a customer can check is what happens next with their own documents. Anyone notified by Revolut that their data was exposed should treat their passport and driver's licence numbers as compromised, watch for new accounts or credit applications they did not open, and confirm directly with Revolut, through its own official channels, what specifically was disclosed about their file.

Revolut has continued expanding while this played out, gaining a banking licence in France last month and conditional approval from the US Office of the Comptroller of the Currency last week. The scam that got customer data out did not need any of that growth. It needed one email address that looked official enough not to be questioned.